Hardware & Firmware Assessments
We extract, analyze, and report on the security posture of firmware and hardware in your OT devices.
Network security tools tell you what traffic your devices generate. They do not tell you what vulnerabilities exist in the firmware running on those devices. A compromised PLC with clean network traffic is still compromised.
Our Approach
Scoping & Access
We catalog your device inventory, plan physical and logical access, and establish rules of engagement.
Extraction
We extract firmware via JTAG, UART, SPI flash dumping, or vendor-provided update files.
Analysis
Static analysis (strings, entropy, cryptography, hardcoded credentials), dynamic analysis (emulation, fuzzing), and reverse engineering of proprietary protocols.
Reporting
A technical report with CVSS-scored findings, exploitation analysis, and a prioritized remediation roadmap.
Optional: Re-test
We verify remediation of critical and high-severity findings.
Deliverables
- Technical assessment report (PDF)
- Executive summary (1–2 pages)
- Vulnerability inventory with CVSS scores
- Exploitation analysis and proof-of-concept notes
- Prioritized remediation roadmap
- Raw firmware images and analysis logs (encrypted, client-owned)
How Engagements Are Priced
We offer fixed-scope pricing per device class, time-and-materials for heterogeneous environments, and quarterly retainers for ongoing assessment programs. Specific pricing is provided after scoping.
FAQ
What devices can you analyze?
PLCs, HMIs, RTUs, industrial Ethernet switches, edge devices, and embedded controllers from major manufacturers including Siemens, Rockwell Automation, Schneider Electric, and Mitsubishi. Custom or legacy devices require scoping.
Do you need physical access to the devices?
For hardware analysis and firmware extraction via JTAG/UART, yes. For firmware-only analysis, you may provide firmware images. We specify requirements during scoping.
How do you handle zero-day findings?
We follow our 90-day coordinated disclosure policy. We notify the vendor, provide technical details, and publish after patch availability or timeline expiration. Client-specific findings may be embargoed by contract.
Can you assess devices no longer supported by the vendor?
Yes. Legacy and end-of-life devices are often our highest-value targets because they cannot be patched and require compensating controls.
What happens if you find a critical vulnerability?
We notify you within 24 hours of discovery with a preliminary finding and recommended immediate actions. The full analysis and remediation guidance follow in the final report.
Ready to scope an assessment?
Request a scoping call