5.03Critical infrastructure
Industrial Product & Embedded Security
Security testing of industrial products and embedded devices against IEC 62443-4-2, with a development-process review against IEC 62443-4-1, prepared for the Cyber Resilience Act, the Machinery Regulation and IACS UR E27 type approval.
Since 11 September 2026 manufacturers of products with digital elements must report actively exploited vulnerabilities under the Cyber Resilience Act; from 11 December 2027 the full requirements apply, and industrial controllers, industrial firewalls and routers sit in the important-product classes. The Machinery Regulation adds protection-against-corruption requirements from 20 January 2027. Ship equipment suppliers face IACS UR E27 for newbuilds. All of these expect testing evidence.
We test the product the way an attacker and a certifier would: hardware interfaces (JTAG, SWD, UART, SPI), firmware extraction and analysis, boot and update integrity, credential and key storage, network services and industrial protocol implementations, including communication robustness testing with protocol fuzzing. Findings are mapped to the IEC 62443-4-2 component requirements and the security level you are targeting.
The development process is reviewed against IEC 62443-4-1: threat model, secure design, defect management, update delivery and the vulnerability-handling and reporting workflow the Cyber Resilience Act requires. You receive a gap report you can take to a certification body and a pre-certification test report that removes most surprises from the formal evaluation.
- CRA
- reporting since 11 Sep 2026, full application from 11 Dec 2027
- IEC 62443-4-2
- component requirements and robustness testing
Where we work in the Purdue model
IEC 62443-4-2 sets requirements by what a product is – embedded device, host device, network device or software application – and the levels show where each type usually sits. Every test runs on our bench, never in a customer’s plant.
- Actively tested
- Passive capture and configuration review
- Spares, replica lab or bench only
- Out of scope
Enterprise zone · IT
- 5
Enterprise network
Corporate IT, identity, email, cloud and internet access
Out of scope
Outside a product test.
- 4
Site business systems
ERP, scheduling, logistics and site IT
Out of scope
Outside a product test.
Industrial DMZ
- 3.5
Industrial DMZ
Jump hosts, remote-access gateways, patch servers, historian replicas
Spares, replica lab or bench only
Industrial firewalls, routers and remote-access gateways: network device requirements, which apply at every lower zone boundary too.
Industrial zone · OT
- 3
Site operations
Historians, MES, OT domain controllers, engineering workstations
Spares, replica lab or bench only
Engineering, historian and MES software: software application and host device requirements.
- 2
Supervisory control
SCADA servers, HMIs, alarm and operator stations
Spares, replica lab or bench only
HMI and SCADA software against the software application and host device requirements; operator panels against the embedded device requirements.
- 1
Basic control
PLCs, RTUs and IEDs; safety systems sit in a zone of their own
Spares, replica lab or bench only
PLCs, RTUs, IEDs and gateways: embedded device requirements, hardware interfaces and firmware.
- 0
Physical process
Sensors, actuators, drives and valves
Spares, replica lab or bench only
Smart sensors, drives and actuators with digital elements: embedded device requirements and protocol robustness.
How it works
- 01
Product scoping
Interfaces, protocols, target security level and the regulations the product must meet.
- 02
Hardware & firmware
Bench access, firmware extraction, boot and update integrity, storage of secrets.
- 03
Protocol & network
Service enumeration, authentication and robustness testing of each protocol implementation.
- 04
Process review
IEC 62443-4-1 and Cyber Resilience Act vulnerability-handling gap analysis with the product team.
- 05
Reporting
Component requirement mapping, gap report and remediation plan ahead of certification.
Packages
- Device Test
- Hardware, firmware and protocol testing of one product.
- Product + ProcessPopular
- Device test plus IEC 62443-4-1 and Cyber Resilience Act process review.
- Portfolio
- Recurring testing across a product line with vulnerability-reporting support.
Supported by our own threat-intelligence platform
Vulnerability handling under the Cyber Resilience Act needs a feed, not a quarterly search.
Frequently asked questions
What clients in your sector say
From organisations in the same sector.
Manufacturing“The OffSeq team collaborated with the LG team to identify and resolve several high-severity vulnerabilities within LG’s products and services promptly. We appreciate their dedication to helping us improve the security of LG Electronics.”
LG PSRT
Product Security Response Team · LG Electronics
Manufacturing“Their structured methodology, clear communication, and actionable insights directly contributed to increased system reliability, scalability, and resilience.”
Oskars Podziņš
Head of Information Security · Printful
Manufacturing“They found holes me and my IT team were astonished to hear about. They worked from the heart and in high quality.”
Andzejs Stenclavs
Kinetics
All services
OT & ICS Security Assessment
Know how an attacker would reach your control systems, and what NIS2 and IEC 62443 expect you to prove.
OT Penetration Testing & Red Team
Controlled attacks on control systems, under rules that protect the process.
Maritime & Port Cybersecurity
Port and vessel testing that satisfies the port inspector, the class society and the ISM auditor.
Scope a test
[email protected]+371 2256 5353
Direct access to a senior specialist · Reply within 24 hours · NDA available on request