Product Security & Engineering
Strong algorithms, undone by how the keys are managed.
Every place you use crypto, and whether it holds
The assessment inventories what each key and cipher actually protects, then grades it. RSA-2048 firmware signing is fine until you notice the digest is SHA-1, and a scan that reads key lengths alone reports that one as passing.
The cipher is rarely the weak part
Modern algorithms undone by how the keys are managed is the pattern, so the review covers your PKI and certificate practices, not just your primitives: one shared secret across the fleet, a signing key with no rotation path, private keys in a software keystore. Whether that last one is the right call depends on your threat model, which is the kind of judgment a checklist cannot make.
You get a mitigation strategy, not just a verdict
Every finding cites the rule behind it, from the FDA premarket cybersecurity guidance to Section 524B, and arrives with an actionable plan for closing it, so you can tell a design decision from a compliance obligation and know what to do about either.