Product security for product makers.
We help product developers and manufacturers integrate security into development, verification, regulatory evidence, and postmarket support.
The Product Security Guild brings the capabilities of a complete product security organization together under one team. We work as an extension of your team, adapting our support to your products, risks, resources, and level of security maturity.
Practical engineering.
Clear, defensible evidence.
Regulated products do not share one cybersecurity checklist. They do share the need to interpret requirements, integrate security into development, perform specialized testing, and maintain fielded products. We connect every activity to practical product decisions and defensible evidence across the total product lifecycle.
Security leadership and governance
Build and operate a product security program aligned with business, development, and quality objectives. Our support ranges from complete program formation to fractional product security leadership: policies, procedures, work instructions, reusable templates, maturity roadmaps, metrics, and management reporting.
New product cybersecurity readiness
Integrate cybersecurity from the earliest phases of product planning. We develop threat models, cybersecurity risk assessments, security requirements, architecture views, controls, and traceability. Software bill of materials (SBOM) analysis, third-party software review, support planning, and product-change assessments help connect engineering decisions to regulatory and customer evidence.
Security verification and testing
Evaluate realistic threats, verify security controls, and connect findings to product risk decisions. We combine penetration testing, attack-surface analysis, static application security testing (SAST), vulnerability scanning, software composition analysis (SCA), fuzz testing, malformed-input testing, and protocol, embedded, and hardware testing. Support includes finding assessment, remediation consultation, retesting, and reporting.
Postmarket cybersecurity management
Product security responsibilities continue after release. We support security-signal surveillance, vulnerability monitoring, triage, risk assessment, coordinated vulnerability disclosure (CVD), SBOM maintenance, periodic testing, and patch planning. Incident readiness, response, legacy-product assessment, and end-of-life support keep lifecycle decisions connected to the product's supported use.
Product security training for makers
Build practical product security knowledge across leadership, quality, regulatory, systems, software, and embedded engineering teams. Custom live training, workshops, and executive briefings connect concepts to your products and processes. A self-paced maker course and optional hands-on lab are in development.
Explore Product Security TrainingCustom consulting
Access experienced specialists for needs that do not fit a standard engagement. We provide hourly or retainer-based subject matter expertise, targeted reviews, custom research, architecture, engineering, and remediation support, plus surge capacity for submissions, incidents, acquisitions, and portfolio initiatives.
A complete solution, or
the specialist you need next.
Whether you need to establish a product security program, prepare evidence for a review, resolve a technical finding, or support a released product, start with the decision in front of you. We will help define the work around your product, your risks, and your timeline.
Discuss Your ProductYour product and market set the requirements.
We consider intended use, architecture, target markets, operating environments, and support commitments before mapping regulations, standards, and customer requirements to engineering activities and evidence.
Medical Devices
Cybersecurity evidence for device development, premarket submissions, quality-system integration, and postmarket support.
Connect cybersecurity to device safety and regulatory evidence.
We help medical-device manufacturers prepare cybersecurity evidence for 510(k), De Novo, and PMA submissions, including support for FD&C Act Section 524B requirements for cyber devices and FDA's February 2026 premarket cybersecurity guidance.
We support integration of security processes with the Quality Management System Regulation (QMSR), 21 CFR Part 820, which incorporates ISO 13485:2016. A Secure Product Development Framework (SPDF) can connect security risk management, design controls, verification, and lifecycle activities within that quality system. FDA guidance
For EU markets, we support cybersecurity technical documentation in the context of the Medical Devices Regulation (MDR), Regulation (EU) 2017/745, and the In Vitro Diagnostic Medical Devices Regulation (IVDR), Regulation (EU) 2017/746, informed by MDCG 2019-16 Rev.1.
Preparing a submission, addressing a deficiency, or maintaining a released device? Tell us the device, the review stage, and the deadline.
Where we help
- Submission gap assessments and total product lifecycle cybersecurity risk-management planning.
- Threat models, cybersecurity risk assessments, security architecture views, requirements, and control traceability.
- Machine-readable SBOMs, third-party vulnerability analysis, and software-support assessments.
- Security test plans, penetration testing, firmware and protocol testing, control verification, remediation, and retesting.
- Cybersecurity labeling, unresolved anomaly assessments, readiness reviews, and deficiency-response support.
- Postmarket vulnerability monitoring, CVD processes, patch planning, disclosure, and incident readiness.
Casino and Gaming
Product and platform cybersecurity for gaming suppliers navigating technical standards and jurisdiction-specific reviews.
Make the security evidence fit the gaming system and market.
Gaming devices, interactive platforms, and wagering systems face different security expectations. We help suppliers connect product architecture, security controls, testing, and remediation evidence to the requirements of their target jurisdictions.
Relevant references can include GLI-11, Gaming Devices; GLI-19, Interactive Gaming Systems; GLI-33, Event Wagering Systems; and the GLI Gaming Security Framework (GLI-GSF). These are standards and assessment frameworks, not a single set of laws that applies everywhere. Each jurisdiction determines its requirements. GLI standards
For products supplied into Great Britain's licensed remote-gambling market, the Gambling Commission's Remote gambling and software technical standards (RTS) provide additional context. Their security requirements reference relevant controls in ISO/IEC 27001:2022. RTS security requirements
Tell us what you supply, where it will be deployed, and which security review or technical requirement you need to address.
Where we help
- Cybersecurity gap assessments and evidence mapping for the agreed product, platform, and jurisdictional scope.
- Threat modeling across software, embedded devices, mobile applications, cloud services, APIs, and external integrations.
- Assessment of authentication, authorization, privileged access, communications, sensitive data handling, and security logging.
- Penetration testing, vulnerability analysis, component review, remediation prioritization, and retesting.
- Security documentation, change-impact assessments, supplier evidence, and lifecycle vulnerability management.
Healthcare and Biotech
Secure healthcare software, laboratory instruments, and biotech platforms built for sensitive data and regulated workflows.
Protect the product, the data, and the record of what happened.
Healthcare software, connected laboratory instruments, and biotech platforms often sit between embedded technology, cloud services, sensitive information, and controlled processes. We help makers define product-level security controls and produce evidence that supports their customers' operating and quality requirements.
For electronic protected health information (ePHI), product controls can support customers' HIPAA Security Rule responsibilities, including access control, audit capabilities, and data protection. HIPAA applies to covered entities and business associates, not automatically to every product manufacturer. HHS Security Rule summary
For regulated electronic records and signatures, relevant context may include 21 CFR Part 11. Computerised systems used in GMP-regulated activities may also be subject to EU GMP Annex 11. Applicability depends on intended use, the records involved, and the regulated activity. Products regulated as medical devices or IVDs follow the device-specific route above.
Tell us what your product does, which data or records it handles, and the workflow your customers rely on.
Where we help
- Threat models and cybersecurity risk assessments spanning instruments, applications, cloud services, and data flows.
- Security requirements for access, privilege management, communications, sensitive data, logging, and remote support.
- SBOM analysis, third-party software review, penetration testing, and embedded or protocol testing.
- Traceable control-verification evidence and security documentation to support customer validation and supplier review.
- Product-change assessments, vulnerability management, patch planning, and customer communications.
Component Design and Manufacturing
Component-level cybersecurity assessments, testing, and reusable security evidence that support customer integration and regulatory readiness.
Make your components easier to evaluate, integrate, and trust.
Your customers need more than technical specifications. We help component designers and manufacturers identify security risks, validate security characteristics, and develop reusable evidence packages that make their components easier to integrate into regulated products.
Rather than requiring every customer to independently investigate the same component, we help you provide security documentation that supports their risk assessments, regulatory submissions, and supplier qualification processes.
Whether you design or manufacture sensors, embedded electronics, connectivity modules, or other critical components, we help turn security transparency into a competitive advantage.
Tell us what your component does, which products it goes into, and the security evidence your customers are requesting.
Where we help
- Component-level cybersecurity risk assessments and threat modeling.
- Firmware, hardware, interface, and communication security testing.
- Software bill of materials (SBOM) development and vulnerability analysis, where applicable.
- Reusable security data sheets, technical evidence, and customer-facing documentation.
- Ongoing vulnerability monitoring, security updates, and evidence maintenance.
Oil and Gas
Product security for control systems, connected equipment, and software deployed into high-consequence energy environments.
Design security around field conditions and operating constraints.
Products used in oil and gas must be assessed in the context of availability, safety, remote operation, long service lives, and limited maintenance windows. We help equipment and software makers connect those constraints to security architecture, testing, support planning, and evidence for operator review.
For pipeline control environments, API Standard 1164, Pipeline Control Systems Cybersecurity, provides a relevant industry reference. IEC 62443-4-1 addresses secure product development, while IEC 62443-4-2 addresses technical requirements for industrial automation and control system components. The applicable scope depends on the product and its deployment. IEC 62443-4-1, IEC 62443-4-2
Tell us where the product will operate, how it connects, and which safety, availability, or support constraints the security work must respect.
Where we help
- Threat modeling for controllers, gateways, embedded devices, monitoring software, and remote-support connections.
- Security requirements and architecture review tied to the intended operating environment.
- Firmware, protocol, malformed-input, and penetration testing with an agreed test scope and safety constraints.
- SBOM and software-support analysis, vulnerability triage, patch strategies, and compensating-control guidance.
- Security test reports, deployment guidance, and evidence to answer operator procurement and acceptance questions.
Industrial Control Systems and Operational Technology
Secure development and component assurance for industrial products that must remain supportable in real OT environments.
Connect secure development to component-level evidence.
Industrial controllers, gateways, connected equipment, and control software need security engineering that accounts for their interactions with the wider system. We help makers define product boundaries, identify realistic threats, verify controls, and document the assumptions their customers need for secure integration.
IEC 62443-4-1 provides secure product development lifecycle requirements for developers and maintainers of industrial automation and control system products. IEC 62443-4-2 provides component-level technical security requirements. We connect the agreed standard scope to processes, product requirements, testing, and traceable evidence.
For in-scope products supplied to the EU, we also support readiness for the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, alongside applicable sector and customer requirements.
Developing an industrial product, addressing an IEC 62443 gap, or responding to a customer's security requirements? Start with the product and the evidence being requested.
Where we help
- Secure development lifecycle assessments, gap roadmaps, procedures, and implementation support.
- Threat modeling and security architecture for hardware, firmware, software, communications, and remote access.
- Component requirements, control verification, and evidence mapping within the agreed IEC 62443 scope.
- Penetration testing, protocol testing, fuzz testing, remediation, and retesting.
- SBOM maintenance, vulnerability disclosure, patch planning, and installation, operation, and support documentation.
Manufacturing
Product security for connected machinery, automation equipment, and software supplied into manufacturing environments.
Deliver equipment your customers can assess and support.
Manufacturing customers need to understand how connected equipment will behave on the production floor, how it will be supported, and what happens when a vulnerability is discovered. We help makers turn those questions into security requirements, engineering decisions, test evidence, and usable product documentation.
Where a product is part of an industrial automation or control environment, relevant references may include IEC 62443-4-1 and IEC 62443-4-2. In-scope products supplied to the EU may also require CRA readiness. Sector-specific requirements and customer contracts determine additional expectations.
Tell us what you manufacture, how the product connects to your customer's environment, and the security evidence needed to move forward.
Where we help
- Threat models for connected machinery, embedded controls, software interfaces, and remote-service functions.
- Architecture and requirements review for access control, communications, update mechanisms, and security logging.
- Product penetration testing, firmware and protocol testing, and verification of security controls.
- SBOMs, software-support assessments, configuration guidance, and evidence for customer security acceptance.
- Vulnerability monitoring, remediation planning, product-change assessment, and end-of-support communications.
Semiconductors
Embedded product security and cybersecurity evidence for equipment supplied into semiconductor fabrication environments.
Make supplier security evidence fit the fab environment.
Semiconductor product and equipment makers face detailed customer expectations around software support, system hardening, network interfaces, component security, and field service. We help connect hardware, firmware, software, and support processes to the security requirements of the intended product and environment.
For relevant fab equipment, SEMI E187, Specification for Cybersecurity of Fab Equipment, addresses operating-system support, network security, endpoint protection, and security monitoring. Its scope is specific; it is not a blanket requirement for every semiconductor product.
SEMI E188, Specification for Malware Free Equipment Integration, addresses equipment delivery, installation, and support activities. We help identify which supplier requirements and evidence requests apply to your equipment and engagement.
Tell us whether you are developing a component, supplying fab equipment, or addressing a customer requirement. We will define the relevant product security scope.
Where we help
- Embedded hardware and firmware analysis, threat modeling, and security architecture review.
- Software-support assessments, configuration review, vulnerability analysis, and security testing.
- Network-interface, authentication, access-control, endpoint-protection, and logging requirements.
- Evidence mapping for relevant SEMI E187 and E188 requirements, including shipment and service processes.
- Remediation plans, retest reports, vulnerability management, and customer-facing security documentation.
Other Products and Foreign Markets
Product security support for connected technologies shaped by product and market legislation, customer requirements, or high-consequence use.
Start with the product, not an assumed checklist.
Your product may not fit a single industry label. We begin with its intended use, architecture, data, connectivity, target markets, and support period, then map relevant expectations to security engineering, testing, documentation, and lifecycle activities.
For in-scope products with digital elements supplied to the EU, the Cyber Resilience Act (CRA), Regulation (EU) 2024/2847, creates manufacturer cybersecurity obligations. Reporting obligations apply from September 11, 2026; the main obligations apply from December 11, 2027. CRA reporting obligations
For in-scope consumer connectable products supplied in the UK, the Product Security and Telecommunications Infrastructure (PSTI) Act 2022 and its 2023 Security Requirements Regulations address passwords, security-issue reporting information, and minimum security-update periods. We assess the product and market scope before treating any requirement as applicable.
Not sure which requirements apply or where to begin? Tell us what the product does, where it will be sold, and the decision you need to make.
Where we help
- Product cybersecurity gap assessments and requirements mapping.
- Threat models, risk assessments, security architecture, and control traceability.
- SBOM and third-party software analysis, penetration testing, and security-control verification.
- Support-period planning, vulnerability handling, disclosure processes, and technical documentation.
- Custom research, engineering, training, and lifecycle support for needs outside standard engagements.
Bringing an EU or UK product to the US?
US-Bound
A transatlantic cybersecurity readiness program by The Product Security Guild
Your EU or UK cybersecurity work is a strong starting point. US regulators and customers ask different questions and expect different evidence.
US-Bound maps what transfers, identifies what is missing, and helps your team prepare clear, defensible evidence for US market entry.
Turn the next requirement into a practical plan.
Bring us the product, the evidence request, the test finding, or the lifecycle challenge. We will help define the scope and connect the work to the decisions your team needs to make.
Discuss Your ProductPlease do not submit confidential, proprietary, or security-sensitive information through the contact form. We can arrange a more appropriate channel when we respond.
