The easiest way to break into a vault is rarely brute force — it is finding the person with the key and following them home.
In cybersecurity, this is the essence of a supply-chain attack. For many mid-sized companies, the “vault” isn’t their own data — it’s the environments they are allowed into. If your product sits inside a multinational bank or a government agency, a weakness in your device may be one of the most efficient ways in.
Let’s look at ACME Inc., a fictional company that builds a fictional product: the ACME gadget. Not a tech giant, no brand recognition — nobody has heard their name.
Within ACME Inc., cybersecurity barely registers. It has no footing in any procedure, development, or otherwise. Nobody knows what threat modeling is.
Around the water cooler, security means:
- Everyone has to use an authenticator app for Microsoft Office.
- The password must be changed once a year.
- Both are mildly annoying, but tolerable.
But in the ACME gadget? Irrelevant: “Nobody knows us. No one would attack us.”
That mindset is a legacy of a 15-year history, going back to the first ACME gadget. Back then, a feature was considered good if it didn’t crash within a week. Security meant “reasonable protections” that never interfered with usability. There were no trusted execution environments, no TPMs. Secrets were embedded or obfuscated into binaries, and passwords were hashed with MD5.
The thinking was pragmatic, and reasonable for the time: nobody would bother reverse engineering compiled firmware. That takes effort.
Effort implies motivation.
Who would attack them?
15 Years Later
What used to be “good enough” security is now trivially bypassed. Techniques that once required specialized expertise are widely available, automated, and cheap.
Firmware reverse engineering is no longer a niche capability - it is a commodity.
The cost of finding vulnerabilities has dropped dramatically — not because systems became simpler, but because attackers became more efficient. Tooling improved. Knowledge spread. Increasingly, parts of the work can be automated by AI.
The assumption that “this would take too much effort” stopped being true.
ACME Inc. did not notice.
Ask The Wrong Question
Now imagine engineering discovers a weakness. One from the old days — a hard-coded key buried somewhere. Nothing sophisticated. Just the kind of issue that becomes critical the moment someone outside the company discovers it.
Assessing severity quickly runs into a problem:
There is no baseline.
No threat model. No attacker profiles. No shared assumptions. No language to discuss likelihood or impact.
Would anyone invest the effort to reverse engineer the ACME gadget? Disassemble the firmware byte by byte?
Why would they?
For the first time, the question is asked seriously:
Who would attack us?
An Inconvenient Truth
So, engineering asks sales a simple question:
“Who are our most security-sensitive customers?”
The ACME gadget is everywhere.
From small companies no one has heard of to organizations everyone has. Multinational corporations. Critical infrastructure. Institutions that make headlines.
Some customers are valuable targets. Some are high-risk environments. Some cannot afford to fail publicly.
ACME Inc. is not interesting. Its customers are.
Becoming Part of Someone Else’s Threat Model
That is the moment it clicks: ACME isn’t the target — it is the easiest way in.
By placing devices inside high-value environments, ACME becomes part of those environments’ threat models. The relevant question is no longer:
“Who would attack us?”
It becomes:
“Who would attack them — and how much easier are we making it?”
At that point, old assumptions collapse quickly.
“Security by obscurity” stops being a questionable strategy and becomes an obvious liability. It is no longer a question of whether someone can reverse engineer the firmware — it is safer to assume someone already has.
And if the embedded key enables full device compromise, the impact is no longer limited to ACME.
It propagates downstream.
The Cost of Being the Weakest Link
A supply-chain attack does not stop at the supplier.
If ACME gadgets are compromised, attackers gain a foothold inside customer environments as a trusted or internal system. From there, the cost escalates rapidly:
- Operational disruption: devices fail, systems degrade, services go offline unexpectedly
- Incident response costs: emergency investigations, containment, recovery
- Contractual liability: breach of security requirements, penalties, lawsuits
- Regulatory exposure: fines and mandatory disclosure obligations
- Reputational damage: loss of trust from customers who assumed due diligence
- Cascading impact: downstream systems may be affected in turn
The crucial detail: most of these costs do not scale with the size of ACME Inc. — they scale with the value of the environments it touches.
A small supplier can trigger consequences measured in millions.
The Real Problem Isn’t Technical
Fixing a single bug does not fix the problem.
The real issue is the mindset that allowed it to exist unnoticed, and unprioritized.
A company that treats security as friction will produce systems that fail under adversarial pressure. And when those systems are embedded in high-value environments, failure is not isolated.
Security Does Not Start With Code
The conclusion is not technical, but organizational.
Security begins with answering one uncomfortable question:
“What are we responsible for?”
If the honest answer includes “systems inside other people’s critical environments,” then the threat model changes — whether the company acknowledges it or not.
And once that is understood, the follow-up question must be:
“What would it cost if we were the easiest way in?”
That cost will be real.