Device-centric threat intelligence and where to find it

TLDR: Device specific threat intelligence is provided by using device specific threat intelligence platforms like PCA Cervus that look at component level risks.

Device-centric threat intelligence is threat intelligence that focuses specifically on risks to a connected device like a point of sale terminal or a card reader.

This post explains what device centric threat intelligence is and how it differs from traditional SOC centric threat intelligence and what to look for in threat intelligence feed so you can be sure it gives device centric intelligence vs generic SOC focused intel.

Device-centric threat intelligence vs traditional threat intelligence

Traditional threat intelligence is focused on IT assets such as servers, endpoints and networks. Alerts are based on indicators of compromise and designed for an SOC to use to modify SIEM rules or take other actions to defend their corporate network..

Device-centric threat intelligence on the other hand starts with a device's SBOM or xBOM to see which components are inside, then monitors intel around those components for new vulnerabilities and exploits. When a new risk appears, this type of intel will tell you which products are affected.

Benefits of device centre threat intelligence

There are two core benefits of device specific threat intelligence compared to generic threat intelligence:

1. Supply chain risk reduction. Most of the code in an embedded device comes from chip vendors and firmware suppliers, and their SBOMs are often incomplete. A device-centric platform can check those SBOMs against what is actually in the device.
2. Lower engineering cost. Prioritised and device specific intel dramatically cuts down the list of issues engineering has to deal with. For example, a vulnerability flagged by a device specific threat intelligence platform like PCA Cervus only gets priority if the affected code is in the product and can be reached.

However, it's important to note that most organisations that build devices need both a device specific threat intelligence platform and a generic platform or threat intelligence feed.

The SOC protects the company's own systems, and the product security team uses the device-centric view for the products it ships.

5 features that make a threat intelligence platform device-centric

A threat intelligence feed or platform must know what is inside each device and work out risk and their priority from this understanding matched with threat intel for other sources.

Here we break this down into five features you can use to determine whether a platform providers product threat intelligence vs generic threat intelligence”

1. Device composition analysis. A device-centric solution imports and validates existing SBOMs, or supports generating them where none exist, and links components to product architecture. Validation matters because supplier SBOMs are often incomplete or out of date.
2. Cross portfolio capability. Manufacturers need answers from a single device up to the full portfolio. A device-centric solution shows shared dependencies and recurring vulnerabilities across products, so a flaw in a common library or chip SDK is found everywhere it appears in one pass.
3. Whole lifecycle coverage. Risk changes over a device's life. A device-centric solution monitors from development and certification through to deployment and maintenance, so new vulnerabilities and exploits are caught after release as well as before it.
4. Remediation advice is built on evidence. Knowing a patch was released is only part of the picture. A device-centric solution tracks each vulnerability, validates patches and assesses whether changes to the affected components address the exposure. That gives teams evidence the issue is resolved.
5. Fits with existing processes. Product security work already runs through engineering tools. A device-centric solution imports existing SBOMs and integrates with ticketing systems, so findings reach engineers through the channels they use.

Who needs device specific threat intel?

Any organization that builds or runs connected products needs device specific threat intelligence.

To explain why, here we look at two examples of core industry verticals which use this kind of feed: payment device providers and automotive suppliers.

Payment terminal manufacturers must immediately understand how a new exploit for a cryptographic library impacts their terminal models and firmware versions. They need data that is ranked by exposure, with remediation tracked through to deployed devices.

For an automotive supplier, a vulnerability in a component like a Bluetooth stack must immediately be understood in the context of which ECUs use that stack across which vehicle programmes, and whether the affected interface is reachable in each. Otherwise risk remains totally unknown.

In both cases the team moves from reading advisories to acting on product-specific findings.

Who uses it

There's also a regulatory angle. Regulations and standards increasingly ask for continuous visibility of product risk. These include the EU Cyber Resilience Act, PCI DSS and PCI PTS in payments, UNECE R155 and ISO/SAE 21434 in automotive, IEC 62443-4-2 for industrial components and the Radio Equipment Directive through EN 18031.

A device-centric approach helps organisations build the SBOM records, vulnerability assessments and remediation evidence their compliance processes need. The organisation keeps responsibility for meeting each requirement. The tooling supports the process.

Questions to ask a threat intelligence provider

• Can it validate supplier SBOMs and generate them where we have none?
• Does it map threats to specific devices and firmware versions?
• Can it show shared risks across the full portfolio?
• Does it keep monitoring after products are deployed?
• How does it confirm that a patch addressed the exposure?
• If it uses AI, where does our product data go?

For an example of a solution which answers these, look at how PCA Cyber Security launched PCA CERVUS in October 2026 as a device-centric vulnerability monitoring and threat intelligence platform.

It was developed with PCA's offensive security researchers and covers payment, automotive, industrial and IoT devices. It validates or generates SBOMs, maps vulnerabilities to affected products and verifies patch status.