Scality Achieves CNA Status as EU Cyber Resilience Act Reshapes Storage

PARIS – November 10, 2026 – In the rapidly evolving landscape of 2026, data infrastructure is no longer merely a passive repository; it is the active, beating heart of global digital experience and enterprise artificial intelligence. As the sheer volume and strategic value of this data grow, so too does the regulatory pressure to secure it. Today, Paris-based data infrastructure provider Scality announced its official designation as a Common Vulnerabilities and Exposures (CVE) Numbering Authority (CNA) under the Root operated by the European Union Agency for Cybersecurity (ENISA).

While a technical designation on its surface, Scality’s move to become a CNA represents a fundamental shift in how enterprise storage vendors are adapting to a new era of regulatory scrutiny and operational integration. By gaining the authority to directly assign CVE Identifiers and publish corresponding CVE Records for vulnerabilities discovered in its software products—including Scality RING, ARTESCA, and ADI—the company is bridging a long-standing gap between proprietary storage infrastructure and standardized enterprise security operations.

The EU Cyber Resilience Act Forces a Reckoning

The timing of Scality’s announcement is inextricably linked to the sweeping regulatory changes currently reshaping the European technology sector. On September 11, 2026, the rigorous reporting obligations of the EU Cyber Resilience Act (CRA) officially came into effect. The CRA fundamentally alters the liability and operational landscape for manufacturers of products with digital elements available in the EU market.

Under Article 14 of the CRA, vendors are now subject to a multi-staged reporting process that demands unprecedented speed and transparency. When an actively exploited vulnerability or severe incident is detected, manufacturers must issue an early warning to ENISA and relevant national Computer Security Incident Response Teams (CSIRTs) within a punishing 24-hour window. This is followed by a comprehensive full notification within 72 hours, and a final report detailing corrective measures shortly thereafter. Non-compliance carries severe financial penalties, reaching up to €15 million or 2.5% of total worldwide annual turnover.

For years, many infrastructure vendors relied on proprietary technical bulletins hidden behind customer portals to communicate security flaws. The CRA effectively outlaws this opaque approach. By transitioning to a formalized CNA model, Scality is not only ensuring its compliance with these stringent new European mandates but is also aggressively backfilling past vulnerabilities previously noted in private bulletins into standardized public CVE Records. This proactive stance reflects a broader industry realization: security by obscurity is no longer legally or operationally viable.

Securing the Crown Jewels: Storage Joins the SecOps Stack

Beyond regulatory compliance, the transition to standardized CVE reporting addresses a critical pain point for enterprise Chief Information Security Officers (CISOs). Storage platforms hold the "crown jewels" of an organization—the proprietary data, customer records, and AI training models that define modern business value. Yet, historically, storage software has often operated in a silo, disconnected from the automated workflows of modern Security Operations Centers (SOCs).

Enterprise security teams track, prioritize, and remediate vulnerabilities almost exclusively via CVE IDs. Their entire ecosystem of automated scanners, ticketing systems, and patch deployment workflows is built around this standardized nomenclature. When a vendor relies on proprietary bulletins, it forces security engineers to manually interpret and integrate threat data, introducing dangerous friction and delays into the incident response lifecycle.

"Our customers run Scality in some of the most regulated environments in the world, and their security teams were clear about what they wanted: vulnerability information from the vendor, in the format their tools already use," said Anh Nguyen-Phuoc, chief information security officer at Scality. "Becoming a CNA means that when a vulnerability is found in Scality software, it gets its CVE ID and public CVE Record from the people who know the code best, at the moment the fix is ready. It also gives us a seat in the community that keeps the CVE system working, and we are glad to do that under the ENISA Root."

This sentiment highlights a crucial evolution in enterprise architecture. Storage software must now meet the same rigorous disclosure standards as firewalls, endpoint detection agents, and the rest of the traditional security stack.

"Storage holds the data an organization cannot afford to lose, so storage software has to meet the same disclosure standards as the rest of the security stack," noted Paul Speciale, chief strategy officer at Scality. "Becoming a CNA is a practical commitment to our customers. When something in our software needs fixing, they hear about it from us directly, with an identifier their tools recognize and the guidance to act on it. It sits naturally alongside the cyber resilience we build into every product."

The ENISA Root and the New European Standard

Scality’s authorization, officially granted on July 21, 2026, places the company under the oversight of ENISA, which became a CVE Root for European entities in late 2025. As the 13th CNA from France, Scality is part of a growing cohort of European organizations embracing structured vulnerability disclosure under regional oversight.

ENISA’s expanding role as a CVE Root is designed to strengthen the resilience and long-term sustainability of the global vulnerability identification ecosystem. This is particularly critical in 2026, as the proliferation of advanced AI models has dramatically accelerated both the defensive discovery and offensive exploitation of software flaws. ENISA’s recent threat landscape reports indicate that attackers are now weaponizing new vulnerabilities within days—sometimes hours—of their initial discovery.

By operating under the ENISA Root, Scality integrates its disclosure process directly into the European cybersecurity apparatus. This facilitates smoother reporting through ENISA’s new Single Reporting Platform (SRP) and ensures that critical vulnerability data flows seamlessly to the national CSIRTs tasked with defending the continent's digital infrastructure.

Beyond the Checkbox: A Maturing Infrastructure Landscape

Scality’s elevation to CNA status is not an isolated compliance exercise; it is part of a broader maturation of the data infrastructure market. As enterprises deploy multi-petabyte and exabyte-scale systems to support AI initiatives and defend against sophisticated ransomware campaigns, the demand for verifiable "secure-by-design" architectures has skyrocketed.

The company’s existing security framework already includes an ISO 27001-certified information security management system and the publication of a Software Bill of Materials (SBOM) with every release of its ARTESCA platform. These practices, combined with its CORE5 cyber resilience architecture, align Scality with established industry leaders. Benchmarking against the broader enterprise storage sector reveals that major players like NetApp, Dell Technologies, and Pure Storage have also adopted the CNA model, cementing standardized vulnerability disclosure as a baseline expectation for enterprise-grade infrastructure.

As the digital landscape of 2026 continues to evolve, the intersection of technical capability and transparent governance will define the market leaders. The ability to store massive volumes of data is no longer sufficient; vendors must prove they can secure that data and integrate seamlessly into the defensive postures of their customers. By embracing the transparency of the CVE program and aligning with the rigorous demands of the EU Cyber Resilience Act, storage providers are acknowledging that true resilience requires not just robust code, but an unwavering commitment to open, standardized collaboration with the global security community.