Cybersecurity
ZF Engineering Solutions provides engineering support services across the full development process. The scope includes project management, compliance-related activities, system design and analysis and software engineering, as well as testing and evaluation. These services aim to support structured and consistent project execution throughout all development stages.
In addition, ZF Engineering Solutions offers incident response–related services, including Product Security Operations Center (SOC) activities and Red Team testing. These services support the monitoring of systems, identification of security-relevant events and implementation of appropriate response measures.
Services are adapted to project-specific requirements. ZF Engineering Solutions applies a structured approach and technical expertise to support transparent and efficient project execution.
Cybersecurity Coaching & Consultancy Services
Securing modern embedded systems is more challenging than ever. It requires deep specialized know‑how, sufficient engineering capacity, and strict adherence to evolving cybersecurity standards and distribution requirements. Without the right support, organizations face increased risks, rising costs, and longer development cycles.
ZF Engineering Solutions delivers tailored Coaching and Consultancy Services designed to help teams overcome these challenges efficiently and confidently. ZF Engineering Solutions supports organizations in strengthening their cybersecurity capabilities, accelerating implementation, and maintaining compliance across the entire product lifecycle:
- Accelerates Cybersecurity Maturity: Boosts your team’s capabilities and shortens the learning curve.
- Customized Protection Strategies: Designed to shield embedded systems from vulnerabilities.
- Compliance Confidence: Ensures alignment with industry standards and regulatory requirements.
Cybersecurity Research & Prototypes
Developing and testing novel cybersecurity solutions across diverse hardware platforms, operating systems, and connected environments brings significant technical risks and requires substantial resources. Teams must validate new concepts quickly - without compromising security, performance, or compliance.
ZF Engineering Solutions accelerates your innovation journey with targeted expertise and hands‑on development support. The organization helps you explore, validate, and refine cutting‑edge cybersecurity technologies through:
- Feasibility Studies & Rapid Prototyping
Quickly evaluate technical viability and bring concepts to life in early demonstrators.
- Cybersecurity for AI Systems & AI‑Driven Defense
Protect AI‑enabled systems and leverage AI‑powered defense mechanisms to counter emerging threats.
- Cryptography
Implement modern cryptographic solutions that ensure confidentiality, integrity, and trustworthiness of embedded systems.
- Intrusion Detection & Monitoring for Connected Devices
Strengthen security with intelligent monitoring, anomaly detection, and real‑time protection mechanisms.
These capabilities help you proactively manage risks, allocate resources efficiently, and accelerate innovation from idea to implementation:
- Risk Mitigation
Identify and address potential issues early.
- Resource Optimization
Focus efforts where they matter most.
- Rapid Innovation
Move from concept to proof-of-concept faster.
Post-Quantum Cryptography on Aurix TC3xx
Post-Quantum Cryptography (PQC) is becoming increasingly important as future quantum computers are expected to break many of today’s widely used cryptographic algorithms. Products being developed today must therefore be prepared for this upcoming paradigm shift to ensure long-term security and resilience.
As post-quantum cryptography (PQC) algorithms such as ML-DSA65 and ML-KEM 1025 (security level 3) require significantly more memory than traditional algorithms (e.g., ECC‑384), there are valid concerns about whether current platforms can support PQC without negatively impacting system performance—such as slowing down or interrupting existing applications—or requiring hardware upgrades with increased memory capacity.
In this proof of concept, we successfully integrated PQC algorithms into an existing production-ready system. Through careful optimization, we were able to deploy these algorithms within the Hardware Security Module (HSM) of an Aurix™ TC3xx microcontroller without exceeding RAM limits or compromising runtime performance.
Securing Safety Critical System
HSM software stacks are typically classified as QM (Quality Managed) from a safety perspective. However, in safety-critical systems, not only functional safety but also robust cybersecurity is essential. This creates a mixed-criticality challenge: while the overall system may require ASIL D, the HSM itself does not meet this level, preventing its direct use for securing safety-relevant functionality during runtime.
To address this, we developed a tailored security concept (concept – poc – requirements – series grade implementation) in close collaboration with safety experts. By customizing known concepts (SecOC) and incorporating additional monitoring and redundancy measures from the safety domain, ZES managed to implement a secure and safe concept capable of protecting CAN communication with up to 1ms cycle times.
Following in-depth validation and formal approvals, the concept is now implemented in series production.
Cybersecurity Management
Cybersecurity development often spans multiple disciplines—software, hardware, IT infrastructure, and production environments. Aligning these interconnected domains while maintaining regulatory compliance can be demanding, time‑consuming, and requires precise coordination. Without structured oversight, organizations risk delays, gaps in security coverage, and compliance issues.
ZF Engineering Solutions delivers the expertise needed to keep cybersecurity development on track and fully compliant. The following services are included:
- Technical Coordination
- Compliance Documentation
This especially ensures:
• Streamlined Cybersecurity Interfaces: Clear coordination across disciplines.
• Reduced Development Time: Benefit from experienced decision-making.
• Regulatory Compliance: Ensure your product meets required standards.
Cybersecurity Software Engineering
Achieving effective, robust development while securely configuring microcontrollers demands deep technical expertise and a security‑first mindset. Modern embedded platforms require careful orchestration of software architecture, secure implementation practices, and protection mechanisms built directly into the system stack. Without specialized knowledge, even small misconfigurations can introduce significant vulnerabilities.
ZF Engineering Solutions empowers your development teams with end‑to‑end support, ensuring both functional excellence and embedded security:
- Software Requirements & Architecture
Clear, security‑aware requirements and architecture definitions that set the foundation for reliable and maintainable embedded systems.
- Implementation Services
Hands‑on development, secure configuration, and optimization of microcontroller‑based software tailored to your platform and use case.
- Standalone Security Components
Modular, reusable cybersecurity building blocks that integrate seamlessly into your system—enhancing protection without disrupting workflows.
Benefit from our experience:
- Cybersecurity-Minded Engineers: Faster threat detection, strategic foresight, and stronger system resilience.
- Proven Expertise: Real-world problem-solving across embedded platforms.
- Integrated Security: Security built into every layer of your software stack.
Cybersecurity Testing and Evaluation Services
Even the strongest cybersecurity concepts can fall short if they are not objectively evaluated. Ensuring robust protection requires more than effective development—it demands independent testing to uncover hidden vulnerabilities before products reach the field. Without systematic validation, security gaps may go unnoticed until they are exploited, leading to costly fixes, compliance risks, and potential damage to brand reputation.
ZF Engineering Solutions delivers comprehensive evaluation services to verify the security and resilience of your systems:
- Code Review
Detailed, methodical inspection of source code to identify weaknesses, unsafe coding practices, and hidden vulnerabilities.
- Functional Testing
Verification that cybersecurity measures work as intended and interact correctly with system functions and interfaces.
- Penetration & Fuzz Testing
Realistic attack simulations and automated input fuzzing to expose exploitable vulnerabilities before attackers do.
Integrate cybersecurity from the early development stages and leverage independent testing for reliable validation:
- Efficient Development: Early identification of security issues reduces cost and time of post-development fixes.
- Real-World Threat Simulation: Pen & fuzz testing reveals exploitable vulnerabilities before attackers do.
- Stronger Defenses: Helps organizations proactively reinforce their systems against evolving threats.
Incident Response, SOC & Red Team
Organizations today face growing pressure to respond rapidly to emerging threats while simultaneously maintaining strict compliance with industry regulations. Beyond day‑to‑day security operations, long‑term product support demands secure storage, effective knowledge retention, and reliable license management. Without the right structures and expertise in place, these challenges can put intellectual property, system availability, and business continuity at risk.
ZF Engineering Solutions delivers comprehensive operational cybersecurity services that protect your organization across both short‑term incidents and long‑term lifecycle needs:
- Monitoring Services
Continuous surveillance of system behavior, security events, and anomalies to ensure early threat detection. - Incident Management
Structured response workflows that minimize impact, reduce recovery time, and safeguard critical assets. - Long‑Term Preservation
Secure data retention, documentation management, and lifecycle support to maintain compliance and operational readiness over time. - Red Team Testing
Realistic adversarial exercises to validate the effectiveness of your defenses and uncover hidden vulnerabilities.
Protect your product during the entire lifecycle and be prepared for the worst:
- Continuous Protection: Minimizes impact on intellectual property, customers, and brand reputation.
- High Availability: Ensures systems remain secure and operational.
- Business Continuity: Supports long-term resilience and regulatory alignment.
Tooling & Automation
Cybersecurity has become a core requirement in embedded product development. Rising threat levels and strict regulations—including the EU Cyber Resilience Act (CRA) and ISO/SAE 21434—demand stronger protection, full lifecycle transparency, and continuous monitoring.
Automated fuzzing is now essential to uncover vulnerabilities early, while diagnostic tools safeguard system integrity throughout operation. At the same time, generating a complete SBOM is no longer optional—it is required to ensure vulnerability tracking, supply‑chain visibility, and regulatory compliance.
Together, these technologies form the backbone of a secure‑by‑design development pipeline that protects products, users, and brand reputation.
