Firmware & configuration deltas
Compare new firmware builds, configurations, exposed services, and security settings with the assessed baseline. Identify changes to attack surfaces, control behavior, and earlier findings.
What we investigate.
BOM, SBOM & dependency changes
Track available hardware and software component records, substitutions, library versions, and supplier changes. Correlate changes with the product revisions and deployments they actually affect.
Bespoke vulnerability intelligence
Define collection requirements for the device family and its dependencies. Review relevant CVEs, vendor advisories, technical research, and disclosures, with applicability analysis rather than an unfiltered alert feed.
Security observability requirements
Specify the logs, telemetry, update records, and configuration evidence needed to investigate product security changes. Agree the available integrations, collection boundary, retention, and review owner.
Change-driven retesting
Use material changes or new vulnerability evidence to scope targeted validation and regression tests. Recheck the assumptions and reproduction conditions behind previous findings.
Remediation & evidence currentness
Maintain the affected-version record, remediation and retest status, unresolved gaps, and reasons for reopening a finding. Preserve the history when new evidence changes the conclusion.
How we work.
Baseline the product
Record hardware revisions, firmware builds, components, exposed interfaces, assessed controls, and existing findings.
Set collection requirements
Agree advisory sources, vendor and dependency coverage, available telemetry, review cadence, and materiality thresholds.
Assess applicability & change
Determine which versions and operating conditions are affected, whether existing controls still apply, and which claims need validation.
Retest & update the record
Scope focused testing, verify corrective changes, and retain the evidence and rationale behind each revised finding status.
What you receive.
- Versioned product baseline and intelligence requirements
- Applicability-reviewed advisory and change analysis
- Prioritized retest and regression validation plan
- Finding history with affected versions and remediation status
Collection sources, observability integrations, and review cadence are agreed per engagement. This scoped review model does not imply an operating 24/7 customer monitoring service.
Start with your question.
Tell us about the system and the decision ahead.