We test whether your security boundaries hold.
Redlings is a technical product security boutique specialising in embedded systems, firmware and cryptography. We assess connected devices as well as standalone web applications and APIs. Our pentesters also develop software. They work directly with your engineering team to address weaknesses in code and architecture.
Security extends beyond the device.
Firmware, maintenance interfaces, protocols and backend services interact. We investigate the access an attacker can gain through them and which security boundaries hold. The assessment scope follows your product architecture and security objectives.
A security defect can scale with the product.
Once deployed, a shared weakness can affect devices, customer environments and the infrastructure behind the product.
Assessing product security.
From devices to applications.
Pentests, code reviews and architecture reviews answer different questions. We work with your engineering team to identify those that matter for your system – whether it is an embedded product, a web application or an API.
Device & Firmware Security Assessment
For products where the device itself is part of the target. We test the system from physical interfaces, hardware security controls and boot chains through firmware, protocols, applications and backend components.
Device & Firmware Assessment →Penetration Testing
Standalone pentests for web applications, APIs and backends. We examine roles, tenant isolation and business logic, trace exploitable flaws to their cause and discuss remediation directly with your engineers.
Penetration Testing →Cryptography, protocols
and security-critical code.
Review scope can be limited to a specific trust model, protocol implementation or security-critical code path.
Cryptography Review
Cryptographic designs and implementations for devices and standalone software. We examine key management, signatures, encryption and protocols, including rotation, revocation and recovery.
Cryptography Review →Wireless & Protocol Security
Proprietary protocols, RF, pairing, authentication and protocol reverse engineering.
Security Code Review
Firmware, bootloaders and parsers as well as libraries, clients and backend code: we review security-critical implementation paths.
Vulnerability Response
Technical response for reported product vulnerabilities, reproduction, exploitability analysis, remediation support, coordinated disclosure and retesting.
Product Security Architecture Review
Which security assumptions does your product depend on, and what happens when one fails? We review trust boundaries, identities, privileges and recovery before fundamental decisions become fixed in the implementation.
Explore architecture review →
Dr. Ewan Fleischmann
Redlings is technically led by Dr. Ewan Fleischmann, a PhD cryptographer with a background in offensive security, security research and complex product-security assessments.
We investigate products
to understand how they fail.
Original technical work across devices, firmware, protocols and cryptography.
Reverse engineering, analysis and tooling.
Original technical work across devices, firmware, protocols, cryptography and product infrastructure.
Scope. Attack & Review. Verify.
We define the scope with your IT, security or development team, test the agreed systems and deliver findings your team can reproduce and fix.
Scope with your team
Map architecture, trust boundaries, attacker assumptions and the access needed for the assessment.
Attack & review
Use the methods the target requires: penetration testing, reverse engineering, protocol analysis, cryptographic review, source code review or hardware analysis.
Findings and retest
Document reproducible findings, technical impact and remediation context. Retest fixes against the original attack path.
Need the testing to support a regulatory requirement?
Where required, assessment work and findings can be mapped to relevant technical requirements from the CRA, EN 18031 and IEC 62443.
Product Security Regulation →Field notes on
product security.
Technical analysis, engineering lessons and regulatory context for teams building security-critical products.
Secure boot is not a checkbox: where trust chains fail in real products
A practical look at the gaps between “secure boot enabled” and a boot chain that actually resists an attacker.
Read note →EN 18031, CRA and IEC 62443: where technical testing fits
How regulation and standards create real technical validation needs for product teams.
Read note →Why device key management becomes painful at scale
Provisioning, storage, rotation and recovery patterns worth designing before production.
Read note →What would you like tested?
Describe the application, network or product, your reason for testing and the preferred timeline. You will define the scope directly with an experienced tester.