Zyxel Networks Embeds Security Governance Across Product Lifecycle To Support SMBs And MSPs

Zyxel Networks has outlined an expanded framework for product security governance, targeting the small and medium-sized business and managed service provider markets as regulatory requirements tighten and AI-driven cyber threats continue to grow.

The networking vendor’s approach centres on embedding security practices across product development, vulnerability management and lifecycle governance – rather than applying them as a layer after products reach the market.

The framework arrives as the EU Cyber Resilience Act (CRA) introduces stricter requirements for product accountability, demanding transparent and verifiable security governance throughout the entire product lifecycle. Research from Mandiant has identified software exploits as the top initial attack vector, with threat actors now using AI to accelerate these attacks.

For SMBs and MSPs that often lack dedicated security teams, the choice of vendor and the maturity of that vendor’s security governance has become a more pressing consideration.

First SMB networking vendor to sign CISA’s Secure by Design pledge

Zyxel Networks holds the distinction of being the first company in Taiwan and the first global SMB networking vendor to sign CISA’s Secure by Design pledge, a commitment that shapes how the company approaches product development and deployment.

Practical measures flowing from that commitment include passwordless login support for Zyxel accounts and multi-factor authentication (MFA) across the company’s product portfolio and extended services. MFA support covers wireless access, administrator logins and remote VPN access.

The company has also moved to eliminate default passwords from its products and works to reduce entire classes of vulnerabilities during the development process, aligning with core CISA principles.

Dual CVE acceptance levels place Zyxel alongside Cisco, Juniper and F5

The Zyxel Group’s Product Security Incident Response Team (PSIRT), which has been in operation for close to a decade, works with global security researchers through a published Vulnerability Disclosure Policy and a coordinated remediation process.

As a CVE Numbering Authority (CNA), the Zyxel Group has achieved dual Provider Acceptance Levels – placing it in a small group of networking industry CNAs that includes Cisco, Juniper and F5. The acceptance level data was accurate as of June 2026.

The Zyxel Group has also been approved as a full member of the Forum of Incident Response and Security Teams (FIRST), the global body for incident response and security coordination. The membership strengthens the company’s ability to collaborate internationally on coordinated vulnerability response and cybersecurity incident management.

Lifecycle transparency aimed at reducing long-term security exposure

Zyxel Networks maintains a product lifecycle management policy that defines maintenance timelines and support phases for its products, making deprecation schedules visible to customers.

The intent is to give organisations the information they need to plan technology investments, transition away from ageing products and insecure network protocols before they introduce avoidable risk and maintain compliance with requirements under the EU CRA.

The approach reflects a broader industry shift toward lifecycle transparency, where customers increasingly expect vendors to be upfront about how long a product will receive security updates and when it will reach end of support.

CISO points to verifiable governance over vendor promises

Edward Yu, Chief Information Security Officer of the Zyxel Group, framed the company’s approach as a response to an environment where trust needs to be demonstrated rather than asserted.

“Cybersecurity today can no longer rely on promises alone,” Yu stated. “As cyber threats intensify and global regulations such as the EU CRA raise expectations for product accountability, trust must be earned through verifiable, day-to-day security governance.”

“Transparency across the product lifecycle helps organisations reduce blind spots, make more informed decisions and strengthen overall cyber resilience,” he added.

ANZ head highlights out-of-the-box security for partners

Gary Chen, ANZ Regional Head at Zyxel Networks, pointed to the operational benefits for channel partners working with SMB and MSP customers in Australia and New Zealand.

“SMBs and MSPs are under growing pressure to strengthen cyber resilience while managing increasingly complex IT environments,” Chen observed. “Embedding out-of-the-box security across the entire network infrastructure minimises the costly, time-consuming manual hardening afterwards.”

“This empowers our partners to deploy faster, simplify compliance audits and deliver a resilient network foundation that wins client trust,” he added.

Regulatory and threat landscape driving vendor accountability

The timing of Zyxel’s governance push aligns with a broader wave of regulatory and market pressure on networking vendors to demonstrate security credentials beyond marketing claims.

The EU CRA, which applies to products with digital elements sold in the European market, is expected to have flow-on effects for vendors operating globally, including those serving the Australian and New Zealand markets. Compliance will require vendors to maintain documented security processes across the full product lifecycle.

At the same time, the growing use of AI by threat actors to identify and exploit software vulnerabilities is compressing the window between vulnerability disclosure and active exploitation – putting additional pressure on vendors to maintain responsive PSIRT operations and coordinated disclosure processes.

For SMBs and MSPs evaluating networking vendors, the combination of regulatory compliance requirements and an escalating threat environment is making security governance a more central part of the procurement decision.

For more information, visit zyxel.com.

Last Updated on July 28, 2026 by Nick Ross