Adversarial Research & Red Teaming
We simulate advanced persistent threats against your OT environment, with emphasis on firmware persistence and hardware implant techniques.
Standard penetration tests stop at the network perimeter. They do not test whether an adversary with physical or supply-chain access could plant a persistent foothold in your devices' firmware — a threat model industrial operators increasingly have to answer for.
Our Approach
Threat Modeling
We define adversary capability and objectives with you, and set explicit rules of engagement and safety boundaries.
Access Simulation
We model supply-chain, physical-access, and insider paths onto target devices in an isolated lab environment.
Persistence Testing
We evaluate bootloader, firmware, and hardware implant techniques for surviving reboots, reflashes, and factory resets.
Detection Review
We assess whether your existing monitoring — network or otherwise — would have observed the simulated activity.
Reporting
A findings report with attack narrative, detection gaps, and prioritized hardening recommendations.
Deliverables
- Attack narrative report with timeline
- Persistence technique documentation
- Detection gap analysis
- Prioritized hardening roadmap
- Executive debrief session
How Engagements Are Priced
Time-and-materials, scoped to the threat model and number of target devices or systems agreed in advance. Specific pricing is provided after scoping.
FAQ
Do you test against live production systems?
No. All adversarial testing runs in isolated lab replicas or client-designated test environments. We do not simulate attacks against systems actively controlling physical processes.
What is a hardware implant, in this context?
A physical modification to a device — an added chip, a reprogrammed component, a tapped bus — intended to grant covert access or persistence. We evaluate whether such modifications are feasible and detectable on your device class.
How do rules of engagement work?
We agree on scope, target systems, safety boundaries, and an emergency stop procedure before any testing begins, documented in a signed rules-of-engagement letter.
Can this be combined with a firmware assessment?
Yes. Many clients scope a Hardware & Firmware Assessment first, then follow with adversarial testing informed by what we found.
Ready to scope an adversarial exercise?
Request a scoping call