Chapter 7 of 8

7Vendor landscape

6 min read · 2 figures · 1 table · 50 sources

A maker of connected products buys most layers of its stack, from the secure element through the update service to the IoT platform, and needs these vendors for the whole support period of its products. Every layer can be bought from named vendors, but the market behind it changed owners in 2025 and 2026, and the three large US clouds cut IoT services. Not one body is notified under the CRA yet. A gateway that needs one therefore has no route to conformity. The chapter describes the consolidation by layer, the cloud providers’ retirements and the status of notified bodies.

7.1 Market consolidation 2025-2026

The vendor market consolidated in four layers of the stack between 2024 and 2026. Device management moved to chip and OS vendors, capital flowed to firmware security, PKI vendors went to financial investors, and independent platforms changed owners (vendors by layer in Appendix D).

A vendor chosen in 2026 may therefore have a different owner, product line or price list before a product sold in 2027 reaches the end of its support period.

7.1.1 Device management and OTA

Three of the five OTA products that carry most DACH projects changed owners between June 2025 and March 2026. Nordic Semiconductor acquired Memfault on 24 June 2025 and is integrating it into nRF Cloud. Nordic has committed to keep serving device makers on other vendors’ hardware.286 Golioth became part of Canonical on 3 March 2026,198 and Canonical’s Zephyr 26.04 LTS has shipped with Golioth OTA since September 2026.200 The OTA choice is therefore tied more closely than before to a chip or operating-system vendor.

Two vendors focus on compliance for the German-speaking market. qdCloud maps its functions to CRA requirements and states that this does not replace the conformity assessment of the product.332 Kontron in Linz sells the operating system and the update service together241 and has had Ennoconn as anchor shareholder since 2026.243

7.1.2 SBOM, vulnerability management and PSIRT

The binary-analysis vendors, which read compiled firmware and so cover bought-in radio modules and supplier boards, raised more capital than any other vendor group in the stack. Exein in Rome alone raised €70 million in July 2025, €100 million in December 2025 and USD 270 million at a USD 1.7 billion valuation in September 2026.177, 178, 180 Dragos bought NetRise, and Keysight sells Cybeats’ SBOM platform under its own name.89, 118

No tooling vendor sells the PSIRT team, the disclosure policy or the 24-hour reporting path. Engineering firms offer them as services. Ginzinger electronic systems and its partner LIMES Security, for example, sell secure updates and the matching CVE process as part of a lifecycle service.192 The tooling can be bought, the process stays with the maker or its service partner.

7.1.3 Secure element and PKI

Four listed chip makers supply the common secure elements and their provisioning services, among them NXP EdgeLock 2GO, Infineon Trust M Express and Microchip Trust&GO.218, 263, 296 The issuing-CA vendors consolidated under financial investors. Keyfactor bought InfoSec Global, DigiCert bought Vercara and Valimail, and Sectigo took over Entrust’s public certificate business.103, 104, 231, 352 Keyfactor also took a growth investment above USD 1 billion in 2026.233 The DACH-based PKI and HSM vendors are smaller, and several are owned by private equity or the state.

7.1.4 IoT connectivity

Two Germany-based MVNOs compete with the national operators. 1NCE in Cologne reports more than 40 million SIM connections,4 emnify in Berlin more than 23 million.130 Both are investor-funded. 1NCE raised USD 60 million in April 2025, with Deutsche Telekom among its investors.1 Both offer SGP.32 eSIM, the standard for changing profiles in the field.129

7.1.5 IoT platforms

The independent platforms changed owners, while the German industrial platforms stayed with their groups. Cumulocity was bought back from Software AG by its management in January 2025,86 and PTC sold ThingWorx and Kepware to TPG, closing on 13 March 2026.327 Siemens renamed MindSphere to Insights Hub,361 Bosch IoT Suite shows no end-of-life notice,44 and Device Insight has been a wholly owned KUKA subsidiary since 2019.102

7.1.6 Trackers and telematics

Two of the main tracker and telematics suppliers came under financial owners in 2025. Advent International completed its acquisition of u-blox, the Swiss GNSS and cellular module maker, on 26 November 2025.11 Trackunit, the construction-equipment telematics vendor, has had Goldman Sachs Alternatives as majority investor since June 2025.390

7.1.7 Engineering service providers

The two listed engineering service providers with large German operations, Bertrandt and EDAG, reported revenue falls of 18 % and 13 % for their financial years ending in 2025.34, 122 The specialist embedded firms in Austria and Switzerland are smaller and work closer to the device.

7.2 Discontinued IoT services as a platform risk

All three large US clouds have retired IoT services or closed them to new customers since 2023. Google retired IoT Core in 2023, and AWS and Microsoft followed with several services from 2024, six changes in four years14, 201, 264 (Table 17). For a product with a support period of at least five years, each one is a platform risk.171

Service Provider Change Date
Google Cloud IoT Core Google Retired August 2023
AWS IoT Analytics AWS Closed to new customers 24 Jul 2024; end of support 15 Dec 2025
AWS IoT Events AWS Closed to new customers 20 May 2025; end of support 20 May 2026
AWS IoT FleetWise AWS Closed to new customers; end of support not announced 30 Apr 2026
Azure IoT Central Microsoft No new applications; applications unavailable after 20 Sep 2029 23 Sep 2026
Azure IoT Edge 1.5 LTS Microsoft End of support; no successor LTS listed 11 Nov 2026
Azure Device Update for IoT Hub Microsoft Remains generally available; Azure Device Registry updates in preview October 2026
Table 17: Cloud IoT service retirements since 2023

Sources: [14, 17, 18, 201, 264, 265, 267].

The core services are not affected. AWS IoT Core and Azure IoT Hub have no retirement announced, and Microsoft names IoT Hub, the Device Provisioning Service and Fabric as the migration path from IoT Central.264 The risk lies in the services built on top. The update service therefore belongs behind an abstraction.

7.3 Notified bodies under the CRA

NANDO currently lists no body notified under Regulation (EU) 2024/2847, in any status.161 Chapter IV of the CRA has applied since 11 June 2026, and the Commission publishes each body in NANDO once it is notified.157

The authorities are not complete either. Fourteen notifying authorities in 13 Member States are registered for the CRA, in Germany the BSI.161 Austria has registered none. The Federal Chancellery states that it will take on the role.59 Germany’s CRA implementation act has yet to complete the parliamentary procedure.100, 220 Swiss bodies have no route to notification, because the CRA is not covered by the EU-Swiss MRA.365

Two bodies have said in public that they are on the way. SGS Brightsight in the Netherlands holds ISO/IEC 17065 accreditation for CRA Module B and will seek notification through the Dutch notifying authority.360 TÜV NORD will apply to the BSI for designation under the CRA.396

A Class I product such as a stand-alone gateway therefore needs a notified body that does not yet exist, as long as no CRA harmonised standard is cited. RED assessments under EN 18031, by contrast, can be booked today, with 55 active bodies, 12 of them in Germany.160

In summary

A maker buys the stack but must build it so that it can switch update service, PKI and cloud without touching a device in the field. Standardisation and notification, not the maker, decide market access for gateways sold on their own. The last chapter turns the analysis into actions by role, a twelve-month plan and five guiding questions.

Sources in this chapter50

Numbered as in the full reference list and the PDF.

  1. [1] 1NCE. (2025). 1NCE raises 60 million USD in new funding. https://www.1nce.com/en-eu/resources/news-insights/press-releases/1nce-raises-60-million-usd-in-new-funding
  2. [4] 1NCE. (2026). 1NCE in a nutshell. https://www.1nce.com/en-eu/about/1nce-in-a-nutshell
  3. [11] Advent International. (2025). Advent completes acquisition of u-blox. https://www.adventinternational.com/news/advent-completes-acquisition-of-u-blox/
  4. [14] Amazon Web Services. (2025). AWS IoT Analytics end of support. https://docs.aws.amazon.com/iotanalytics/latest/userguide/iotanalytics-end-of-support.html
  5. [17] Amazon Web Services. (2026). AWS IoT Events end of support. https://docs.aws.amazon.com/iotevents/latest/developerguide/iotevents-end-of-support.html
  6. [18] Amazon Web Services. (2026). AWS IoT FleetWise. https://aws.amazon.com/iot-fleetwise/
  7. [34] Bertrandt AG. (2026). Press release: first quarter 2025/2026. https://www.bertrandt.com/fileadmin/files/files/00_Unternehmen/03_Presse/Pressemitteilungen/2026/2026-02-12_press_release_q1_2025-2026_bertrandt.pdf
  8. [44] Bosch Global Software Technologies GmbH. (2026). Bosch IoT Suite. https://bosch-iot-suite.com/
  9. [59] Bundeskanzleramt Österreich. (2026). Fragen und Antworten zur Cyberresilienz-Verordnung (CRA). https://www.bundeskanzleramt.gv.at/themen/cybersicherheit/cyberresilienz-verordnung-cra/fragen-und-antworten-zu-cra.html
  10. [86] Cumulocity. (2025). A new chapter for Cumulocity: building an AIoT powerhouse. https://community.cumulocity.com/t/a-new-chapter-for-cumulocity-building-an-aiot-powerhouse/13692
  11. [89] Cybeats Technologies. (2026). Cybeats and Keysight partner to OEM Cybeats SBOM platform. https://www.cybeats.com/news/cybeats-and-keysight-partner-to-oem-cybeats-sbom-platform-for-software-supply-chain-security
  12. [100] Deutscher Bundestag. (2026). Gesetzentwurf der Bundesregierung zur Durchführung der Verordnung (EU) 2024/2847 (Cyber Resilience Act), Drucksache 21/6134. https://dserver.bundestag.de/btd/21/061/2106134.pdf
  13. [102] Device Insight GmbH. (2026). Über Device Insight. https://device-insight.com/device-insight/
  14. [103] DigiCert. (2024). DigiCert completes acquisition of Vercara. https://goldengatecap.com/digicert-completes-acquisition-of-vercara-acquisition-furthers-digicerts-position-as-a-leader-in-digital-trust/
  15. [104] DigiCert. (2025). DigiCert acquires Valimail. https://www.digicert.com/news/digicert-acquires-valimail-global-leader-in-email-authentication
  16. [118] Dragos. (2026). Dragos acquires NetRise and runZero. https://www.dragos.com/blog/dragos-acquires-netrise-runzero-xot-platform
  17. [122] EDAG Engineering Group AG. (2026). EDAG Group: market uncertainty and delayed awarding of projects shape FY 2025. https://live.deutsche-boerse.com/news/EQS-News-EDAG-Group-Market-uncertainty-and-delayed-awarding-of-projects-shape-FY-2025--Strategic-measures-accelerated-to-restore-sustainable-growth-and-competitiveness-bc5ff7b3-8c89-47a0-b416-f1bf55f3fcb9
  18. [129] emnify. (2026). emnify introduces SGP.32 eSIM. https://www.emnify.com/blog/emnify-introduces-sgp.32-esim
  19. [130] emnify. (2026). emnify named a Visionary in the 2026 Gartner Magic Quadrant for Managed IoT Connectivity Services, Worldwide. https://www.emnify.com/blog/emnify-named-a-visionary-in-the-2026-gartner-magic-quadrant-for-managed-iot-connectivity-services-worldwide
  20. [157] European Commission. (2026). Cyber Resilience Act: conformity assessment. https://digital-strategy.ec.europa.eu/en/policies/cra-conformity-assessment
  21. [160] European Commission. (2026). NANDO: notified bodies under Directive 2014/53/EU (RED) and Regulation (EU) 2023/1230 (Machinery). https://webgate.ec.europa.eu/single-market-compliance-space/notified-bodies
  22. [161] European Commission. (2026). NANDO: Regulation (EU) 2024/2847 (Cyber Resilience Act), notifications and notifying authorities. https://webgate.ec.europa.eu/single-market-compliance-space/notified-bodies/notifying-authorities?filter=legislationId:167953
  23. [171] European Parliament and Council. (2024). Regulation (EU) 2024/2847 on horizontal cybersecurity requirements for products with digital elements (Cyber Resilience Act). https://eur-lex.europa.eu/eli/reg/2024/2847/oj
  24. [177] Exein. (2025). Exein raises €100M to accelerate its global expansion. https://exein.io/blog/exein-raises-100m-funding-to-accelerate-its-global-expansion
  25. [178] Exein. (2025). Exein raises €70M Series C to secure IoT devices. https://exein.io/blog/exein-raises-70m-series-c-to-secure-iot-devices
  26. [180] Exein. (2026). Exein raises $270M at $1.7bn valuation. https://exein.io/blog/exein-raises-270m-at-1-7bn-valuation-to-build-the-security-layer-for-physical-ai
  27. [192] Ginzinger electronic systems GmbH. (2026). Connectivity & Security. https://www.ginzinger.com/en/technologies/connectivity-security/
  28. [198] Golioth. (2026). Golioth is now a part of Canonical. https://blog.golioth.io/golioth-is-now-a-part-of-canonical/
  29. [200] Golioth. (2026). Zephyr 26.04 LTS: up to 15 years of support with Golioth OTA built in. https://blog.golioth.io/zephyr-26-04-lts-up-to-15-years-of-support-with-golioth-ota-built-in/
  30. [201] Google. (2023). python-iot: Cloud IoT Core client library (archived). https://github.com/googleapis/python-iot
  31. [218] Infineon Technologies. (2026). OPTIGA Trust M Express. https://infineon.com/cms/en/product/security-smart-card-solutions/optiga-embedded-security-solutions/optiga-trust/optiga-trust-m-express
  32. [220] ingenieur.de. (2026). CRA-Meldepflicht: wann die Frist beginnt. https://www.ingenieur.de/technik/fachbereiche/ittk/cra-meldepflicht-wann-die-frist-beginnt/
  33. [231] Keyfactor. (2025). Keyfactor acquires InfoSec Global and CipherInsights. https://www.keyfactor.com/press-releases/keyfactor-acquires-infosec-global-and-cipherinsights/
  34. [233] Keyfactor. (2026). Keyfactor announces $1B strategic growth investment led by Summit Partners. https://www.keyfactor.com/press-releases/keyfactor-announces-1b-strategic-growth-investment-led-by-summit-partners-to-expand-leadership-in-securing-the-ai-and-post-quantum-enterprise/
  35. [241] Kontron. (2026). KontronOS: secure operating system for edge devices. https://www.kontron.com/en/products-solutions/susietec/kontronos-secure-operating-system-for-edge-devices
  36. [243] Kontron AG. (2026). Kontron AG: all conditions of the mandatory tender offer of Ennoconn Corporation are met. https://www.kontron.com/en/media/news/kontron-ag-all-conditions-of-the-mandatory-tender-offer-of-ennoconn-corporation-are-met-settlement-will-take-place-shortly?eqs=1035566611
  37. [263] Microchip Technology. (2026). Trust Platform for the CryptoAuthentication family: Trust&GO, TrustFLEX, TrustCUSTOM. https://onlinedocs.microchip.com/oxy/GUID-5C346303-A9CB-4341-B67F-4354AB92FE04-en-US-3/GUID-67185155-9838-416B-8F46-33923D075394.html
  38. [264] Microsoft. (2026). Azure IoT Central is evolving: what you need to know. https://techcommunity.microsoft.com/blog/iotblog/azure-iot-central-is-evolving-what-you-need-to-know/4554570
  39. [265] Microsoft. (2026). Azure IoT Edge: lifecycle. https://learn.microsoft.com/en-us/lifecycle/products/azure-iot-edge
  40. [267] Microsoft. (2026). Device Update for IoT Hub. https://learn.microsoft.com/en-us/azure/iot-hub-device-update/understand-device-update
  41. [286] Nordic Semiconductor. (2025). Nordic Semiconductor acquires Memfault, launches the first complete chip-to-cloud platform. https://www.nordicsemi.com/Nordic-news/2025/06/Nordic-Semiconductor-acquires-Memfault
  42. [296] NXP Semiconductors. (2026). EdgeLock 2GO service platform. https://www.nxp.com/products/security-and-authentication/authentication/edgelock-2go:EDGELOCK-2GO
  43. [327] PTC. (2026). PTC third fiscal quarter 2026 results. https://s27.q4cdn.com/610238322/files/doc_earnings/2026/q3/earnings-result/Q32026_PTC_Earnings-release.pdf
  44. [332] querdenker engineering GmbH. (2026). qdCloud: overview. https://querdenkerengineering.de/en/products/qd-cloud/overview
  45. [352] Sectigo. (2025). Sectigo acquires Entrust public certificate business. https://www.sectigo.com/resource-library/sectigo-acquires-entrust-public-certificate-business
  46. [360] SGS Brightsight. (2026). CRA notified body services. https://www.brightsight.com/cra-notified-body-services
  47. [361] Siemens. (2026). Insights Hub: FAQ. https://www.siemens.com/en-us/products/insights-hub/resources/faq/
  48. [365] Staatssekretariat für Wirtschaft SECO. (2026). MRA Schweiz - EU: Abkommen über die gegenseitige Anerkennung von Konformitätsbewertungen. https://www.seco.admin.ch/de/mra-schweiz-eu
  49. [390] Trackunit. (2025). Trackunit announces closing of investment. https://trackunit.com/press/trackunit-announces-closing-of-investment/
  50. [396] TÜV Informationstechnik GmbH. (2026). Cyber Resilience Act. https://www.tuvit.de/en/topics/regulations/cyber-resilience-act/
Next

Contents

Report overview
  1. 1Deadlines and scope
  2. 2Device requirements
  3. 3Cost per device
  4. 4Technology and architecture
  5. 5Spotlight: logistics tracking
  6. 6Spotlight: Austria and Switzerland
  7. 7Vendor landscape
  8. 8Recommendations
  9. AMethod
  10. BLegal basis
  11. CCost model
  12. DVendor directory
  13. EFunding programmes
  14. About RUBINLAKE
  15. Disclaimer
  16. References