Questions? contactus@blockharbor.io
Product security engineering
Product security engineering, done with your team
Pen tests that leave you regression tests, engineers in your design reviews, and EU CRA monitoring for machinery and robot makers.
Ask an engineerWe reply by email.
One OEM engagement grew into seven service lines, at under 10% of a competitor's bid
On-site or through a bench in your lab
Inside your Jira and DOORS
Three ways we work with your team
Penetration testing
Your pen test covered one firmware release.
We test the device the way an attacker would, on-site or through a bench that stays in your lab. Then we turn findings into test cases you re-run on every release and compare run to run.
Read: Your ECU pen test expires at the next release →Embedded engineers
A security engineer on your supplier call.
Our engineers take tasks, sit in your design reviews and supplier calls, and work inside your Jira and DOORS, for the hours each month the work needs.
EU Cyber Resilience Act
CRA vulnerability reporting started September 11.
Reporting an actively exploited flaw within 24 hours starts with seeing it in the fleet. Connected machinery, robots and their components fall under the EU CRA unless built solely for EU type-approved cars, vans, trucks, buses, trailers or motorcycles. We built CRA-driven fleet monitoring for an equipment maker, now run by a two-person team, plus the disclosure program behind it.
Read: CRA reporting starts September 11, 2026 →What happens next
- 1Send the form with what's on your plate.
- 2We reply by email with questions about your product.
- 3We scope the work with your team.
Do you work in our tools?
Yes. Our engineers work inside your existing tools, including Jira and DOORS.
How small can the work be?
We staff the hours each month the work needs.
Ask an engineer
Tell us which of these looks like your week.