What it is
Ti Lab is the laboratory where our researchers work. It arose from a practical need: delivering our services properly required a place where we could open a device, analyse a sample or test an attack without touching anyone's production. Today it is a laboratory with real control equipment, a hardware bench, radio capabilities and analytical tools.
In ethical hacking, intrusive techniques are rehearsed here before approaching your plant. For a manufacturer, a product is evaluated here against IEC 62443-4-2 and the Cyber Resilience Act. And in training, people practise on real equipment rather than slides.
The aim is to expose the attack surface that sits between hardware, firmware, radio, applications and cloud services. When research produces a new finding, we support remediation and coordinated disclosure; see the CVEs published by the team.
The laboratory has five areas of work. Each solves a different type of problem; all share the same workbench and R&D team.
OT, IoT, IIoT and IIoMT device assessment
A network or software assessment cannot see what is inside a device. Here we open the device: a PLC, RTU, industrial gateway, smart sensor, meter or connected medical device. We work on the actual hardware, not its datasheet.
We go as deep as necessary. We identify the SoC, memory and debug interfaces (UART, JTAG, SWD); extract firmware through those interfaces or, when they are locked, through more aggressive techniques—chip-off, glitching and fault injection—and then dissect it statically with binwalk, Ghidra and IDA Pro to find factory credentials, keys and flaws, and dynamically through QEMU emulation and service fuzzing.
- PLCs and controllers: Siemens, Schneider, Rockwell, Omron…
- Plant IIoT: sensors with LPWAN or cellular connectivity, edge-computing gateways and industrial wearables.
- Healthcare IIoMT: infusion pumps, monitors, diagnostic equipment and imaging systems (PACS, RIS).
- Technical evidence for the Cyber Resilience Act and support for coordinated vulnerability disclosure with the manufacturer.
Application vulnerability research
A pentest confirms known flaws. This is the opposite: specialists spend time finding flaws nobody has yet seen—zero-days—in your software or in third-party software on which you depend, before an attacker finds them.
The method is systematic: we define the attack surface, model the threat, instrument the binary and subject it to targeted fuzzing. Each finding is investigated, developed into a proof of concept and responsibly disclosed. We cover web applications and APIs, desktop and mobile software with native components, file-format parsers, network protocols and the deepest layer: kernels, drivers and hypervisors.
- Modern fuzzing: AFL++, LibFuzzer…
- x86, x86_64 and ARM architectures; Windows internals and the Linux kernel.
- A proof of concept for every critical flaw, with vendor and relevant CNA coordination for CVE assignment and publication.
- Alignment with the Cyber Resilience Act (Article 11), bug bounty programmes and coordinated disclosure.
Software and firmware reverse engineering
We analyse binaries for Windows, Linux, macOS and embedded systems, both statically and through live debugging; unpack and deobfuscate them; reconstruct proprietary protocols and algorithms. We are especially interested in malware designed for industry, whose catalogue is short but extremely serious.
- Core tools: IDA Pro with Hex-Rays, Ghidra, Binary Ninja, Radare2/Rizin and Cutter.
- x86, x86_64, ARM, ARM64, MIPS, PowerPC and RISC-V architectures.
- Operational outputs: YARA and Sigma rules, indicators of compromise and Wireshark dissectors.
- Recovery of functionality from legacy software without source code, enabling maintenance or migration.
Software Defined Radio (SDR) laboratory
More and more signals cross a plant over the air: wireless telemetry, remote control of cranes and vehicles, LPWAN networks, sensor Bluetooth and 5G with a private APN. Almost none are audited, and many travel unencrypted or misconfigured. The radio laboratory examines this overlooked spectrum.
We begin by characterising the radio environment—what is transmitting, in which band and whether it is legitimate or unauthorised. We then analyse standard and proprietary protocols, demodulate and decode them, and test what an attacker would: replay of captured commands, manipulation, deliberate interference and geolocation. All work remains within spectrum-use regulations (CNAF, ETSI).
- SDR equipment: HackRF One, BladeRF, USRP and RTL-SDR, with spectrum analysers and directional and omnidirectional antennas.
- Industrial LPWAN: LoRaWAN and Sigfox, key management (OTAA versus ABP), and network and application servers.
- Private 5G (MPN): segmentation and isolation, core, radio access and signalling.
- Industrial Bluetooth/BLE (pairing, GATT and known flaws such as KNOB or BIAS) and radio remote control of cranes, AGVs and drones.
Applied artificial intelligence, used with judgement
AI is not magic and should not be applied because it is fashionable. In the laboratory we use it where it genuinely adds something classical techniques cannot provide: reducing the flood of SOC alerts, detecting anomalies in industrial protocols, accelerating malware analysis or reconnaissance in a pentest, and automating the mechanical parts of documentation.
We build custom prototypes—multi-agent systems, not simple wrappers around an LLM—and take seriously what many overlook: data confidentiality, prompt injection, the real cost of operating the model and the technical debt of taking an experiment into production. When data cannot leave the plant, the model runs locally.
- Anomaly detection for Modbus, DNP3, S7 and IEC 61850, with a baseline learned from the process itself and integration with Rutile.
- Open models (Llama, Mistral, Qwen) deployed on the client's infrastructure using Ollama, vLLM or TGI.
- Assistance with malware analysis and pentesting, while critical judgement always remains with the specialist.
- Honest assessment of quality, cost and risk before deciding whether a prototype moves into production, with knowledge transfer to the client.