About Direction of Business
A security research firm focused on the firmware and hardware layer of industrial control systems.
Why We Exist
Direction of Business was founded to address a gap we observed repeatedly in industrial security: network monitoring tools dominate the market, but the firmware and hardware running on OT devices remain largely unexamined. We are a team of embedded systems engineers and security researchers who believe that understanding what a device actually does — at the binary and silicon level — is essential to securing it. We work with industrial enterprises and government agencies to find vulnerabilities before adversaries do, and we publish our methodology and findings to advance the field.
Our Approach
Evidence-based
Every finding is traceable to a specific artifact: a firmware binary, a hardware measurement, a protocol capture. We do not rely on automated scan output or generic checklists.
Reproducible
We document our tools, environments, and procedures so that our findings can be independently verified. We share our methodology with clients and, where appropriate, with the broader research community.
Responsible disclosure
We follow a 90-day coordinated disclosure timeline by default. We notify affected vendors, provide technical details, and publish findings after patch availability or timeline expiration. We do not hoard vulnerabilities for competitive advantage.
Operational safety
We do not test live production systems. We require isolated environments or client-provided firmware images. We prioritize safety over comprehensiveness in OT environments.
Team
[Founder Name], Founder and Principal Researcher
[Founder Name] is an embedded systems engineer and security researcher with [X] years of experience in firmware analysis, hardware reverse engineering, and industrial control systems. Prior to founding Direction of Business, [he/she/they] [relevant background — prior roles, device families researched, conferences spoken at]. [He/She/They] holds [relevant certifications or degrees].
This bio is a placeholder pending founder confirmation — see the Content Plan's launch checklist (item 9). We do not publish contractor or advisor bios unless they are active and credited, to avoid implying a larger team than exists.
Ethics and Disclosure Policy
We follow a 90-day coordinated disclosure timeline by default, notifying affected vendors and publishing technical details only after a patch is available or the timeline expires. We disclose conflicts of interest to affected parties and accept no vendor commissions or reseller agreements that could bias our findings. The full policy document is in preparation — contact us with questions in the meantime.
Want to work with us?
Work with us