As cyber threats grow, securing power electronics is becoming increasingly important. We spoke with Alois Wolff, Embedded Software Team Leader at Watt & Well, about cybersecurity challenges, current practices and the impact of the Cyber Resilience Act (CRA).
1. What are the main cybersecurity threats that connected industrial equipment can be exposed to?
Our equipment converts and controls electrical power. A cyberattack can therefore have real-world consequences: a charger going offline, a battery system disrupting grid operations, or a motor operating outside its intended parameters.
The main risks include:
- Exploitation of communication interfaces: This includes connections to back-end systems, such as OCPP for EV chargers, as well as maintenance ports and industrial fieldbuses.
- Firmware tampering: A modified or malicious update is one of the most direct ways to take control of a device.
- Supply chain vulnerabilities: Risks can originate in third-party software components, development tools or electronic components.
- Physical access: Equipment installed in public spaces, such as EV charging stations, can be physically accessed, opened and tampered with.
- Long product lifecycles: Our products can remain in service for 15 to 20 years. A vulnerability discovered eight years after deployment still needs to be addressed.
This last point is often underestimated. Cybersecurity doesn’t end when a product is delivered. It requires ongoing attention and support throughout the product’s entire lifecycle.
2. How do you work with the different teams to secure Watt & Well products? What are the main challenges?
Our products involve five software disciplines: FPGA, embedded firmware, control, application software and connectivity. A core cybersecurity team coordinates the work, bringing in specialists from each discipline when needed.
The goal is to address security throughout development, not just at the end. This starts with requirements based on risk analysis, continues with security practices built into our development tools, and includes reviewing security alongside functional requirements.
As an SME, we face a few specific challenges:
- Constrained hardware. On real-time DSPs and FPGAs, processing power and memory are limited. Security therefore needs to be considered from the early stages of the architecture.
- Product variants. We adapt some products to meet specific customer requirements, and security needs to be maintained across those different versions.
- Culture. Power electronics engineers are used to dealing with reliability and functional safety. Cybersecurity requires a slightly different approach: instead of preparing for random failures, we also have to consider someone deliberately trying to exploit the system. Developing that way of thinking takes time, and it is becoming an increasingly natural part of our engineering work.
3. Do cybersecurity requirements differ depending on the market: Oil & Gas, Green Technology, or Space & Defense?
Yes, quite a lot. The risks vary depending on the application and the environment:
- Green Technology (EV charging and BESS): These systems have a broad range of interfaces. Chargers communicate with back-end systems and vehicles, while battery storage systems interact with the grid. Regulations such as the Cyber Resilience Act (CRA), along with grid-related requirements, are raising expectations around cybersecurity. Our customers are also asking more often how we address these risks.
- Oil & Gas: Downhole tools operate in isolated environments and mainly communicate over CAN. Here, the main concerns are protecting configuration data and securing the surface and maintenance tools used to interact with the equipment. Operators are also increasingly aligning their cybersecurity requirements with IEC 62443.
- Defense&Space: The focus is more on protecting sensitive information, securing development environments and controlling supply chain risks, in line with the expectations of the French defense industry.
Across all three areas, we follow the same basic approach: risk analysis, secure development and security throughout the product lifecycle. What changes is how we apply it, depending on the equipment, its operating environment and the customer’s requirements.
4. How is Watt & Well preparing for the new requirements of the Cyber Resilience Act?
We started early by reviewing our practices against the CRA’s essential requirements and IEC 62443, a key reference for industrial cybersecurity. We then translated the findings into a practical set of requirements for our development teams.
Some measures are already in place:
- Secure boot and signed firmware on our charger control hardware and EV communication controllers. This helps ensure that devices only run software we trust.
- A coordinated vulnerability disclosure process. Researchers and customers have a way to report potential vulnerabilities to us, and our contact details are published in a standard security.txt file. This is particularly important now that the CRA’s reporting obligations have started to apply.
Our next steps are to formalise our secure development lifecycle and extend the use of software bills of materials (SBOMs) across our product range. We’re working towards the CRA’s full application date of December 2027.
We see the CRA less as a constraint than as a way to formalise security practices that our customers were already asking us to put in place.