Skip to content

AI & security

Secure-by-Design & Product Cybersecurity

For connected products sold in the European Union, cybersecurity is now a legal requirement. The cybersecurity requirements for radio equipment have applied since August 2025; the Cyber Resilience Act's reporting obligations began in September 2026, and all of its obligations apply from December 2027. We design security not as a feature added later, but as part of the board, the software and the process.

What we do

Threat modelling and risk analysis

We map out the product's assets, attack surface and risks, and tie each risk to a design decision or a test.

Hardware trust

We build secure elements, hardware-backed key storage and protection of debug ports into the board design.

Secure boot and updates

We set up signed firmware, a secure boot chain and field-update infrastructure with rollback.

SBOM and vulnerability management

We generate the software bill of materials (SBOM), track vulnerabilities in its components and set up the reporting process.

Compliance and technical file

We map the requirements of the CRA, RED (EN 18031) and IEC 62443 to your product, and prepare the technical file for conformity assessment.

Testing and verification

We verify the design through fuzz testing, static analysis and coordinated penetration testing.

Typical deliverables

  • Threat model and risk assessment
  • Security requirements and architecture
  • Secure boot and update infrastructure
  • SBOM and vulnerability management process
  • Compliance mapping table (CRA, RED, IEC 62443)
  • Technical file and test reports

Tools and platforms

  • MCUboot
  • Trusted Firmware-M
  • OP-TEE
  • SWUpdate
  • Mender
  • Syft
  • Dependency-Track
  • AFL++

Standards and methods

  • EU Cyber Resilience Act
  • RED 2014/53/EU
  • EN 18031
  • IEC 62443-4-1
  • IEC 62443-4-2
  • ETSI EN 303 645
  • ISO/SAE 21434

Applied as the project requires.

Our approach

Security isn’t won with patches after a product reaches the market; it is won at the first architectural decision. That is why we write the threat model alongside the requirements and put the security tests into the verification plan.

We do compliance work on the product itself, not on paper. Every requirement is answered by a design decision, a test or a process step.

Where we apply it

Defence & Aerospace

Electronics, embedded software and mechanics designed for harsh environments, long product life and rigorous documentation.

Industrial Automation

Control boards, embedded software and operator interfaces that run on the production line for years without interruption.

Automotive

Vehicle electronics, embedded software and test systems, built with functional safety and cybersecurity in mind.

Engineering it draws on

Systems Engineering & Architecture

We think about the product as a whole before we divide it into parts. Requirements, architecture and interfaces come together in the same picture.

Electronics & PCB Design

From schematic to a board ready for production. Power, signal integrity and testability are part of the design from day one.

Embedded Systems

Software that lets hardware speak. From microcontrollers to embedded Linux; secure, and updatable in the field.

AI & security

More AI & security services

AI Agents & Enterprise Assistants

AI assistants that work with your organisation's documents and systems, show their sources and deliver measurable results.

  • Software
  • Systems

Edge & Embedded AI

Models that process image, audio and sensor data on the device itself, not in the cloud. We design the board, the software and the model together.

  • Electronics
  • Embedded
  • Software

AI-Assisted Legacy Modernisation

We analyse legacy systems with AI-assisted tools, safeguard them with tests and move them, step by step, to a modern architecture.

  • Software
  • Systems

Let's talk about your project.

Describe it in a few sentences and we'll find the right starting point together.