About me
Projects
Blog
Europe/Berlin
--:--:--
EMBEDDED · DEVICE SECURITY

Your devices are going into production, and so are their gaps.

Once shipped, you never get them back. Firmware, boot path, updates and communication get reviewed once, and hardened before customers run them.
Book a free initial analysis

Where embedded security hurts

Three typical blind spots in IoT and OT devices:
1.
Insecure boot pathWithout secure boot, foreign software can take over startup, a malicious update flash ends in fully controlled devices.
2.
Update & OTA chainsSignatures, encryption and rollback protection are often loose. A compromised update spreads malware across the whole fleet.
3.
Blind spots in communicationProtocols, certificates and key management are rarely reviewed end-to-end, exactly where attackers prefer to start.

How we make the device tight

A security audit that fits the product, from sensor to cloud connection.
1. Threat model & code reviewWe model your device's attack paths and review the critical firmware code paths in a targeted way.
2. Boot, update & communicationSecure boot, signature verification, rollback protection and protocols, from sensor to cloud connection.
3. Findings, fixes, hardeningFindings with concrete recommendations, and, on request, hardening implemented directly.

Investment

Embedded Security Audit, from NIS2 entry to a full firmware audit.from €3,000

Free initial analysis, in two steps

Both steps are free and non-binding. Afterwards you know where you stand, and what makes sense next.
Step 2 · Call with mini-findingsIn the free 30-minute call I review publicly visible hints about your systems beforehand and show you 1–2 concrete findings you can verify yourself. No slides, real starting points.
Book the call

Frequently asked questions

Your devices are going into production, and so are their gaps.

Both steps are free and non-binding. Afterwards you know where you stand, and what makes sense next.
Book a free initial analysis
To the backend & API check
Also watching the backend and cloud?
Services described here are provided by David Büngener as a freelancer. This self-check and offer do not replace legal advice or a formal review.