Firmware & Accelerator Audit.

A firmware security audit from XSource Security is an implementation review of the code that runs before and beneath the operating system: boot-chain firmware, privileged SMM and TrustZone handlers, and the accelerator drivers between an AI workload and the hardware. Every finding is reproduced on the platform before it is written up.

What is in scope

• UEFI/SMM handlers, SMRAM and communication-buffer validation
• ARM TrustZone, TF-A/TF-M, OP-TEE and secure-boot chains
• NPU and GPU driver IOCTLs, DMA and shared-memory boundaries
• Firmware image parsing and update paths

Who it is for

Device makers, firmware vendors and teams running accelerators in production. The published Lenovo SMM CVEs and the accepted Trusted Firmware findings came out of exactly this kind of review: privileged handlers reached from a lower-privilege position, with the impact shown on the real platform.

How the engagement runs

1. Scope and threat model. The component, its trust boundaries, the attacker positions that matter and the exact build under review are fixed in writing before any code is read.
2. Map the surface. Entry points, parsers, privilege transitions and the past security fixes in that code, because incomplete fixes are where the variants live.
3. Reproduce. Tooling produces candidates; a candidate becomes a finding only when it runs, from the attacker position the scope names.
4. Report, disclose, retest. Advisory-grade write-ups with evidence, CVSS rationale and remediation. One retest within 60 days is included.

One researcher runs each engagement end to end: scoping, review, reproducing every finding and writing the report. Scope, access, findings, questions and retest results are handled in writing.

What you receive

• Confirmed scope, threat model and methodology, agreed in writing before any code is read
• Prioritized findings, each reproduced live against the build in scope, with a working proof of concept
• CVSS with rationale and the attacker position each finding requires
• Written remediation naming the location and the change
• An executive summary written for a reader who will not open the technical section
• One asynchronous retest within 60 days
• Coordinated disclosure and the CVE request with the vendor or CNA, on request, where a finding belongs upstream

The report is written to be handed straight to whoever asked for it: customer security questionnaires, SOC 2 / ISO 27001 evidence requests, ISO/IEC 42001 and NIST AI RMF work for AI systems, procurement or investor review.