The IoT Security Foundation (IoTSF) was invited to bring an industry perspective to the Global Cybersecurity Labelling Initiative (GCLI) meeting in London on Wednesday 4th November, joining government representatives from across the world to discuss the future of cybersecurity labelling and product security regulation.
The GCLI is a multilateral, government-led cooperation forum working towards greater international alignment on cybersecurity labelling for connected products. Its ambition is to strengthen consumer protection while reducing the complexity faced by manufacturers operating across different markets.
With representatives from Brunei Darussalam, Canada, the European Union, Germany, Hungary, India, Ireland, Japan, Qatar, the Republic of Korea, Singapore, the United Kingdom, the United States and the European Commission in attendance, this was a valuable opportunity for industry practitioners to speak directly to those helping shape international cybersecurity policy.
Setting the scene: The state of vulnerability disclosure
The session opened with a presentation from David Rogers MBE, Chief Executive Officer of Copper Horse, an IoTSF member company.
David provided a preview of the forthcoming 2026 edition of ‘The State of Vulnerability Disclosure in Global Consumer IoT’, the long-running research series examining how effectively connected-device manufacturers enable security researchers to report vulnerabilities.
The research provides an important measure of real-world product security practices and offers policymakers valuable evidence of progress, persistent gaps and the practical impact of regulation.
The previous edition, covering 2025, found that just over 40% of manufacturers surveyed provided a public mechanism for reporting security vulnerabilities. While this represented encouraging progress, it also demonstrated just how much work remains to be done.
A serious subject, but plenty of laughter
Following David’s presentation, the IoTSF took centre stage for an industry panel discussion chaired by Christopher Bennison, Operations Manager at the IoT Security Foundation.
Joining Christopher were three experts bringing different perspectives from across the product cybersecurity ecosystem:
– David Rogers MBE: Chief Executive Officer, Copper Horse
– Alfred Baghouzian: Founder & CEO, Pinsights Inc.
– Joe Lomako: Cybersecurity Lab Manager, TÜV SÜD
Despite the serious subject matter, the discussion was lively, good-humoured and frequently funny, providing a refreshingly candid exchange between industry experts and international policymakers.
The panellists explored what good cybersecurity labelling and product security regulation should look like from an industry perspective, the realities of implementing cybersecurity requirements in practice, and the difficulties businesses encounter when navigating different regulatory approaches across international markets.
A central theme was the need for requirements that are understandable, practical and capable of delivering genuine security improvements, rather than simply adding compliance complexity.
The conversation also considered what governments could do to make cybersecurity requirements easier for businesses to understand and implement without compromising security outcomes.
One question. One unanimous answer.
Perhaps the most memorable moment came during the audience Q&A, when delegates asked a deceptively simple question:
“What is the one thing governments could do to improve the situation?”
The answer from the panel was unanimous:
Governments must speak to the manufacturers.
It was a straightforward message, but one carrying considerable significance for the future of international cybersecurity regulation.
Manufacturers are the organisations responsible for translating regulatory requirements into real products, engineering processes, supply-chain arrangements, testing procedures and ongoing security support.
Their practical experience is essential to developing requirements that are not only technically sound but also achievable, proportionate and effective.
With countries around the world introducing cybersecurity labelling schemes, product security legislation and conformity assessment requirements, the need for meaningful engagement between governments and industry has never been greater.
The message from the panel was clear: if governments want regulation that works in the real world, they need to involve the people who build the products.
Building international alignment through industry engagement
The discussions highlighted the importance of international cooperation in an increasingly complex regulatory landscape.
For manufacturers selling connected products globally, different national requirements can create considerable challenges, particularly where approaches to testing, certification, documentation and compliance differ between markets.
Greater alignment has the potential to reduce unnecessary duplication, ease the burden on businesses and ultimately support better cybersecurity outcomes for consumers.
However, successful alignment requires more than governments talking to one another. It also requires sustained engagement with manufacturers, testing organisations, cybersecurity specialists and the wider product supply chain.
The IoT Security Foundation was delighted to contribute an independent industry voice to these important international discussions.
Bringing together expertise from across the product cybersecurity community, IoTSF continues to help bridge the gap between policy ambition and practical implementation, supporting governments and industry in the shared objective of making connected products more secure.
And if this week’s session demonstrated anything, it’s that serious progress on cybersecurity does not always require a serious atmosphere. Sometimes, a little humour, some candid conversation and a willingness to listen can go a remarkably long way.
Find out more:
– Global Cybersecurity Labelling Initiative
– Join the IoT Security Foundation
– The State of Vulnerability Disclosure in Global Consumer IoT