900,000 homes. One weak spot. One Sunday night.

Jonas had finally got the twins to sleep. It was a Sunday evening at the end of November 2016, and he and his wife had been saving the last episode of a series all week. Nothing would play. He walked out to the hallway, looked at the little box with blinking lights that the phone company had sent them, and switched it off and on again, the way you do. Nothing. He called the helpline, and a recorded voice told him that waiting times were longer than usual. Much longer.

He did not know it, but more than 900,000 other customers were standing in their own hallways doing exactly the same thing. Nobody had guessed Jonas's password. He had done nothing wrong. Criminals had found a weak spot in that model of box itself, and because every one of them was built the same way, they all fell together, like dominoes in a line.

That is the danger hiding inside every successful product: when you sell the same thing to hundreds of thousands of homes, a mistake is never just one mistake. Under the Cyber Resilience Act, companies must build products with as few unlocked doors as possible, and fix weak spots without delay for as long as they have promised to support the product. If criminals are already using a weak spot, the company must warn the authorities within 24 hours. The fix gets there first. Jonas and his wife find out how the series ends.