For executives
Checked once, changed a hundred times. The difference is on your books.
Your product was checked once. It has changed many times since. The gap between the two is a cost that shows up in five places.
Large customers ask how they can check what runs on their data. Each week a deal sits in security review is a week of delayed revenue, and some reviews end with no.
The Cyber Resilience Act allows fines up to 15 million euros or 2.5 percent of worldwide turnover. The AI Act goes up to 35 million euros or 7 percent for the worst cases. NIS2 allows up to 10 million euros or 2 percent for essential entities.
IBM puts the average cost of a data breach in 2026 at 4.99 million dollars, and more than twice that in the United States. Breaches that take longer to find cost more. A product that reports its own state shortens the search.
When a flaw is announced and you cannot tell which units are affected, you treat all of them as affected. That means stopping fleets, re-imaging machines or sending technicians.
Teams spend weeks each year collecting screenshots for auditors. Evidence the product produces by itself is collected once and reused for every audit and every customer.
Fine levels are the maximums in the regulations. The breach figure is from the IBM Cost of a Data Breach Report 2026. This page is not legal or financial advice.
| When this happens | Without re-attestation | With it |
|---|---|---|
| A vulnerability is announced | Days of inventory work, then a broad shutdown to be safe | A list of affected units within hours, and a targeted fix |
| A customer's security team asks for proof | Policies, questionnaires and a long wait | Evidence they verify themselves |
| An update goes out | You assume it arrived | Each unit shows the new version, or is flagged |
| The auditor or insurer comes | A yearly evidence hunt | A report from data you already hold |
| You buy or sell a company | Nobody can say what the product fleet runs | A verifiable inventory on the day |
This is engineering work measured in weeks. Most of the hardware is already paid for: the security chips are in your servers, processors and devices today. What is usually missing is the design that uses them, and the routine that repeats the proof.
Working on the business case? A first call takes 30 minutes and commits you to nothing. Bring your product and the one question that worries you.
Next fixed date: EU Digital Identity Wallets are due in every member state on 24 December 2026, 42 days from now.