Rockwell Automation announced new SecureOT capabilities for machine builders on 29 October 2026, and the argument underneath the announcement is narrower — and more awkward — than the usual OT-security pitch. The point is not that machines need firewalls. It is that the European rules now closing in on machine builders are, in practice, documentation tests. And the documentation has to begin with a list of every controller, I/O card, drive and firmware revision inside the machine, including the ones fitted years ago by somebody who has since left the company.

Rockwell says the additions cover cybersecurity assessments, advisory services, machine-level asset visibility, vulnerability identification and compliance reporting, delivered through SecureOT Platform. That is a credible set of tools. It is also a set of tools that inherits every weakness in the asset register feeding it. For plants and OEMs running a mixed installed base of ControlLogix, CompactLogix, Flex I/O and older platforms, the register — not the software — is the binding constraint.

Key takeaways

• Rockwell expanded SecureOT for OEMs on 29 October 2026, adding assessments, advisory services, machine-level asset visibility, vulnerability identification and compliance reporting.
• The EU Cyber Resilience Act reporting clock has already started: 24 hours for an early warning, 72 hours for full notification, final report 14 days after a corrective measure is available.
• Full CRA obligations apply from 11 December 2027. The Machinery Regulation (EU) 2023/1230 applies from 20 January 2027 and puts protection against corruption into the essential health and safety requirements.
• Rockwell’s OEM Advantage Playbook survey (500 OEM executives, 17 countries) found almost two in five already responding to changing compliance requirements, and 63% expecting cybersecurity risk to persist.
• The hard part is not buying a platform. It is producing a defensible record of which part number, series and firmware revision is installed in each machine — and where a replacement can still be sourced.

The announcement, without the marketing

SecureOT is not new. The suite launched in November 2025, built around the platform Rockwell acquired with Verve and previously sold as Verve Security Center. What is new on 29 October is packaging aimed specifically at machine builders, who carry a different obligation from plant operators: they place a product on the EU market, and they must be able to prove what is inside it.

Rockwell’s release describes five additions. Read together, they amount to a workflow that starts with discovery and ends with a document a notified body or a customer’s procurement team can read.

What the release does not provide is a price list, a per-capability availability date, or any statement that using SecureOT confers conformity. That distinction matters more than it sounds: conformity is declared by the manufacturer, on the manufacturer’s liability. A platform can only produce the evidence.

Two clocks, running at different speeds

Most coverage of the CRA treats it as a single 2027 event. It is not. The reporting duty under Article 14 has been live since 11 September 2026, which means a machine builder that learns of an actively exploited vulnerability in a shipped machine today already has a legal deadline — not a preparation deadline.

The Machinery Regulation is a separate instrument with a separate logic. It replaces Directive 2006/42/EC from 20 January 2027 and, for the first time, treats hostile interference with a control system as a safety question rather than a purely IT one. Annex III of the regulation includes protection against corruption among the essential health and safety requirements, alongside the long-standing requirement that control systems fail in a safe direction.

The two overlap without substituting for each other. A machine with a PLC, an HMI and a remote-access path contains products with digital elements, so the CRA reaches it. The same machine is machinery, so the Machinery Regulation reaches it too. The legal tests differ — the CRA looks at the product’s security properties and lifecycle support, the Machinery Regulation at whether the machine can be made unsafe by corrupting its control system — but both end at the same place: a technical file that has to be specific about hardware and software.

Why a 24-hour deadline is really an inventory problem

The reporting structure is deliberately staged. An early warning is allowed to be partial; the full notification can fill in severity and mitigation; the final report waits until a fix exists. The design assumes the manufacturer can answer one question within a day: which products, in which member states, contain the affected component.

Note the asymmetry in the last two rows. The vulnerability clock starts when the fix exists; the incident clock starts when you notified. Teams that keep one internal deadline for both will miss one of them.

None of this can be answered from memory. A machine shipped in 2021 with four I/O cards substituted during commissioning, a drive replaced under warranty in 2023 and a firmware update applied during a 2024 shutdown is not an unusual case — it is the normal case. If the register does not capture substitutions, the manufacturer cannot tell a customer, or a regulator, which units carry the affected component.

What a machine-level record has to contain

“Asset visibility” is a phrase that hides a lot of work. Discovery tools are good at finding what is powered on and reachable. They are poor at naming what is inside a sealed enclosure, what revision a module is, and what was replaced two shutdowns ago. The record has to survive the machine’s life, not the tool’s licence term.

The list is not abstract. Each row corresponds to a physical object in the cabinet: a 1756-L81EP ControlLogix 5580E process controller that has a firmware revision, a 1756-IF16H HART analog input module that has a series letter, a 1794-IE8H Flex I/O HART module on a remote skid that may not have been touched since the FAT. The regulator’s question is not whether these devices are secure in the abstract. It is whether the manufacturer knows which of them is installed where.

Where the spare-parts cabinet becomes compliance evidence

This is the part of CRA readiness that rarely appears in vendor presentations, and it is where a parts supplier sees the problem most clearly. A compliance record is only as good as its substitution history. When an adapter fails at 02:00 and is swapped from the stores, the machine’s firmware baseline changes. If that swap is recorded only on a maintenance ticket — or not at all — the asset record quietly becomes fiction.

Three practices close most of that gap, and none of them requires new software. First, record the part number and the revision of every replacement, not just the order code: a 1734-AENT POINT I/O Ethernet adapter pulled from stock may be a different series from the one it replaces, and that difference can change which advisories apply. Second, treat cold spares as assets in their own right: a 1794-ACN15 Flex I/O ControlNet adapter sitting on a shelf for four years still belongs in the register, with its own support status. Third, keep the replacement path documented for controllers that are still supported but no longer current, such as a 1769-L33ERM Compact GuardLogix controller — the day a customer asks what replaces it is usually the day after an advisory lands.

There is a commercial consequence too. Buyers are starting to write cybersecurity questions into machine purchase specifications, and a supplier who can answer them in a table wins work that a cheaper supplier without the table loses. The same table is what makes a spare-parts conversation productive: if the customer knows the installed revision, the replacement can be matched rather than guessed.

The legacy problem, stated plainly

The uncomfortable truth for anyone with an ageing installed base is that part of it cannot be brought into line by documentation alone. PLC-5 processors, SLC 500 I/O and first-generation ControlNet hardware were designed in an era when a control network was assumed to be physically isolated. They do not have the secure boot, signed firmware or authenticated protocol support that the new requirements implicitly assume.

The CRA does not require a manufacturer to retrofit the impossible. It requires an honest support period — at least five years, or the product lifetime if shorter — and effective vulnerability handling within it. The Machinery Regulation requires a risk assessment that identifies corruption risks and states how they are mitigated. Where patching is not available, the mitigation has to be architectural.

Two things make that table defensible in an audit. It is specific, and it is dated. A generic statement that legacy equipment is “protected by the firewall” is worth very little once a customer asks which firewall, which rule, and who reviews it.

What to ask before buying the tool

Rockwell is not the only vendor in this space, and the questions below apply to any platform — including the free ones. The point is to find out whether the tool can produce evidence about the machines you actually have.

1. Can it inventory a device that is powered but not reachable from the discovery point?
2. Does it record hardware revision and firmware version separately from the order code?
3. Can it attribute an asset to a specific machine serial number, not just a site?
4. Does it import the OEM’s own SBOM, or only generate one from what it can see?
5. Can it show the history of substitutions on a given machine?
6. Does it map a new advisory to affected machines within the 24-hour warning window?
7. Can it export a machine-level report that a customer or notified body can read without a licence?
8. What happens to the record when the subscription ends?

The last question is the one most often skipped, and it is the one that decides whether the investment survives a change of supplier.

Where the Rockwell claim stops

Three limits are worth stating. The release does not publish pricing or a date for each capability, so a machine builder cannot plan a budget from it alone. The survey figures are vendor-commissioned and self-reported; the finding that almost two in five OEMs are already acting is a signal about intent, not a measurement of readiness. And no platform confers conformity — the declaration remains the manufacturer’s, and for machinery categories that require a notified body, the assessment remains an external process.

There is also a technical limit that matters in this sector. Agentless discovery depends on network reachability. Equipment that is air-gapped, powered down, or sitting in a warehouse as a spare is invisible to it by design. For process plants and machine builders with long asset lives, that invisible inventory is often the majority of the risk — and it is exactly the inventory a parts record already holds, if anyone has maintained it.

Frequently asked questions

Does the EU Cyber Resilience Act apply to industrial machines?

Yes, where the machine contains products with digital elements that connect to a device or network, or that are supplied with software. A machine with a PLC, an HMI and a remote access path is normally in scope. The obligation falls on the manufacturer that places the product on the EU market, not on the plant that operates it.

What did Rockwell actually add to SecureOT for OEMs?

On 29 October 2026 Rockwell added cybersecurity assessments, advisory services, machine-level asset visibility, vulnerability identification and compliance reporting, delivered through SecureOT Platform and aimed at machine builders preparing for the CRA and the Machinery Regulation.

When do the reporting obligations start?

They started on 11 September 2026. Manufacturers must issue an early warning within 24 hours of learning of an actively exploited vulnerability or a severe incident, a full notification within 72 hours, and a final report within 14 days of a corrective measure for a vulnerability, or within one month for an incident.

Is the Machinery Regulation also a cybersecurity law?

Partly. Regulation (EU) 2023/1230 applies from 20 January 2027 and adds protection against corruption to the essential health and safety requirements. It does not replace the CRA. A machine builder exporting to the EU has to satisfy both, and the technical file has to show how the two sets of risks were assessed.

Do machines already installed in plants need to be reassessed?

The CRA obligations attach to products placed on the market, so an installed machine is not automatically re-certified. But the manufacturer still has to handle vulnerabilities and provide security updates for the declared support period, which means the installed base has to remain visible to the manufacturer for as long as that period runs.

What is an SBOM and does a machine builder need one?

A software bill of materials lists the components and versions inside a product. It is the document that lets a manufacturer answer a vulnerability advisory in hours rather than weeks. Machine builders need one for the software they supply, including third-party libraries and the firmware versions of the control hardware they integrate.

Can a spare-parts supplier help with compliance?

Only indirectly, and that is enough. A supplier can confirm part numbers, revisions and support status, supply like-for-like replacements that preserve a validated configuration, and document substitutions. None of that replaces a compliance programme, but it is what makes the programme accurate.

Sources

• Rockwell Automation, press release on SecureOT capabilities for OEMs, 29 October 2026.
• Regulation (EU) 2024/2847 (Cyber Resilience Act), EUR-Lex, including Article 14 reporting obligations.
• European Commission, Cyber Resilience Act policy page, on reporting from 11 September 2026 and full application from 11 December 2027.
• ENISA, Single Reporting Platform guidance for CRA notifications.
• Regulation (EU) 2023/1230 (Machinery Regulation), EUR-Lex, applicable from 20 January 2027.
• Rockwell Automation, OEM Advantage Playbook global survey, February 2026.

Talk to us

If you are assembling a machine record and need the hardware side confirmed, we can check part numbers, revisions and support status against what is actually available. Our 1756 ControlLogix and 1769 CompactLogix listings include safety and process controllers such as the 1756-L81ES GuardLogix 5580 safety controller, discrete input modules such as the 1769-IQ32 Compact I/O input module, and HART output modules such as the 1756-OF8IH ControlLogix HART output module.

The 1794 Flex I/O range covers the remote racks that usually sit outside the asset register, and the wider Allen-Bradley catalogue includes operator terminals such as the 2711P-K4M20D PanelView Plus 400 terminal. For machines that mix vendors, we also stock interface and safety hardware from other families, including the Honeywell FC-RUSIO-3224 remote safety I/O device, the Yokogawa AAI143-H50 HART analog input module and the Mitsubishi GT2712-STBA operator terminal.

Field devices are part of the same picture. The SICK LMS511-22100 laser scanner, the ABB TZIDC-200 digital positioner, the MTL4626 relay module and the ATV930D22N4 variable speed drive all appear in machine inventories, and all need a recorded revision if the register is going to mean anything. Send us the list, or start from our drives and motion control and controllers and CPUs sections, and we will tell you what can be matched and what has moved on.

For context on how support status changes the buying decision, see our analysis of why Bently Nevada still calls the 3500 fully supported while the Orbit 60 takes new installations, and our breakdown of the Sinamics G200 and G210 launch and what it means for G120 spares. To discuss a specific machine record, contact us with the model list and we will reply with availability and lead time.