When Hardware Gets Pwned
Course
Marcus Richerson, James DeLuccia and Aaron Guzman walk through a supply chain firmware implant from three perspectives - builder, assessor and product security team - and ask why hardware security still has no equivalent of EDR.
The hardware security industry has become very good at proving devices can be compromised. What it has not solved is what happens operationally afterward - detection, attribution, remediation and recovery at scale. This session walks through a single scenario: a firmware-level implant introduced into an enterprise managed switch during supply chain, deployed across 200 branch offices, surviving OS reload and factory reset, dormant and undetected.
In this insightful discussion, the panel of experts discuss:
- Why firmware-level persistence in deployed network infrastructure is effectively undetectable without purpose-built runtime monitoring - and what signals, if any, exist;
- How a product security team, a hardware assessor and a builder experience the same compromise scenario from three entirely different vantage points;
- Why hardware security has no equivalent of EDR or XDR, and what governance, supply chain design and repeatable testing workflows must look like to close that gap.
Here is the course outline:
When Hardware Gets Pwned: Mechanics of Detection, Response and Recovery |
Completion
The following certificates are awarded when the course is completed:
![]() |
CPE Credit Certificate |
