Bosch Home Comfort Group manufactures the connected infrastructure that keeps buildings running - heat pumps, hybrid heating systems, air conditioning, ventilation, and process heat solutions. With 26 development centers and 33 production sites across Europe, the Americas, and Asia Pacific, the company's attack surface is industrial-scale: firmware updates flowing to millions of deployed HVAC units, OT networks linking factories on three continents, and cloud backends managing energy consumption data for households and industrial clients alike. Annual sales exceed eight billion euros; the stakes around securing supply chain integrity, device authentication, and data privacy in regulated energy markets are not theoretical.
For security practitioners, the relevant threat model spans the full IIoT stack. Think firmware signing for embedded controllers in heat pumps and condensing boilers, securing MQTT or equivalent telemetry channels between field devices and cloud platforms, hardening the 26 development pipelines that push code to connected products, and protecting the OT environments at 33 manufacturing sites from lateral movement. The company operates at the intersection of energy transition policy and consumer hardware - meaning compliance pressure from EU cybersecurity regulations (think NIS2, the Cyber Resilience Act) lands directly on product and platform teams.
The organization employs approximately 25,000 people and has committed over one billion euros toward making electrified heating accessible and affordable. Security work here is not bolted on as an afterthought to a pure software stack; it's embedded in the lifecycle of physical products that get installed in basements, mounted on walls, and connected to home networks for decades. The challenge is long-tail: devices shipped today will need secure update mechanisms and vulnerability response processes well into the 2030s.
