CAP-04 / Capability

Secure engineering and R&D for technology that has to hold up.

We develop robust technologies for high value targets of cyber attackers. When a device, a control system or a piece of software has to resist determined attackers, we help design it that way and test it before it is deployed.

Overview

Secure Engineering and R&D

Security is far cheaper to design in than to add later. We work with your engineers from the requirement stage: who would attack the system, what they would want, and which design choices make that hard. The result is a set of security requirements and an architecture your team can build to.

We then help prove it: design and configuration reviews, firmware and update mechanisms, and lab testing of devices and systems against the agreed requirements, with findings your developers can act on.

Scope of work

What we deliver

Threat modelling

Who could attack the system, how and why, turned into clear security requirements.

Secure system design

Architecture, trust boundaries and data flows designed to limit what an attacker can reach.

Embedded and device security

Secure boot, signed updates, protected keys and locked debug access for connected equipment.

Security testing

Lab testing of devices, firmware and systems against the agreed requirements.

Prototypes and proofs of concept

Short iterations to prove that a security approach works before it is built at scale.

Documentation and handover

Design records, test results and guidance your team can maintain.

Typical applications

01Connected industrial equipment
02Controllers, gateways and edge devices
03Building and access control systems
04Custom software for operations
05Technology evaluations before purchase
06Security reviews of new products

Configuration envelope

Parameter	Options
Stage	Concept, prototype or existing product
Focus	Hardware, firmware, software or the complete system
Methods	Design review, threat modelling, code and configuration review, lab testing
Deliverables	Security requirements, design, test results and recommendations
Intellectual property	Defined per agreement
Confidentiality	Work under a non-disclosure agreement from the first conversation

Specifications are defined per program. The table describes the configuration options we work within, not fixed product specifications.

Process

How a program runs

Requirement
Your operations, constraints and risks, captured as clear and measurable requirements.
Assessment
What is actually there: assets, connections, access and procedures, reviewed with your team.
Design review
Architecture, priorities and trade-offs, reviewed with you before anything is changed or built.
Implementation and testing
Changes put in place in planned windows and tested against the agreed requirements.
Handover and support
Documentation, training for your team and ongoing support.