Firmware assessment
Review of embedded Linux, RTOS images, boot assumptions, update mechanisms, exposed services, and local debug paths.
Product security assessment
Security review for firmware, devices, and control planes.
Bitfield Research helps engineering teams evaluate connected products before release, procurement, or customer security review.
NDA-first work
Focused 1-3 week reviews
Engineer-ready findings
asset: gateway-fw-2.8
interface: update service
status: assessment in progress
0x0000 7f 45 4c 46 01 01 01 00
0x0040 b5 03 00 00 34 00 20 00
0x00c0 a0 12 00 00 f4 ff 00 00
notes:
boot chain checked
update controls reviewed
network exposure mappedServices
Independent review for systems with real-world constraints.
Device and protocol review
Assessment of pairing flows, authentication boundaries, proprietary protocols, telemetry, cloud APIs, and management channels.
Hardening support
Security findings translated into engineering tickets, validation steps, release guidance, and customer-facing assurance notes.
When it fits
Useful when a product needs a second technical read.
Pre-release review
Assess firmware, management interfaces, and update flows before a launch or major customer pilot.
Vendor diligence
Review a device, appliance, or software-controlled system before bringing it into a sensitive environment.
Customer assurance
Produce practical evidence for security questionnaires, enterprise reviews, and remediation follow-up.
Issue validation
Confirm whether a suspected weakness is exploitable, product-relevant, and worth prioritizing.
Output
Clear artifacts for engineering, security, and procurement teams.
Assessment plan
Target inventory, assumptions, access requirements, and areas intentionally out of scope.
Findings report
Risk-ranked issues with reproduction notes, impact, affected components, and remediation guidance.
Engineering readout
Walkthrough with owners so fixes can be sequenced against release and platform constraints.
Retest memo
Confirmation of resolved items and notes for accepted risk or follow-on work.
Approach
Lightweight process, private by default.
01
Start with the product goal, target environment, threat model, and what decision the review needs to support.
02
Work from firmware images, test hardware, docs, logs, source snippets, or remote access when useful.
03
Deliver privately. Public disclosure or publication only happens when explicitly agreed in advance.
Review surface
Common areas covered during an assessment.
Update integrity
Authentication boundaries
Debug exposure
Secrets handling
Transport security
Management APIs
Telemetry paths
Fleet operations
Contact