FOR DRONE AND AUTONOMOUS SYSTEM MAKERS
FuzzForge tests the autopilot, GNSS and datalink code inside your drone. With or without the source code, and no harness to write.
WHAT MAKES UAV SECURITY TESTING HARD
01
The autopilot comes as a binary.
→Testing that starts at the binary.
FuzzForge writes the fuzzing harness itself, then fuzzes, emulates and reverses it.
02
Long campaigns need the hardware you fly.
→Campaigns run on a rehosted target.
FuzzForge emulates the board, so a campaign can run for days without tying up a flight unit.
03
The Cyber Resilience Act only exempts what is certified.
→Findings you can put in a technical file.
You get a test case your engineers can rerun.
PROOF
WHAT WE TEST
FuzzForge works on the compiled code of each of these, on a rehosted target.
The autopilot
The code that flies the aircraft, and the MAVLink and telemetry messages it parses.
The GNSS and RTK stack
The RTCM3 correction messages a centimetre-accurate drone depends on.
The command and control link
The datalink that EU 2019/945 requires to be protected against unauthorised access.
The modules you bought in
Radios, cameras, gimbals and positioning boards ship as binaries from your suppliers.
WHY FUZZFORGE
For UAV security testing you have three usual options: run the scanners your developers already use, book a one-off pentest, or fuzz the binary yourself. FuzzForge does the third, at scale. It rehosts the target and writes the harness itself. Your engineers get a test case they can rerun.
FAQ
Yes. FuzzForge works on the compiled code and generates the fuzzing harness itself. You do not have to obtain the source of the autopilot, the positioning board or the radio modules you integrate.
No. FuzzForge rehosts the target and emulates it, so a campaign can run for days without a flight unit sitting on a bench.
The CRA exempts products certified under EU aviation regulation 2018/1139. A component you did not certify is not covered by that exemption. Its full requirements apply from 11 December 2027, and they include security testing, vulnerability handling and technical documentation.
SAST reads source code. On an autopilot you ship as a binary, it has nothing to read. FuzzForge starts from the compiled code, fuzzes the protocol handlers, and proves which crashes are exploitable.
A UAV security testing campaign ends with a list of findings. Each one comes with a test case your engineers can rerun on their own bench, and the coverage the campaign reached.
A real campaign, on a target close to yours. Findings your engineers can pick up and verify.
MEET US
RELATED ARTICLES
| Cookie | Duration | Description |
|---|---|---|
| cookielawinfo-checkbox-analytics | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics". |
| cookielawinfo-checkbox-functional | 11 months | The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional". |
| cookielawinfo-checkbox-necessary | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary". |
| cookielawinfo-checkbox-others | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other. |
| cookielawinfo-checkbox-performance | 11 months | This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance". |
| viewed_cookie_policy | 11 months | The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data. |
