Security policy in Germany usually looks like a tug of war. Civil-liberties organisations argue for disclosure, transparency and caution about state hacking powers; industry associations argue for legal certainty and limits on liability. heise reports that on vulnerability management, the two camps are now making the same demand.
Vulnerability management is the unglamorous discipline that decides whether a known flaw is actually fixed: who is told, how fast, who is responsible for patching, how long a product must be supported, and what happens when a vendor stays silent. Failures there — not novel zero-days — are behind a large share of real-world intrusions, because attackers overwhelmingly use flaws that were disclosed and patched months or years earlier.
The convergence makes sense from both directions. For civil-liberties groups, mandatory, timely patching and clear disclosure duties are consumer protection: an unpatched device in a home is a surveillance and fraud risk. For Bitkom's members, the same rules are a way to force the laggards in the market — cheap hardware with no update path — to carry the cost they currently externalise, rather than leaving responsible vendors to compete against them.
The European backdrop is the Cyber Resilience Act, whose reporting duties for actively exploited vulnerabilities begin from 11 September 2026 and whose main obligations apply from 11 December 2027, alongside national debates over the powers of the BSI. What the exact demands are is reported by heise; the significance is that the principle of security by design now has both industry and civil society asking for enforcement rather than encouragement.
