I lead product development for OT security at TRIOVEGA. We build products that let operators secure their machines. I also help machine builders and software companies build their own products so they stay secure and updatable for as long as they are in use.
That is how long I have been building connected devices, from Linux gateways to OT security.
TÜV has certified the secure development lifecycle I'm responsible for to this standard.
I'm co-inventor of a secure OT gateway (EU, US, Israel).
I'm a member of the expert group “Security Solutions for Industry”.
What does it take to build secure products?
Products have to be designed around the user. So does their security, otherwise people work around it. Clear lines of defence in the architecture and suitable licence models help keep security up in the long run without creating cost traps.
A good secure development lifecycle has to focus on the developers and stay efficient – otherwise they won't accept it and will work against it. It also has to hold up in an audit. Ours is TÜV-certified to IEC 62443-4-1 ML-2.
Secure products come from small autonomous teams with clear ownership. They have to understand why a requirement exists – otherwise they build past the users and past security. What matters is embracing innovation and being able to talk openly about mistakes.
Good security can only be built together and only in close exchange with the users. It takes partnerships across company boundaries. That is why I contribute to the VDMA and the CISO Alliance and share tools as open source.
The Cyber Resilience Act (CRA) makes security a duty for every product with a digital element sold in the EU. For machines that run for many years, it changes not just the paperwork but the architecture.
Each project started with a problem I kept running into. All projects →
Devices in the field need security updates for ten years and more. Every update can cause an outage. That is why updates are often put off (especially in OT). CuOS makes them systematic and repeatable.
The whole operating system is a container image. An update replaces it in one go and rolls back on its own if the update runs into problems. CuOS started in 2025. Since early 2026 a commercial product has been built on it.
AI agents work best with files they can read and write directly. Teams need a good interface for them. BrainDesk brings both together in the same Markdown files.
BrainDesk keeps a knowledge base in plain Markdown files. People and AI agents read it alike.
Details →Soon
Energy management needs a lot of data and control. Attackers can exploit exactly that. So osiota makes data accessible on site and keeps it local where possible.
osiota is a JavaScript platform for distributed IoT applications and is still maintained.
Here I write down what I learn while building secure products. I write for the people who make the decisions. All posts →
The article explains what the IEC 62443 series regulates and what it does and does not do for NIS2 and CRA compliance. It also shows what a certified development process means for customers.
Security works as a process across the whole development lifecycle. The report shows how to start with CRA conformity through a gap analysis along IEC 62443-4-1.
At TU Braunschweig I studied electrical engineering, spent eight years researching distributed energy management and IoT, and earned my doctorate. Since 2019 I have been building OT security products at TRIOVEGA that run in our customers' production plants – and are updated automatically on a regular basis.
Building machines or software for industry and wondering what the CRA means for your product line? Write to me or connect with me. I'm happy to exchange experiences.