We embed engineering, original research, and formal methods across the development lifecycle.
Security built in from first principles, not bolted on at the end. We integrate research and engineering across the full development lifecycle: from threat-modelled architecture and security-native implementation through expert code review, original vulnerability research, and formal verification for systems where failure is not an option.
NIST SSDFOWASP SAMMIEC 62443Common CriteriaFIPS 140-3SLSADO-178C
STANDARDS
What we hold the work to.
Development Standards
- NIST SP 800-218 (SSDF) · Secure Software Development Framework: prepare, protect, produce, respond
- OWASP SAMM v2 · Software Assurance Maturity Model for benchmarking and roadmap planning
- NIST SP 800-160 Vol. 1 & 2 · Systems security engineering and cyber-resiliency engineering
- ISO/IEC 27034 · Application security controls and organisational normative framework
- SLSA Framework · Supply chain levels for software artifacts: provenance, build integrity, source control
- CIS Benchmarks · Hardening baselines for OS, container, cloud, and network configurations
High-Assurance Frameworks
- Common Criteria (ISO/IEC 15408) · EAL evaluation support, protection profile authoring, assurance activity planning
- FIPS 140-3 · cryptographic module design, implementation guidance, pre-validation readiness
- DO-178C / DO-326A · avionics software assurance and airworthiness security process considerations
- IEC 62443 · industrial automation and control system security for OT/ICS environments
- UNECE WP.29 / ISO 21434 · automotive cybersecurity engineering and vehicle type approval
- IEC 62368-1 / ETSI EN 303 645 · consumer and IoT device security baseline requirements
Supply Chain & Pipelines
- SBOM generation & analysis · CycloneDX and SPDX formats; dependency risk assessment and licence compliance
- Artifact provenance · SLSA build levels, in-toto attestations, cryptographic artifact signing
- CI/CD hardening · pipeline isolation, secret management, ephemeral build environments, admission gates
- Dependency pinning & SCA · transitive risk analysis, vulnerability triage, automated update policy
- Policy-as-code · admission controller policies for Kubernetes and cloud environments
- VEX statements · Vulnerability Exploitability eXchange for downstream consumer communication
CAPABILITIES
Research, embedded, high-assurance.
Vulnerability Research
- Targeted vulnerability research · deep investigation of specific components, protocols, or systems to surface novel, previously unknown vulnerabilities
- Exploit development · proof-of-concept exploit construction to validate severity, confirm exploitability, and support remediation prioritisation
- Fuzzing campaigns · coverage-guided fuzzing and grammar-based fuzzing for protocol and parser targets
- Binary & protocol analysis · reverse engineering of closed-source components, proprietary protocols, and compiled binaries
- Custom security tooling · bespoke scanners, fuzzers, detection rules, and research instrumentation built to your requirements
- All findings handled under a documented Coordinated Vulnerability Disclosure (CVD) process
Embedded, IoT & OT Security
- Secure boot & firmware integrity · chain of trust design, bootloader hardening, measured boot, anti-rollback mechanisms
- TrustZone & OP-TEE · trusted execution environment design, Trusted Application development, secure world isolation
- HSM & secure element integration · key provisioning, attestation, hardware-bound credential management
- Firmware security review · static analysis, JTAG/SWD debug access assessment, binary hardening verification
- Secure OTA update architecture · signed update manifests, delta patching, rollback protection, update server security
- IEC 62443 / UNECE WP.29 · industrial and automotive security process alignment and gap assessment
High-Assurance & Formal Methods
- Formal specification & model checking · tools for protocol correctness and security property verification
- Common Criteria readiness · security target authoring, protection profile analysis, assurance activity support for EAL evaluation
- FIPS 140-3 preparation · cryptographic module boundary definition, algorithm selection, pre-validation documentation
- Safety-security co-engineering · DO-178C / DO-326A for avionics; IEC 61508 / IEC 62443 for safety-critical industrial systems
- Memory-safe language migration · migration strategy, safe wrapper design, incremental rewrite planning for legacy codebases
HOW WE ENGAGE
Embedded or project-based.
Embedded Engineering
- Dedicated engineer(s) allocated to your team for the engagement duration
- Participation in sprint planning, design sessions, and retrospectives
- Continuous PR review and security advisory throughout development
- Threat modelling and architecture review at each feature milestone
- Knowledge transfer and security champion enablement as a built-in outcome
- Weekly written summary of findings, decisions, and open risks
Project-Based & Advisory
- Defined scope, timeline, and deliverables agreed before work begins
- Interim findings issued during engagement for high-severity issues without waiting for the final report
- Parallel workstreams across architecture, code, and verification available for large scopes
- Accelerated scheduling available for pre-release or compliance deadlines
- Retainer option for ongoing vulnerability research or periodic review cycles
- Advisory-only engagements available for design review and threat modelling without full implementation access
DELIVERABLES
What ships at the end.
Architecture & Design
- Threat model document with STRIDE/PASTA analysis, data-flow diagrams, and mitigations mapped to controls
- Architecture decision records (ADRs) with security rationale
- Reference architecture diagrams and trust-boundary specifications
- Secure-by-default IaC modules and application framework templates
- Security requirements specification tied to assurance level
Review & Research
- Code review report: CWE-tagged findings, CVSSv4 severity, reproduction steps, remediation guidance
- Vulnerability research report with technical write-up and proof-of-concept
- Fuzzing campaign report: crash triage, root cause analysis, coverage metrics
- SBOM (CycloneDX / SPDX) with risk assessment and VEX statements
- Binary analysis report for closed-source or firmware targets
Engineering & Assurance
- Secure coding standard and developer guidance documentation
- CI/CD security gate configuration and policy-as-code rules
- Custom security tooling with source code and documentation
- Verification & validation report with test evidence for sign-off
- Common Criteria security target or protection profile (where applicable)
IP, NDA & DISCLOSURE
Ownership agreed up front.
The signed MSA and SoW define ownership, licences, and transfer triggers. Vulnerabilities found in third-party components are handled under an agreed coordinated-disclosure process.
Intellectual Property
- Contract-defined ownership · the signed MSA and SoW define ownership or licence rights, transfer triggers, and treatment of code, tooling, documentation, and research produced under the engagement
- Any Grilli Security background IP incorporated into a deliverable is subject to written disclosure and agreed licence terms
- Open-source components used in deliverables are identified with licence obligations documented in the SBOM
- IP terms are finalised and signed before any work begins, with no ambiguity at project close
Confidentiality
- Mutual NDA executed before any code, architecture, or system information is shared
- Source code and proprietary information handled on isolated, access-controlled systems and never stored in shared or cloud-sync environments without explicit agreement
- All research artefacts (exploits, PoCs, vulnerability details) treated as strictly confidential and returned or destroyed at engagement close
- No publication, blog post, or public disclosure of client-specific findings without explicit written consent
Coordinated Vulnerability Disclosure
- CVD process · vulnerabilities discovered in third-party components handled aligned with ISO/IEC 29147 and 30111
- Client is notified immediately upon discovery; disclosure timeline and approach agreed jointly before any vendor contact
- CVE assignment support provided where applicable; advisory drafted in CSAF/CVRF format
- No unilateral disclosure: disclosure decisions account for the client's operational and legal interests
Get a written proposal
Send scope + timeline. Initial response and next steps within 1 business day; proposal timing is confirmed after scoping.
Open the form →
Email a senior practitioner
Direct line for scoping questions. NDA available on request before you share details.
hello@grillisecurity.com →
Active incident?
24/7 incident line. Triage call + retainer set-up inside the hour for new engagements.
+372 5610 1641 →