By Ramon Barakat, Fraunhofer FOKUS
As the Internet of Things continues to expand into nearly every sector—from smart homes and energy systems to automotive and industrial environments — security cannot be disregarded any longer. These systems are no longer isolated, they are complex ecosystems built from countless interconnected components, often sourced from different vendors across global supply chains. In such an environment, a single vulnerable component can compromise an entire system. This is precisely the challenge that the DOSS project seeks to address.
DOSS introduces a new way of thinking about IoT security. Instead of treating security as an afterthought, it embeds it throughout the lifecycle of a system, beginning at the component level. At the center of this approach is the Component Tester (CT), a platform designed to realize the unified component security testing methodology by assessing the security of individual software and firmware elements before they are integrated into larger systems. The CT is performing automated security testing for the single components of an IoT device, including 3rd party, open-source software and self‑development.
The Importance of Component-Level Security
Traditional approaches often focus on securing the system as a whole, but vulnerabilities tend to originate much earlier, within the building components themselves. Each component—whether open-source, third-party, or developed in-house—represents a potential entry point for attackers.
Systematically analysing these elements before integration significantly reduces the risk of propagating vulnerabilities across the system. This proactive approach helps to create a more resilient and trustworthy IoT ecosystem. The Component Tester enables developers and organisations to target these components directly and detect vulnerabilities early in the development phase, when they are easier and less costly to fix.
Integrated Testing Techniques
Rather than being a single tool – as illustrated in Figure 1 – the Component Tester is an integrated environment that brings together multiple security analysis techniques into a unified workflow. It combines static analysis, dynamic testing, interactive security testing as well as the validation of security patches into a single platform. What makes this particularly effective is not just the breadth of techniques, but how they are orchestrated to complement one another.
Figure 1: The overview of the DOSS Component Tester
Under the hood, the system is built on a modern microservice architecture. Each type of analysis runs as an independent service, typically inside its own container, while a central orchestrator coordinates their execution. This design makes the platform both flexible and scalable, allowing it to adapt to different use cases and integrate seamlessly into existing development pipelines. When a user submits a request—such as a link to a source code repository or a firmware image—the system automatically routes it through the appropriate analyses and aggregates the results into a structured report.
One of the first layers of analysis focuses on the source code itself. Static analysis tools examine the code without executing it, identifying potential issues such as memory leaks, unsafe function calls, or improper input handling. Although static analysis is powerful, it often produces large volumes of alerts, not all of which are equally important. Furthermore, not all of these alerts represent real vulnerabilities (false positives). To address this, the Component Tester enhances its static analysis with an AI-driven vulnerability prediction model. This model helps prioritize findings by estimating which parts of the code are most likely to contain real vulnerabilities, allowing developers to focus their efforts where it matters most.
The Component Tester also evaluates how software behaves at runtime. Through dynamic testing techniques such as fuzzing, it subjects applications to unexpected or malformed inputs in order to trigger failures and uncover hidden vulnerabilities. This approach is particularly effective at revealing issues that depend on runtime conditions—problems that static analysis alone might never detect.
In order to reduce the number of false alarms, interactive testing is used. This testing method combines insights from both static and dynamic methods. When static analysis identifies a potential vulnerability, interactive testing attempts to confirm it by generating targeted test cases. This not only reduces false positives but also provides concrete evidence of exploitability, making it easier for developers to understand and fix the problem.
Security, however, does not end with identifying vulnerabilities. Fixing them introduces a new challenge: ensuring that the fix is complete. The Component Tester addresses this through patch validation, a process that actively tests whether a security patch fully resolves the underlying issue. By attempting to reproduce the vulnerability even after the patch has been applied, the system can detect incomplete fixes and highlight areas that require further attention.
Another critical dimension of IoT security lies in firmware, which often operates at a lower level and is harder to analyze using conventional tools. The Component Tester includes dedicated capabilities for firmware fuzzing, allowing entire embedded systems to be tested in emulated environments. This approach makes it possible to uncover vulnerabilities in complex, hardware-dependent software that would otherwise remain hidden.
Structured Results and Traceability
A key strength of the Component Tester lies in how it handles and presents its findings. Rather than producing isolated outputs, the system aggregates results from all analysis techniques into structured, machine-readable reports, typically in JSON format. These reports include not only detected vulnerabilities but also contextual information such as severity levels, affected components, CWE number and execution metadata.
This structured approach enables seamless integration with development pipelines, dashboards, and other analysis tools. It also supports traceability, allowing stakeholders to track vulnerabilities back to specific components, code locations, or versions. This level of transparency is essential for effective vulnerability management and for maintaining accountability across the development process.
Integration and Continuous Assurance
What truly sets the DOSS approach apart is how these capabilities are integrated into a broader supply chain framework. The Component Tester does not operate in isolation; it feeds its findings into the Device Security Passport, a digital record that captures security information about each component. This information becomes part of a larger Supply Trust Chain, enabling continuous monitoring, traceability, and collaboration across all stakeholders involved in the lifecycle of an IoT product.
This integration transforms security from a one-time assessment into an ongoing process. Manufacturers, developers, and operators can all access up-to-date security insights, ensuring that vulnerabilities are identified, tracked, and addressed as systems evolve. In doing so, the Component Tester supports a shift toward a truly secure-by-design philosophy, where security is embedded into every stage of development rather than bolted on at the end.
You can find out more about the Compoten Tester in the DOSS Deliverable D3.2.
