Industrial software runs on RTOS and firmware most security tools have never scanned. IEC 62443 requires you to govern all of it.
Black Duck sees what others miss. Polarion governs what Black Duck finds. X-DLM™ connects both to your IEC 62443 development workflow.
and
OT software carries unique risk that generic SCA tools miss. IEC 62443 and EU CRA require you to govern it anyway.
ICS/OT vulnerabilities disclosed in 2025 — the highest annual volume on record. Manufacturing and energy are the top two affected sectors. Source: Forescout / CISA ICS-CERT 2026.
Known vulnerabilities in Black Duck's KnowledgeBase — including industrial-specific advisories for RTOS, OPC UA, Modbus, and embedded cryptographic libraries not tracked in general CVE databases.
Black Duck BDSA advisories ahead of NVD — critical for OT environments where patching requires production change windows measured in weeks, not hours.
Minimum support period EU CRA requires industrial manufacturers to maintain security updates for Important Class II products — from the date of last unit placed on market.
Sources: Forescout / CISA ICS-CERT 2026. OSSRA 2026. Black Duck BDSA documentation. EU CRA Important Products classification.
IEC 62443-4-1 evidence builds as you develop. EU CRA conformity evidence builds from the same system.
- 01
Scan industrial components other tools miss
Black Duck identifies vulnerabilities and license risks in RTOS kernels (FreeRTOS, VxWorks, QNX), industrial protocol implementations (OPC UA, Modbus, DNP3, EtherNet/IP, PROFINET), cryptographic libraries (OpenSSL, mbed TLS), HMI frameworks, and embedded firmware — the components that make up the actual risk surface of an industrial product.
- 02
IEC 62443-4-1 secure development lifecycle — evidence as an output
Polarion provides the development workflow backbone aligned to IEC 62443-4-1 security management, requirements, design, implementation, verification, and vulnerability handling processes. Security requirements are traced from design through code through test through release — producing the ML2/ML3/ML4 evidence package as a byproduct of how your team develops.
- 03
Safety-security co-engineering in one system
Security patches to safety-critical functions must be validated against functional safety requirements (IEC 61508 SIL levels, ISO 13849 PLr ratings). Polarion maintains both requirement types in the same traceability thread — so the change control record proves the patch was assessed against both safety and security obligations simultaneously.
- 04
EU CRA Class II SBOM — machine-readable, notified-body-ready
Black Duck generates SPDX and CycloneDX SBOMs covering every component in the industrial product — including firmware, protocol stacks, and AI-generated code if development tools introduce it. X-DLM™ version-controls SBOMs in Polarion, linked to vulnerability decisions and release records, for EU CRA notified body submission.
See how Siemens Polarion and Black Duck become one governed software risk workflow.
X-DLM™ turns Black Duck software supply chain intelligence into Siemens Polarion work items, requirements links, approvals, escalation paths, and continuously maintained evidence.
Brand authority buyers recognize
Backed by Siemens lifecycle governance and Black Duck AppSec intelligence.
Siemens Polarion ALM
Polarion provides the lifecycle system of record for requirements, tests, approvals, traceability, workflow automation, audit evidence, and regulated software delivery.
Black Duck Software Composition Analysis
Black Duck identifies open source and third-party components across source, binaries, containers, firmware, snippets, AI-generated code, and C/C++ environments without package managers.
The most common industrial engineering objections — answered
"We can't patch production systems — uptime comes first."
X-DLM™ doesn't require you to patch to demonstrate governance. It routes every finding into a Polarion work item with documented risk acceptance, compensating control rationale, and change control timeline — the evidence trail IEC 62443 and EU CRA require, whether you patch or formally accept the risk.
"We're already IEC 62443 certified — that covers CRA."
IEC 62443 certification significantly supports CRA conformity — but is not automatic equivalence. EU CRA requires additional documentation including machine-readable SBOM, 24-hour vulnerability reporting, and CE marking evidence. X-DLM™ closes the gap between IEC 62443 certification and full CRA Important Class II conformity.
From RTOS vulnerability to IEC 62443 evidence trail.
EU CRA Class II conformity as a development output.
See how X-DLM™ integrates Black Duck and Siemens Polarion to scan industrial OT components, automate IEC 62443-4-1 secure development lifecycle evidence, produce CRA-compliant SBOMs, and maintain safety-security co-engineering traceability for industrial automation manufacturing teams.