Industry executives and experts share their predictions for 2026. Read them in this 18th annual VMblog.com series exclusive.
By Shane Fry, Chief Technology Officer at RunSafe Security, Inc.
For years, embedded security has relied on a familiar formula: scan for vulnerabilities, patch what you can, and hope attackers don’t find the rest. It worked when systems were isolated, updates were infrequent, and adversaries needed significant skill to develop exploits. But heading into 2026, that model is breaking down. Devices are more connected, software is more complex, attackers are moving faster, and AI-generated code is changing the DNA of embedded systems.
This is the year the industry will fully recognize that the scan-and-patch mindset is no longer enough and shift away from chasing individual bugs to building systems that can withstand inevitable vulnerabilities, both known and unknown, and human-written and AI-generated.
Here’s what will define embedded software security in 2026.
SBOMs Will Become the Industry Baseline
By the end of 2026, shipping an embedded product without a Software Bill of Materials (SBOM) will feel as outdated as shipping firmware without encryption. Regulatory pressure from Executive Order 14028 to the EU Cyber Resilience Act is forcing embedded vendors to reveal what’s actually inside their devices.
OEMs, integrators, and operators want transparency:
- What components make up this device?
- What open-source or third-party libraries does it rely on?
- Where is my inherited risk coming from?
SBOMs are the answer. They’ll be generated automatically during builds, updated continuously within CI/CD pipelines, and integrated into development, procurement, vulnerability assessment, and incident response. For C and C++ systems-where deeply embedded dependencies often hide risk-SBOM automation and generation at build-time will significantly reduce risk.
Resilience Overtakes Patching: Runtime Protection and Predictive Security Converge
Many embedded systems are built on C/C++ code bases and are exposed to vulnerabilities like buffer overflows, use-after-free errors, and other structural weaknesses that have persisted for decades despite scanning and patching cycles. For example, SAST for C/C++ can miss 47-80% of vulnerabilities. A “scan-and-patch-everything” mindset simply doesn’t work in practice.
In 2026, runtime protection and predictive security will help to shift the security conversation from “How many vulnerabilities do we have?” to “How hard is it to exploit the ones that exist?”
For example, using tools that quantify and score risk will allow teams to make informed decisions on where and what security measures to apply. One of the security measures gaining traction is runtime protection, which mitigates risk and defends devices even when zero days are present in software. Examples include Control Flow Integrity (CFI), memory tagging extensions, and fine-grained randomization like Load-time Function Randomization.
AI Accelerates Embedded Development and Intensifies Risk
AI code assistants will be ubiquitous in embedded development by 2026. The 2025 AI in Embedded Systems Index Report found that 80.5% of respondents working on embedded systems in critical infrastructure environments currently use AI tools in embedded development. 83.5% have deployed AI-generated code to production systems.
While AI allows teams to write code more quickly, generate tests, optimize code, and accelerate releases, the velocity also increases risk. AI-generated embedded code frequently inherits unsafe patterns from the datasets it was trained on, like unchecked memory usage, dangerous pointer logic, race conditions, and questionable library choices. And because embedded devices often run for 10-20 years, today’s mistakes can become tomorrow’s long-lived attack surface.
Attackers benefit from AI too. Automated firmware analysis, exploit construction, and large-scale vulnerability discovery move to machine speed. Threat actors who once needed deep expertise now rely on AI to handle the work.
With this in mind, defenders can respond with AI-driven threat modeling, predictive vulnerability detection, and behavior-based anomaly detection. Additionally, we’ll see organizations begin requiring traceable audit trails for AI-generated code to maintain accountability.
Reinforcing Trends Will Push Embedded Security Forward
Several other trends are pushing embedded system security toward resilience rather than the scan-and-patch mindset.
- The transition to memory-safe languages will expand, but legacy C/C++ code remains entrenched, meaning memory-safety risks will persist for years.
- Runtime monitoring grows, giving teams visibility into what devices are actually doing in the field, a major leap for historically opaque systems.
- Regulatory expectations tighten, especially in automotive, medical, industrial, and defense ecosystems, where resilience matters as much as detection.
- System connectivity increases, multiplying exposure and raising performance-sensitive security requirements.
Embedding Resilience Into the Next Generation of Devices
Embedded systems power national defense, transportation, industrial automation, and the critical infrastructure that keeps modern life running. In 2026, the industry will shift away from reacting to vulnerabilities and toward engineering resilience into devices. Embedded systems can’t rely on eliminating every bug. They must be engineered to withstand them.
##
ABOUT THE AUTHOR
Shane Fry is the Chief Technology Officer at RunSafe Security, Inc. and has over a decade of cybersecurity experience on both the offensive and defensive sides. He began his career conducting vulnerability assessments on platforms like Unix/Linux, Mac OS X, Android, and cloud systems. His research covers hardware and software security, focusing on secure boot, memory corruption, and web vulnerabilities.
Shane consults on secure system design for private industry and government. Active in the Huntsville, AL, startup scene, he co-taught a course on product investment frameworks and led a team to first place in an automotive hacking competition with Intel/McAfee, contributing to a public report on Automotive Security Best Practices.
