PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

UK PSTI Act: ‘World first’ IoT security rules offer reminder of VDP virtues

yeswehack.com | blog | #iot | #vdp | #regulation | #uk | #smart-devices | #psti
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

UK PSTI Act: the 'world first' IoT law, in force since 29 April, mandates vulnerability-report contacts, bans weak default passwords and sets update commitments; 76% of vendors still lagged.
Published
Collected

Related coverage

blog · netspi.com
IoT: Great Holiday Gift or Network Security Nightmare?
Learn why IoT devices may be the next big security risk – for both employees' personal lives and corporate networks.
vulnerability · hackerone.com
Vulnerability Disclosure Policy Requirements for UK Smart Products
The UK PSTI Act takes effect in late April, requiring consumer smart device makers to ship unique default passwords, publish a vulnerability disclosure policy, and commit to security update periods.
research · eshard.com
What does the EU Cyber Resilience Act (CRA) mean for connected device manufacturers?
The Cyber Resilience Act is a new legislation proposed by the European Commission to improve the cybersecurity posture of organisations using digital assets.
blog · yeswehack.com
EU Cyber Resilience Act: Manufacturers face 24-hour deadline to report actively exploited vulnerabilities
The EU CRA's vulnerability reporting rules took effect on 11 Sept 2026: makers of digital products must report actively exploited vulnerabilities within 24h, facing fines up to EUR 15M.
blog · yeswehack.com
YesWeHack joins G-Cloud framework for UK public-sector procurement after clearing rigorous evaluation
YesWeHack joined the UK's G-Cloud 15 framework after evaluation: public-sector bodies can now procure its bug bounty and agentic continuous pentest services without running tenders.
blog · yeswehack.com
The prioritisation problem: dealing with a growing vulnerability backlog
YesWeHack explains why CVSS alone cannot set remediation priorities as backlogs grow, and how exploitability, exposure and asset value help rank findings from Bug Bounty, VDP and pentest sources.
Back