To coincide with the launch of PCA CERVUS, the embedded product threat intelligence platform, we want to explain what threat intelligence for embedded products is, who needs this kind of solution, and why they need it.

TL;DR: Product security threat intelligence is threat intelligence about embedded products that tracks new vulnerabilities and exploits of components in a device, supporting compliance and product security across the whole product lifecycle.
Components like operating systems, chipsets, and third-party libraries are the source of truth for product threat intelligence.
A product-focused or device-centric threat intelligence platform like PCA CERVUS will match information about these components (taken from a product SBOM) with live data on exploits and threat actor behavior.
This is an automated process that results in a prioritized list of actions that a product engineering or product security team can use to make a device secure, reduce risk to the business, and support compliance with regulations like the Cyber Resilience Act.

Below, we explain in more detail how this kind of threat intelligence differs from what you might call “traditional” threat intelligence and traditional threat intelligence platforms. 

Traditional Threat Intelligence vs Threat Intelligence for Embedded Products

Traditional threat intelligence platforms and platforms like PCA CERVUS do different jobs, so you don't have to choose between them. Traditional platforms focus on threat intelligence for the SOC. PCA CERVUS covers embedded products.

The table below compares the two types of platforms:

What Are Some Examples of Threat Intelligence for an Embedded Product?

Product threat intelligence connects vulnerability information with the specific products, components, and risks that matter to a product manufacturer. For example, it can identify a newly disclosed CVE affecting a component embedded in a device, assess its exploitability and risk, determine which products and product lines use the affected component, and track whether a patch has been integrated into those products.

The PerfektBlue vulnerabilities illustrate the security risks that can affect embedded products and the importance of understanding their potential impact.

PerfektBlue is a collection of four vulnerabilities in OpenSynergy’s BlueSDK Bluetooth stack, which is used in embedded systems, particularly in vehicles. Our security researchers discovered these vulnerabilities in 2024. While individual vulnerabilities may not necessarily be considered highly severe, chaining them together enables remote code execution with at most one user interaction.

Our team demonstrated the vulnerabilities on infotainment units from Mercedes-Benz and Volkswagen, among others.

Understanding the broader product impact is where product threat intelligence comes in. Beyond identifying vulnerabilities, it helps manufacturers determine which products are affected, assess the associated risks, and track remediation across their product portfolios. This product-specific context is often missing from generic threat intelligence platforms, making product-focused threat intelligence an important part of embedded product security.

What Kind of Organizations Should Use a Threat Intelligence Platform Specifically for Embedded Products?

Our recommendation is that companies that manufacture or rely on embedded products use both kinds of threat intelligence platforms because both have different purposes. 

• Product threat intelligence platforms like PCA CERVUS support product security and the work of product engineering teams, security teams, or PSIRT, who use the intelligence to triage vulnerabilities and work on fixes. 
• “Traditional” threat intelligence platforms like those sold by Recorded Future, ThreatConnect, CrowdStrike and similar support the work of the SOC.

As per the table above, an embedded threat intelligence solution like PCA CERVUS is a solution for monitoring risks to embedded products throughout their lifecycle. The purpose of this kind of threat intelligence is to help engineering teams prioritize fixes that improve device security and reduce their direct and supply chain risk exposure.

Examples of the kinds of companies that need a product threat intelligence platform like PCA CERVUS include:

• Payment terminal manufacturers and payment service providers that deploy terminals at scale.
• Car makers and their Tier 1 and Tier 2 suppliers, such as makers of infotainment units and telematics modules.
• EV charger manufacturers and charge point operators.
• Industrial automation vendors that build PLCs and other controllers.
• Energy and utility companies running connected equipment such as smart meters.
• Consumer IoT brands, from smart home devices to wearables.
• Medical device manufacturers with connected products.

These organizations will also use a traditional threat intelligence platform to inform their SOC work, for example to keep SIEM detection rules effective against the latest threats.

That said, a product threat intelligence platform like PCA CERVUS goes beyond product security. It can also provide full visibility over the threats targeting company secrets, infrastructure and code.

How Product Threat Intelligence Supports Regulatory Compliance

Beyond making products more secure, decreasing supply chain risk and prioritizing engineering work, a core driver for embedded product threat intelligence is to meet evolving compliance requirements. 

Regulators now expect manufacturers to keep monitoring their products after release and to act on new vulnerabilities within a set time. 

For example:

• Cyber Resilience Act (CRA). Since 11 September 2026, manufacturers must report actively exploited vulnerabilities in their products, with an early warning within 24 hours and a fuller notification within 72 hours.
• UNECE R155. Since July 2024, no new car can be registered in the EU without a valid CSMS certificate and a cybersecurity type approval. Manufacturers must monitor for threats and vulnerabilities.
• RED and EN 18031. Since 1 August 2025, internet-connected radio equipment sold in the EU must meet the cybersecurity requirements of the Radio Equipment Directive, using the EN 18031 standards to show compliance, which creates a requirement for tracking new vulnerabilities.th a platform like PCA CERVUS, these requirements are fulfilled automatically and to the highest possible level, with live prioritized reporting on product vulnerabilities provided automatically.

How Product Threat Intelligence Platforms Work

PCA CERVUS matches vulnerability intelligence to the components in each product, using the xBOM as the device model. It validates SBOMs, helps generate missing ones, and verifies that patches close the exposure. 

The product threat intelligence workflow, from the user perspective, is:

1. Upload an SBOM as a JSON file.
2. PCA CERVUS reviews the SBOM and validates the software components in the product or device
3. A list of new vulnerabilities in that SBOM is found.
4. The exact products affected are identified.
5. Risks are prioritized based on the real-world exploitability of the components.
6. A list of exact fixes to be made is created and can be sent to engineering.

This process was built based on PCA Cyber Security’s extensive experience working with dozens of real product security teams since 2019 and is designed to give product users direct visibility into risks and the ability to prioritize fixes simply.

Learn more about how product threat intelligence works.

Product Security Threat Intelligence FAQs

We are getting a lot of inquiries about PCA CERVUS at the moment, so we have collected some of the most common questions and our answers below.

What is product security threat intelligence?
Product security threat intelligence is threat intelligence designed for embedded products that matches new vulnerabilities in device components to the products that contain them.

How is product security threat intelligence different from traditional threat intelligence?
Traditional threat intelligence monitors IT assets using indicators of compromise. Product security threat intelligence monitors embedded products using their components.

Do I still need a traditional threat intelligence platform?
Yes, if you secure IT infrastructure or run an SOC, you still need a traditional threat intelligence solution to inform the work of the SOC.