Security by Design for Software Developers
The CRA is here: is your software ready?
Since 11 September 2026, manufacturers of products with digital elements must report actively exploited vulnerabilities under the Cyber Resilience Act (CRA). From December 2027, all essential requirements apply, including CE marking. For software teams, security can no longer be an afterthought: it has to be part of how you design and build. This masterclass shows you how to get there without losing development speed, combining proven frameworks with a hands-on threat modelling workshop on your own product.
For whom?
- Software developers and tech leads at start-ups and scale-ups
- Engineering teams building cloud, SaaS, mobile, or embedded applications
- Product owners integrating security and compliance into their lifecycle
- CTOs and decision-makers responsible for secure architecture
- Any team member asking: "How secure is our product?"
Key insights
This masterclass helps start-ups, scale-ups, and small to mid-sized software companies understand what security by design really means and how to apply it in daily development. You will learn how to:
- Translate the CRA essential requirements into concrete design and development choices
- Apply the core principles of application security, based on the OWASP framework
- Assess your security maturity with SAMM and DSOMM
- Integrate security and compliance into your DevOps workflow
- Build a threat model of your own product and prioritise the risks
- Get started straight away with practical tools and templates
Programme
A full day in 2 parts: in the morning you explore the frameworks and requirements, in the afternoon you put them into practice on your own product.
| Time | Subject |
| 09:00 - 09:30 | Welcome and introduction • Objectives of the masterclass • Current challenges in software security • Regulatory context: NIS2 and the Cyber Resilience Act |
| 09:30 - 12:30 | Security by design in practice • Key concepts: OWASP framework, AppSec, and basic principles • Security maturity models (SAMM, DSOMM) • CRA essential requirements and security by design • Integrating security and compliance into DevOps • Building a security-by-design culture in small teams • Choosing scalable tools and workflows |
| 12:30 - 13:30 | Lunch break |
| 13:30 - 17:00 | Hands-on threat modelling workshop • Step-by-step introduction to threat modelling (STRIDE, attack trees, and DFDs) • Guided modelling of threats in your own product • Identifying attack surfaces and trust boundaries • Prioritising risks and designing mitigation strategies • Practical tools and templates for immediate use |
| 17:00 | Closing and next steps • Summary of key takeaways • How to continue building secure applications • Q&A |
Flemish companies can take advantage of a subsidy from VLAIO for this course
This programme is part of Industriepartnershap in which 13 Flemish innovation partners offer an integrated service to stimulate growth and innovation in the Flemish industry in the 6 following themes: AI, Cybersecurity, Circularity, Digitisation, Climate & Energy and Industry 4.0. They do so under the leadership of Agoria and Sirris and with the support of Agentschap Innoveren & Ondernemen.
Experts
Read more about this expertise
For all practical information, information on invoicing, location etc of this event, please contact our event manager
adres events@sirris.be
Partners
Date
Location
Price
Language
English
Status
Gelijkaardige activiteiten
Local AI for the graphics industry: from production data to dashboard
PR_D_CT DAY 2026: product management event
Are you ready for industrial AI?
