EU Cyber Resilience Act reporting duties started on 11 September 2026, with full application from 11 December 2027.
Why this market is moving now
- Manufacturers selling into the EU have had to report actively exploited vulnerabilities and severe incidents since 11 September 2026.
- The EU Cyber Resilience Act applies in full from 11 December 2027, so product makers worldwide that sell in the EU face a fixed deadline.
- More vulnerability records were published in the first three quarters of 2026 than in all of 2025.
- The number of connected products in scope is forecast to grow from 22.3 billion connections in 2025 to 47.1 billion in 2031.
Key figures
Global figures for this market, with the year each one describes. Use Cite to copy a reference to this page.
| Figure | Value | Year | Cite |
|---|---|---|---|
| IoT connections worldwide totalled about 22.3 billion in 2025, counting short-range and wide-area connections. | 22.3 billion connections | 2025 | |
| IoT connections worldwide are forecast to reach 47.1 billion in 2031. | 47.1 billion connections (forecast) | 2031 | |
| North East Asia held around 70% of all cellular IoT connections in the world at the end of 2025. | 70 % of world cellular IoT connections | 2025 | |
| 48,244 new public software vulnerability records were published worldwide in 2025, up from 40,077 in 2024. | 48,244 vulnerability records published | 2025 | |
| 72,812 public software vulnerability records were published in the first three quarters of 2026, more than in all of 2025. | 72,812 vulnerability records published (Q1 to Q3) | 2026 | |
| As of 9 November 2026, a US government catalog listed 1,769 vulnerabilities known to be exploited in the wild. | 1,769 known exploited vulnerabilities | 2026 | |
| UL Solutions, which tests and certifies product safety and security, had revenue of $3,053 million in 2025, up from $2,870 million in 2024. | 3,053 USD million | 2025 | |
| Under the EU Cyber Resilience Act, manufacturers must report actively exploited vulnerabilities and severe incidents from 11 September 2026. | 11 September 2026 reporting obligations start | 2026 | |
| The EU Cyber Resilience Act applies in full from 11 December 2027. | 11 December 2027 general application date | 2027 | |
| The UK security regime for consumer connectable products, which requires unique or user-set passwords, came into effect on 29 April 2024. | 29 April 2024 date in force | 2024 |
Calculated figures (shares, changes and prices per kilogram) are plain arithmetic on the reported values. Read how we work.
Companies to watch
UL Solutions
Product safety and security testing and certification firm with 2025 revenue of $3,053 million.
Black Duck
Sells application security testing and software composition analysis to manage open source risk and secure the software supply chain (
JFrog
Sells software supply chain tools that control software binaries from build to production (
What the full report covers
- 01Executive summary
The answer in one page: size, direction and what moves it - 02Market definition and scope
What is in and out of the global market - 03Global market size, 2021 to 2025
Historical series and growth rates - 04Countries and regions
Demand, supply and trade by country and region - 05Outlook to 2031
Base, low and high scenarios with stated assumptions - 06Rules, policy and deadlines
Regulation and programmes that change demand - 07Drivers and barriers
What accelerates or slows adoption, by customer segment - 08Prices, costs and margins
Unit economics where public data allows - 09Competitive landscape
8 to 12 company profiles with recent moves - 10Opportunities and risks
For new entrants, suppliers and investors - 11Method and assumptions
How every figure was built
Included with the full report
- PDF report, 40 to 60 pages
- Excel data pack
- Ready-to-use charts
- Method note and assumptions
- Written to order in 5 working days
Frequently asked questions
How many connected products need cybersecurity rules?
IoT connections worldwide totalled about 22.3 billion in 2025. They are forecast to reach 47.1 billion in 2031.
How many software vulnerabilities are published each year?
48,244 public vulnerability records were published worldwide in 2025, up from 40,077 in 2024. In the first three quarters of 2026, 72,812 were published.
How many vulnerabilities are known to be exploited?
As of 9 November 2026, a US government catalog listed 1,769 vulnerabilities known to be exploited in the wild.
Which regions have the most connected devices?
North East Asia leads, with around 70% of all cellular IoT connections in the world at the end of 2025.
What product cybersecurity rules apply?
The UK regime for consumer connectable products came into effect on 29 April 2024. EU Cyber Resilience Act reporting duties started on 11 September 2026, and the Act applies in full from 11 December 2027.
Which companies test and certify product security?
UL Solutions tests and certifies product safety and security. Its revenue was $3,053 million in 2025, up from $2,870 million in 2024.
Free sample
Get a free sample of this report
We send the table of contents, two sample chapters and the method note, usually within one working day. It is free to ask.
- Full table of contents
- Two sample chapters
- Method note and data outline