Research and development

The OffSec Hardware Lab

Software can test a server. It cannot test a reception desk, a locked workstation, an unattended port or a room that is supposed to be sealed. Our hardware programme builds the physical layer tools our red team needs for authorised assessments, designed and assembled in India.

Authorised testing only Designed in India Design partner programme open

Apply as a design partner Read our responsible use charter

programme status

Purpose: Physical layer attack simulation for regulated and isolated environments
Users: Our own red team, and vetted partners under written authorisation
Design: In house hardware and firmware, with tamper evidence and audit logging
Controls: Engagement scoped activation, chain of custody, device recovery accounting
Availability: Not sold on the open market. Access is by invitation and contract

researchprototypefield trialrelease

Because the physical layer is still the softest

Organisations spend heavily on network and cloud defence, then leave an unattended machine in a branch office with an open port and a logged in session.

Because imported tools are a supply chain risk

For defence, government and critical infrastructure work, equipment of unknown provenance is itself a problem. We build what we use, and we can account for every unit.

Because findings must be reproducible

A finding is only useful if the client can see it happen, understand the cause and verify the fix. Our own hardware lets us instrument every step of a test.

Programme lines

Four lines, one purpose: prove the physical risk before someone else does

Each line below is described at capability level. We publish what a device is for and what a client learns from it. We do not publish designs, firmware details or anything that would help somebody build an attack tool.

Line 01

HID assessment devices

A human interface device implant presents itself to a computer as an ordinary keyboard or peripheral. Our assessment devices use that behaviour, under contract, to answer one question: what actually happens when an unknown device is plugged into your estate?

What the client learns

Whether endpoint policy blocks unapproved human interface devices at all.
Whether a locked or unattended workstation can be driven by a peripheral.
Whether the attempt is logged, alerted on, and noticed by anyone.
How long it takes the SOC to connect the event to a physical visitor.

This is the exact scenario the HID and removable device blocking module in Eternal Security Suite is built to stop. Testing it and defending it come from the same team.

Line 02

Air gapped environment assessment kits

Isolated networks in plants, laboratories, defence facilities and secure government rooms are assumed to be safe because they are disconnected. That assumption is rarely tested. These self contained kits let our team assess an isolated environment without ever connecting it to anything.

What the client learns

Whether the air gap is real, or quietly bridged by a laptop, a phone charger or a maintenance link.
How removable media moves in and out, and whether anyone checks it.
Whether an isolated system would produce any evidence at all after an incident.
Which controls can be added without disturbing a production or safety critical process.

Work in operational technology environments is always planned with the engineers responsible for physical safety, and never performed on a live safety critical process without their sign off.

Line 03

Advanced hardware keyloggers

An inline hardware recorder is one of the oldest attacks in the book and one of the least looked for. We build instrumented versions for supervised physical security audits, where the point is not the data but the detection: does anybody ever look behind the machine?

What the client learns

Whether physical inspection routines exist and are actually carried out.
Whether shared and kiosk machines in branches and receptions are checked at all.
Whether staff report an unfamiliar device, and how quickly.
How to train facilities and IT teams to spot one in under a minute.

Deployed only under a signed engagement with a defined scope, defined locations and a defined end date. Captured material is encrypted on the device, is retained only as long as the report requires, and is destroyed with a certificate. These devices are never supplied for employee monitoring.

Line 04

Electromagnetic emission research platforms

Every piece of electronic equipment radiates. Decades of published research show that unintentional emissions can carry information about what a device is doing. Our research platforms measure those emissions so that organisations with genuinely sensitive rooms can find out what theirs are giving away.

What the client learns

The emission profile of equipment inside a designated secure area.
Whether existing shielding, separation and power filtering are doing their job.
Where equipment placement or cabling changes would reduce exposure.
A measured baseline that can be retested after remediation.

This line is measurement and defensive research. It is offered to government, defence and critical infrastructure clients under appropriate authorisation, and findings are delivered as remediation guidance, not as attack capability.

Responsible use charter

Rules we hold ourselves to

Offensive capability without discipline is just risk with a logo on it. These rules are written into our engagement contracts, not only into our marketing.

Written authorisation first. No device leaves the lab without a signed scope naming the systems, the locations, the people informed and the end date.
No open market sales. Devices are not listed, shipped or sold to the general public. Access is contractual and reviewed case by case.
Accounted for, always. Every unit has an identity, a custody record and a recovery check at the end of an engagement.
Minimum data. We collect only what the finding requires, encrypt it, and destroy it on a documented schedule.
Never for surveillance of individuals. We do not supply or operate this equipment for monitoring employees, partners or private persons.
Defence is the deliverable. Every engagement ends with the control that would have stopped it, and we will help you implement that control.

engagement flow

Scope and authorisation

Legal review, named approvers, rules of engagement and a safe word procedure.

Controlled assessment

Instrumented testing with a live log your team can watch in real time.

Debrief and remediation

Findings, recordings, root causes and the specific controls that close them.

Retest

We come back and try again, because a fix is only proven when it holds.

Design partner programme

Help us test it where it matters

We are looking for a small number of organisations in banking, government, defence adjacent manufacturing and healthcare to trial these lines under contract. Design partners get early access, a say in the roadmap and a physical security assessment carried out with the equipment itself.

Apply as a design partner See our VAPT and red team services