CRA – Threat Modeling as a Tool: From Attack Surface to Action Plan

Get your compliance moving before time runs out.

A webinar for product owners and development leads who need to get started with the CRA - and want to see how threat modeling delivers a concrete action plan fast.

Time is short. Threat modeling is the shortcut.

The CRA - the Cyber Resilience Act - applies to far more products than most people think, and from 11 September 2026 incidents and vulnerabilities must already be reported. Many of those affected have barely begun.

The good news: you don't have to work through the entire set of requirements linearly. You start by modeling the threats against your product - and let that drive the rest of the work. Threat modeling is the tool that compresses the CRA process and shows you where to actually spend your time.

What we'll cover

• What the CRA requires, briefly and concretely - which products are covered and which dates hit first
• What threat modeling is, and why it's the smartest first activity toward CRA compliance
• A walkthrough on a real product: from attack surface to a structured action plan
• How to take the result further into a concrete CRA action plan for your own product

45 minutes. Time for questions at the end.

Who it's for

Product owners, product managers and development leads at manufacturers, importers and distributors of products with digital elements. Especially those who know the CRA affects them but haven't gotten started yet - or who have the work sitting with a department far away and want to understand enough to know it's enough.

This is not a legal, clause-by-clause walkthrough. We stay close to the technology: what the requirements mean for your product, and how to get from requirement to plan.

Who's hosting

Lars Lavén - CISSP-certified cybersecurity expert with extensive experience in threat modeling across connected and regulated environments. Has worked with everything from telecom, banking and medical technology to large-scale network systems, identifying risks, analyzing attack surfaces, and turning insights into concrete security solutions and action plans.

Per Tengkvist - systems and security architect with deep experience in safety-critical products and complex system environments within defense and telecom. Works close to the architecture to connect threats and risks to technical design choices, and has delivered threat modeling and security decisions in everything from public IoT solutions to classified communication systems.