Computer science refers to the science of automatic information processing. Behind this term, we find both physical machines (computers, servers, smartphones) and the programs that make them work. Understanding computer science, its simple definition and utility, requires going beyond just describing the tools to consider the logics that govern them, particularly security and the European regulatory framework that today redefines what software must guarantee.
Cyber Resilience Act: the regulatory framework that changes the game for software
For several years, the distinction between system software, application software, and development tools has structured manuals. This classification remains useful, but it says nothing about a dimension that has become central: security integrated from the design stage.
The Cyber Resilience Act (CRA), adopted by the European Union, imposes a series of new obligations on publishers of products containing digital elements. The obligations to notify actively exploited vulnerabilities will apply starting September 11, 2026, while general obligations will be fully applicable by December 11, 2027.
In practical terms, the CRA provides for risk assessment, vulnerability correction, and the provision of security updates throughout the support period. Software can no longer be marketed in Europe without meeting these requirements. To better understand computer science’s simple definition and utility, this regulatory dimension must now be integrated into any reflection on the choice of a program.
This evolution goes beyond mere administrative compliance. It redefines what it means to have “good software”: a program that is reliable functionally, but also monitored, corrected, and documented in terms of security throughout its lifecycle.
System software, application software, development tools: three categories, three distinct roles
The most common classification distinguishes three major families. Each fulfills a specific role in the operation of a computer or network.
System software
It manages the hardware resources of the machine: processor, memory, peripherals. Operating systems (Windows, Linux, macOS) are the most well-known examples. Without them, no other program can run.
The operating system also provides the basic security layer: permission management, integrated firewall, disk encryption. It is the first line of defense even before installing antivirus software.
Application software
This is the software that the user directly interacts with: word processors, spreadsheets, accounting software, web browsers. Application software translates a business need into digital functionality.
In businesses, office suites, customer relationship management (CRM) tools, and electronic document management (EDM) solutions form the most common application foundation.
Development tools
Compilers, integrated development environments (IDEs), debuggers: these programs are used to create other programs. They manipulate source code, transforming it into instructions executable by the machine.
The boundary between these categories is not always clear-cut. A web browser is application software, but it also executes JavaScript code, making it partially an execution environment. Software categories are guidelines, not airtight compartments.
Choosing software with security and licensing in mind
The usual reflex is to compare features and price. The European regulatory context invites an expansion of selection criteria. Here are the points to check before adopting software, whether for professional or personal use:
- The security update policy: does the publisher release regular patches, and for how long do they commit to maintaining the product?
- The type of license: open-source software allows auditing of the source code, which facilitates vulnerability detection by the community. Proprietary software relies solely on the publisher’s responsibility.
- Regulatory compliance: starting in 2027, software sold in Europe must comply with the requirements of the Cyber Resilience Act. Prioritizing publishers committed to this approach now reduces the risk of service disruption or non-compliance.
- Management of personal data: does the software store data locally or in the cloud? What guarantees does the publisher offer regarding the location and protection of this data?
These criteria do not replace functional evaluation, but they complement it. High-performing software whose publisher neglects vulnerability monitoring exposes the user to real risks.
Artificial intelligence and threats: why the definition of computer science is expanding
Computer science is no longer limited to the hardware-software-network triptych. Generative artificial intelligence is changing both usage and risks.
The 2025 landscape from ANSSI highlights that generative AI tools lower the technical barrier necessary to conduct malicious operations. Less experienced attackers can now carry out more sophisticated campaigns. ANSSI recorded 1,366 confirmed incidents in 2025, compared to 1,361 in 2024, a number that remains stable overall, but reports of data exfiltration increased from 130 to 196.
This increase in data theft shows that cybersecurity is no longer a topic reserved for specialists. An individual installing photo management software or an office tool is just as affected as a company equipped with an ERP.
Understanding computer science today means accepting that every installed software constitutes a potential exposure surface. The choice of a program, its updates, and the monitoring of its security patches are integral parts of daily computer use. European regulation formalizes this reality, but it existed long before the CRA.
