Why do nation states pass cybersecurity laws for products, and why is "cost savings" not one of the reasons?

States legislate because of the growing number of vulnerabilities, IoT security incidents and the threat of cyberwar against their infrastructure. The laws add cost for manufacturers, so cost savings are not a driver.

Left to the market, insecure products are cheaper to make, and the damage lands on customers and society, not the manufacturer. Botnets of hacked cameras, ransomware in hospitals and state actors pre-positioning in power grids made that external cost visible. Governments respond by making baseline security a condition for selling at all. The CRA in the EU, PSTI in the UK and the FDA's premarket cybersecurity requirements in the US all work this way.

A law that forces testing, patching and reporting raises costs, at least in the short term. The benefit is lower societal risk, not cheaper products.

Go deeper:

• UK government — The PSTI product security regime — a concrete example: banned default passwords, a disclosure policy and a stated support period