Full ProductAssessment

The Situation

Your product is a major investment, and your company expects a return on it. It may already be in customers’ hands, or still on the roadmap. Either way, you need to know it will perform the way it was designed to.

Our Offering

An end-to-end security assessment of your product, by the engineers you meet at scoping, led by Anthony DeLorenzo, our founder.

Every finding is ranked by business impact, with a CVSS score alongside for reviewers who expect one. Each one comes with steps to reproduce it and a fix that fits your architecture.

When the full report is ready, we walk your team through it and retest your fixes wherever a quick check is enough. A report for regulators is included, if desired.

Service Offering

It isn’t a guarantee that every vulnerability will be found, and it isn’t a certification.

It isn’t ongoing coverage of the releases that follow.

It doesn’t include fixing what we find, and bigger retests are scoped separately.

We scope the testing around your product, and build any tools it needs. Depending on what it has, that can include:

Debug interfaces: JTAG, UART, test pads
Secure boot: can someone run their own code?
Keys: can they be pulled from one unit, and what do they unlock?
Firmware, reverse engineered
Update signing and rollback
The apps, APIs and cloud that command your fleet, and how far they trust one unit

Still in design? The assessment can focus on threat modeling and architecture review.

Access to the product in scope, whether that’s units, builds or test environments, along with test accounts for any app or cloud services. We agree on access and the rules for testing during scoping.

Architecture documents, source code and schematics help where you can share them.

An engineer who can explain the system and answer questions while we work.

We sign a mutual NDA before you share anything confidential. Only the engineers on your assessment see it.

Typically $50,000–$150,000, fixed in the quote after a free scoping session.

You get findings as we confirm them, and the full report follows four to twelve weeks from the day we start. We set the dates together, working back from any deadlines you have.