Report a hacked product in 24 hours

The alarm works. The question is who it rings.

Does your company sell or make anything with software inside it? From tomorrow, Friday 11 September, a European law gives you 24 hours to report it when that…

• The clock is 24 hours and it starts when you find out. An early warning within 24 hours, a fuller notification within 72, and a final report within 14 days of having a fix available. For a serious incident the final report is within a month.
• You file once. The European Commission says manufacturers "report only once through the CRA Single Reporting Platform", the portal that opens the same day. It routes your report onward for you.
• In Belgium it reaches CERT.be, the national team at the Centre for Cybersecurity Belgium. Worth knowing the name now rather than looking it up at eight on a Sunday morning.

European Commission: Cyber Resilience Act reporting obligations → https://digital-strategy.ec.europa.eu/en/policies/cra-reporting

We did not notice for three days

Twenty-four hours sounds like plenty. Let me tell you about my week.

A partner tried to start an assessment. It would not run. Their link to Microsoft had been dead for three days. We had a monitor. It counted failed syncs. But the link never failed, it just stopped answering.

Your IT provider's tool was wide open

The extinguisher was last checked by the man who sold it.

On 5 September N-able rushed out an emergency fix for N-central, the software many IT companies use to run every computer they look after.

• Why this one is worse than an ordinary flaw. N-central is a remote control room. Whoever takes it can reach every machine it manages, at every client that provider serves. One break-in, everybody's computers.
• The number your IT partner needs to answer with is 2026.3.1.14. That is the fixed build, shipped as Hotfix 4 on 5 September. Anything older than it is the vulnerable one.
• N-able said two different things, and both are on the record. Its public advisory said there were "no confirmations that this vulnerability has been exploited in production environments". A separate urgent notice sent to customers said it "has been observed being exploited in the wild" and called it a zero-day, meaning it was attacked before a fix existed. The security firm Huntress reported attempts across several of its customers. We are printing both, because the public page on its own would have told you to relax.

CISA: four known exploited vulnerabilities added, 8 September 2026 → https://www.cisa.gov/news-events/alerts/2026/09/08/cisa-adds-four-known-exploited-vulnerabilities-catalog

Your score now names the machines it missed

A good inspector writes down the door that does not close.

Your readiness score used to give you a number. Now it gives you a list of names.

• "Partly covered" is a real answer now. A control used to be pass or fail. Most are neither. You now see which machines and people it misses, by name.
• A dead connection stops counting in your favour. If the link to Microsoft or your antivirus breaks, your score says so instead of coasting on the last good reading. Two stories up is why we changed that.
• Meet Norm. He sits on your dashboard and gives you the verdict: where you stand today, the way an assessor would put it. Patch helps you. Norm marks you.

See what an assessor asks for → https://easycyberprotection.com/learn/cyberfundamentals/audit-preparation/