▮ Autonomous adversary emulation · embedded & OT
We break firmware
before attackers do.
An AI-driven hardware red team for firmware, CAN bus, and fault injection.
mavka ~ run● ● ●
$ mavka run --target bms-fw.elf --twin stm32h563
› boot firmware on register-accurate twin … ok
› adversary engaged … fuzzing CAN + Modbus
CRITICAL MAVKA-0007 reproduced ✓
Stack overflow in CAN handler → code exec
① inject CAN id 0x18FF50E5, 64B
② overflow can_rx_buf[] +72B @ 0x2000_41a8
③ overwrite ret → 0x0800_9c14
④ execute attacker thunk (MPU off)
proof mavka replay MAVKA-0007 · 1,284 cyc
note real on the faithful peripheral model
$
Built to prove testing for
EU CRA
UNECE R155 / R156
ISO / SAE 21434
IEC 62443
01 — The problem
Devices nobody can safely test.
Probe a live PLC, ECU, or pump and it breaks. So the riskiest systems go untested.
47%
of orgs hit unintended disruption during OT security assessments. — SANS
19h
line shutdown at an auto plant, from a routine vulnerability scan.
2027
EU CRA obligations bite. Security testing becomes mandatory.
02 — The approach
Plan on a twin. Strike real silicon.
Not static analysis. Not an SBOM. The agent rehearses on a silicon-accurate twin, then strikes the real device through a hardware pod — JTAG, CAN, fault injection. Where the silicon diverges from the twin is the bug.
No phantom crashes.
The twin is register-accurate and validated against real silicon on a hardware bench. A bug it finds reproduces on the chip — and the bench-vs-silicon dataset is a moat a software team can't clone. The diff is the product.
03 — The loop
Runs on every build.
[01]
Emulate
Boot your firmware on a register-accurate twin.
[02]
Attack
An autonomous adversary probes firmware, CAN, and protocols.
[03]
Prove
Every finding is a reproducible exploit chain.
[04]
Repeat
In CI. Catches regressions the day they land.
04 — Why it's open
Everyone else stops above the firmware.
Autonomous pentest is well funded. All of it targets web apps and IT.
Where they play
Where it stops
IT autonomous pentestHorizon3 · XBOW · RunSybil
Web apps and IT. No firmware, no CAN.
OT defense platformsClaroty · Nozomi · Dragos · Armis
Passive. They watch; they never attack.
Firmware securityONEKEY · NetRise · Finite State
Static analysis. They read the binary, not run it.
Mavka
Agent-driven exploitation at the firmware, bus, and glitch level — twin + real silicon.
05 — Why now
Regulation made it a deadline.
A requirement with a date on it. The buyers are in Europe.
EU CRA
Connected-product obligations land Dec 2027. Testing becomes mandatory and auditable.
UNECE R155
Pen-testing and fuzzing already mandatory for new vehicles in the EU.
IEC 62443
Now written into industrial procurement contracts.