What counts as a "product" in product cybersecurity?

Anything a company sells or provides to customers that contains digital elements: physical devices, mass-deployed software, and cloud services provided to customers.

The term covers far more than consumer gadgets. An insulin pump, a car, a train, a PLC in a factory, a smart watch, a router, a mobile app and the cloud backend that updates all of them are products. The test is whether the thing leaves the company and runs in someone else's hands. A kitchen knife has no digital element, so it is out. A smart fridge is in, because once it is connected, its software can be attacked.

That is why the discipline is separate from information security, which protects the company's own corporate IT. Product security protects what the company ships, and with it the customer and the company's reputation.

Go deeper:

• European Commission — Cyber Resilience Act — the legal definition of a "product with digital elements"