As EU policymakers are about to adopt new laws to empower consumers and increase cyber-resilience, PI's research shows that the existing practices of device manufacturers around software and security updates fail to meet the expectations of the vast majority of consumers.