Resources

Notes from the field

Practical explainers on how embedded and cyber-physical systems security engagements actually work, written for the engineers and program managers who have to scope and defend them.

Pentest Scoping

Black box, gray box, or white box? How to scope a penetration test

Why black box testing costs more, not less, for the same coverage, the "test us like a real attacker" request doesn't hold up the way it sounds, and the specific cases where black box actually is the right call.

Read the article →

Have a scoping question?

Every engagement starts with a conversation, not a template.

If something you're planning doesn't fit neatly into what you've read here, that's normal. Let's talk through your specific system.

Contact Tim