Today, the next generation of embedded systems are increasingly connected, software-defined, exposed to a growing stream of vulnerabilities, and must adhere to stricter cybersecurity requirements. This has largely influenced regulatory compliance and certifications that mandate making systems safe and secure. Companies building embedded systems today are expected to monitor, remediate known common vulnerabilities and exposures (CVEs), provide secure update mechanisms, and support products for their intended operational lifetime.

Especially relevant in this context is the EU Cyber Resilience Act (EU CRA), which we outlined in the earlier parts of this series.

Recap

The EU Cyber Resilience Act ultimately comes down to two tightly connected pillars: cybersecurity requirements and vulnerability management.

On one side, products must be secure by design and by default — engineered to minimize attack surfaces, protect data confidentiality and integrity, prevent unauthorized access, and maintain resilience even under adverse conditions.

On the other, manufacturers are expected to operationalize continuous vulnerability management: identifying and documenting components, remediating issues without delay, disclosing vulnerabilities responsibly, and delivering timely, secure updates throughout the product lifecycle. This is delved into in more detail in this “Are you EU CRA Ready” blog post, where companies need to operationalize on getting ready for EU CRA.

Together, these expectations shift the focus from point-in-time compliance to sustained, lifecycle accountability.

At the same time, the operating environment for embedded systems has fundamentally changed. Devices are no longer short-lived or static – they are deployed for years, often decades, and are increasingly connected to broader networks, cloud services, and other systems. This extended lifespan and expanded connectivity significantly widens the scope of what must be secured, turning once-isolated components into continuously exposed assets. As a result, the threat landscape evolves alongside them: vulnerabilities are no longer one-time risks but persistent entry points that can be discovered, exploited, or weaponized long after deployment. For critical systems, this shift raises the stakes, requiring not just robust initial design but the ability to monitor, respond, and adapt to emerging threats over time. The timing of implementing EU CRA is coming up soon, and how this impacts organizations. Being ready for the EU CRA regulation is important and this is addressed in more detail in this second blog post: “Why the EU CRA Matters Now”.

In this final part, we look at how that mandate translates into practice, through foundational software like QNX and over-the-air (OTA) update solutions such as Mender, that enable products to remain secure, adaptable, and compliant long after they’ve been deployed.

Secured systems begin with a reliable microkernel OS

Secure-by-design systems start with a deliberate choice at the foundation: a microkernel operating system. By keeping only the most essential services, such as scheduling and inter-process communication, inside the kernel, a microkernel dramatically reduces the trusted computing base and, in turn, the overall attack surface. Services such as drivers, file systems, and networking are isolated in the user space, so a failure or compromise in one component does not cascade across the entire system. This architectural separation enforces strong boundaries, enables least-privilege design, and supports fault containment - principles that are essential for meeting modern cybersecurity expectations. In the context of long-lived, connected devices, starting with a microkernel isn’t just a design preference; it establishes a resilient, adaptable core that can evolve securely as new vulnerabilities and threats emerge.

This foundation comes to life with QNX® Software Development Platform (SDP) 8.0, the next-generation foundational development platform that comes with the microkernel QNX OS 8.0, purpose-built for modern, connected systems. Designed to meet the demands of both cybersecurity and functional safety, it combines a hardened kernel with deterministic real-time performance, ensuring systems behave predictably even under stress. Its fault-tolerant architecture isolates failures, preventing their propagation and enabling continuous operation in critical environments. Beyond security and safety, it is engineered to scale seamlessly with evolving hardware, from resource-constrained edge devices to high-performance compute platforms, a consistent, reliable foundation that can grow alongside system complexity while maintaining strict control over risk.

QNX SDP 8.0 is designed with certification and compliance in mind, aligning with standards such as IEC 62443 and supporting the requirements set out by the EU CRA. Our architecture, development processes, and security capabilities map closely to the expectations for Class I and Class II products, including QNX OS 8.0 and QNX Hypervisor 8.0 and affiliated safety products, where assurance, traceability, and lifecycle security are critical. From secure-by-design principles and strong isolation to built-in mechanisms for access control, data protection, logging, and update management, it provides the technical and process foundation needed to demonstrate conformity. QNX SDP 8.0 is not just a secure platform, but one that enables manufacturers to streamline certification efforts and confidently meet evolving regulatory demands.

Secure for a lifetime with a foundational OS augmented by a robust OTA update platform

As the EU CRA makes clear, security does not end at manufacturing. Maintaining that integrity over years in the field requires a continuous ability to identify, remediate, and respond to vulnerabilities in a timely manner. Over-the-air updates enable manufacturers to deploy security patches, OS updates, application fixes, and configuration changes to devices already in use, without the time delays of physical or manual intervention. To address this lifecycle challenge, QNX extends its foundation through a strategic partnership with Northern.tech, bringing robust OTA updates and fleet management capabilities into the platform.

This collaboration integrates QNX with Mender, an enterprise-grade OTA update solution purpose-built for embedded systems. Mender enables manufacturers to securely deliver software updates across distributed device fleets, regardless of connectivity constraints or deployment scale. Its architecture is designed for reliability and flexibility, supporting everything from full system image updates to granular application and configuration changes.

By combining QNX’s secure runtime environment with Mender’s OTA update and fleet management capabilities, organizations gain an end-to-end solution that ensures devices remain protected, compliant, and up to date throughout their operational life. From the moment a product leaves inventory to its safe and secure decommissioning, Mender ensures security at the device, fleet, and operational levels.

Establishing robust software management strategies that ensure security

From a capabilities perspective, manufacturers can leverage multiple update strategies depending on system requirements and device lifecycle stage. This includes targeted file-level updates for lightweight changes, as well as robust A/B (dual-partition) system updates for critical components.

• For complete new system updates (operating system), Mender leverages A/B updates to provide a fail-safe mechanism. The update is deployed to an inactive partition, verified, and then switched over, ensuring that rollback is always possible in the event of failure. For complete A/B updates, the system maintains two root file systems (rootfs): the active partition and the standby partition. Updates are written to the standby partition, validated, and marked for boot. When the boot is successful, the standby partition becomes the active partition, completing the update cycle. Should the boot fail for any reason, the device will revert to the active partition (with the new update remaining in the standby partition), ensuring operability is never compromised due to an update. The device is always left in an operational state.
• File-based updates allow specific applications, configurations, or security patches to be modified without impacting the full system image, reducing bandwidth and downtime. For file-level updates, Mender leverages customizable Update Modules that interact with the QNX environment to safely replace or modify targeted components.

Technically, this is achieved through a combination of a secure boot chain, signed update artifacts, and atomic installation processes. Mender manages the deployment workflow, delivering cryptographically verified update payloads to devices running QNX. Throughout this process, integrity checks, authentication, verification, and logging ensure that every update is secure, traceable, and compliant with modern regulatory expectations.

Critical compliance elements for EU CRA

Together, QNX and Mender provide more than just update capability; they deliver a continuous security lifecycle. While secure-by-design product foundations and robust OTA updates address key requirements of the EU CRA, the combination also covers:

• First boot update: Device security is not a static state. New software is often deployed during the gap between original software provisioning during manufacturing and the initial device activation and use—typically three to twelve months. Mender automatically updates QNX devices to the latest software version as its first action in the field, ensuring that devices in inventory remain secure when initially activated.
• Secure original state: Mender allows manufacturers to configure a QNX device and restore it to its original secure state. Any fixed bugs, patches, or other security improvements should not be lost when ‘resetting’ the device. If remediations are lost on reset, the ‘factory reset’ state should also be configured to immediately update for any known vulnerabilities so that the device is in a secure state on reset.
• Inventory: Mender provides a real-time inventory of the software components installed on a device, enabling efficient vulnerability management and up-to-date software bill of materials (SBOM) generation.
• Vulnerability management: Vulnerabilities can be identified, patches developed and validated, and updates deployed in a controlled, auditable manner.

Just as importantly, QNX and Mender enable manufacturers to shift from reactive compliance to proactive secure lifecycle management, where security and all elements fundamental to it are an integral and reliable part of system operations rather than a disruptive afterthought.

Looking ahead

The EU CRA ultimately asks manufacturers to think like architects, not inspectors. Building a secure digital product is much like building a home: it starts with a solid foundation, deliberate design choices, and an understanding that protection, including the warranties, must endure long after the front door closes for the first time. A microkernel OS provides that concrete foundation — minimizing cracks, isolating weaknesses, and ensuring the structure holds firm under pressure — while continuous OTA updates function like ongoing maintenance, reinforcing doors, replacing vulnerable materials, and adapting the house to new threats as the environment changes.

With QNX and Northern.tech working together, security is no longer a one-time build, but a living system designed to withstand storms, evolve over decades, and protect what matters most throughout its entire lifecycle. That is the true intent of the EU CRA: not compliance for today, but resilience for every day that follows.