Understand the hardware. Identify the vulnerabilities.
Identify assets, attacker access, trust boundaries, and credible attack paths across the device, companion software, communications, and connected services. Use MITRE EMB3D™ mappings to inform the questions that need validation.
Inventory exposed connectors, test points, removable media, and debug or service interfaces. Assess UART, JTAG, SWD, and other interfaces against the intended production configuration and access model.
Review firmware structure, software components, configuration, and available SBOM or BOM records. Evaluate known vulnerability relevance against the exact component version, exposure, and deployment conditions.
Examine the design and available evidence for secure boot, firmware authenticity, rollback protection, device identity, provisioning, and secret storage. Identify gaps between intended controls and demonstrated enforcement.
Review device protocols, authentication, authorization, pairing, and sensitive data flows. Trace the trust placed in local networks, companion applications, APIs, and remote management services.
Prioritize supported weaknesses by realistic prerequisites and product impact. Give engineering teams exact affected versions, evidence, corrective options, and the validation needed to close each finding.
Record device identity, board revision, firmware, components, deployment context, and the security questions the assessment must answer.
Review the architecture, interfaces, trust boundaries, provisioning, and update design against credible attacker access.
Correlate component intelligence and observed controls, distinguish candidates from validated findings, and identify targeted testing needs.
Deliver reviewed findings with affected versions, prerequisites, product impact, remediation options, and explicit evidence gaps.
Scope review confirms target devices, hardware revisions, firmware builds, available access, and the assessment methods. Public examples illustrate the method and are not customer assessment results.
Tell us about the system and the decision ahead.
