The Cyber Resilience Act (CRA) is raising the bar for software cybersecurity. Identifying vulnerabilities is only the beginning.