Skip to main content

Key Elements: Intended Use and Foreseeable Use in Your Software Risk Assessment

When you're doing your cybersecurity risk assessment under the Cyber Resilience Act, two terms are your North Stars: "intended purpose" and "reasonably foreseeable use". Getting these right is fundamental for any software, app, or game.

Intended Purpose​

The "intended purpose" is what you, the manufacturer, say your software is for. This includes the specific context and conditions of use you describe in your instructions, promotional materials, sales pitches, and technical documentation. If your game is for entertainment on a mobile device, that’s its intended purpose. If your app is for editing photos, that’s its core function. Clearly defining this is step one.

Reasonably Foreseeable Use​

This is where it gets interesting. "Reasonably foreseeable use" goes beyond your explicit instructions. It covers uses that are likely to happen due to predictable human behavior or technical interactions, even if you didn't spell them out. Think about users trying to bypass in-app purchase mechanisms in your game, or someone using your photo app to try and process excessively large files to see if it crashes.

Article 13, Paragraph 3 specifically states your cybersecurity risk assessment must include an analysis of cybersecurity risks based on both the intended purpose and reasonably foreseeable use, and the conditions of use like the operational environment.

Why This Matters for Software​

For your app or game, consider:

  • Data Misuse: Could users input data in a way you didn't intend, creating a risk?
  • System Interaction: If your game engine component is integrated into a larger system, how might that broader context expose it to new risks?
  • User Behavior: Will users try to "jailbreak" your app or use cheat engines with your game?

Understanding both intended and foreseeable uses helps you anticipate a wider range of potential threats and vulnerabilities.

Key Takeway​

Your software risk assessment isn't just about how you want your product to be used. It’s about how it will be used, intentionally or otherwise. Address both to build a genuinely resilient product.