Choosing a firmware security platform: questions to ask first

In short

• Judge a firmware security platform by what it can prove on your own images, not by feature names.
• Ask where your firmware goes, what the tool does with parts it cannot read, which SBOM and VEX formats it exports and which of your markets' rules it covers.
• On their own pages, ONEKEY lists more firmware formats, covers UK and car rules and holds ISO/IEC 27001. FDIE by Magdox covers India's rules, exports VEX in three formats and publishes measured rates.

Buy on evidence, not feature names

Buy on evidence you can check, not on feature names. Every platform in this market unpacks firmware, lists components and matches them to known vulnerabilities. So the differences sit in the details:

• which formats and processors were measured on real images
• what happens to the parts a tool could not read
• which SBOM and VEX formats come out: the list of components, and the statement of which flaws affect you
• which markets' rules it maps to
• where your firmware goes

Below is the checklist we would use if we were buying. After it comes a side by side of our product and ONEKEY, a well-known platform in this market. Every ONEKEY statement comes from ONEKEY's own website or documentation as we read it on 20 October 2026, linked in the sources. Products change, so check the live pages before you decide.

Twelve questions for any vendor

1. Where is my firmware processed and stored, and under which country's law?
2. Which file systems and containers have you measured on real vendor images, not only on test samples?
3. Which instruction sets do you disassemble, and how did you measure it?
4. What happens to a part of the image you cannot read or decrypt? Is it named as a gap, or does the check pass?
5. How accurate is your SBOM, measured against what? A package manifest is a good yardstick.
6. Can I import my suppliers' SBOMs?
7. Which SBOM and VEX formats and versions do you export?
8. Which of my markets' frameworks do you map evidence to, and which requirements still need my documents?
9. Do you compare each release with the previous one, and can I export that comparison?
10. Do you run the firmware, and if you quote a success rate, on how many images and by what definition?
11. What does AI see of my firmware, whose model is it, and can I turn it off?
12. Which security certifications does your own company hold?

Question 4 matters more than it looks. A tool that silently skips what it cannot read produces a clean report on the riskiest image you own.

FDIE by Magdox and ONEKEY, side by side

ONEKEY's column uses only what its pages state. "Not stated" means we did not find it on the pages we read, not that the product lacks it.

Both import a supplier's SBOM. ONEKEY accepts more CycloneDX versions, and FDIE also reads SPDX.

Where ONEKEY is stronger

On its own pages, ONEKEY publishes a longer list of supported firmware formats than we do, and exports more CycloneDX versions. It maps to UK PSTI, the UK's product security law, and to UN R155, the UN rule on vehicle cyber security. It also holds an ISO/IEC 27001 certificate for its own security management.

ONEKEY offers consulting, penetration testing and readiness assessments for the EU's CRA and Radio Equipment Directive (RED) as well. If your products ship mainly to the UK or to carmakers, or you want one company to run the tests too, those count.

Where FDIE by Magdox is ahead, and the evidence

We are ahead where an Indian maker needs it most. FDIE maps evidence to MeitY ER-01, the CCTV security test, to both NCCS ITSAR documents for routers and Wi-Fi equipment, and to TEC 31318. It exports VEX in CycloneDX, OpenVEX and CSAF 2.0, which matters when a customer's tools read only one of them.

We also publish our measurements with their test sets. On programs stripped of their symbol names and built for eight instruction set variants, we found 98.5% of function starts at 99.1% precision. That is level with or ahead of Ghidra 12.1.4 and Rizin 0.9.1, two well-known analysis tools, on every metric except string references on RISC-V.

In our lab, 51 of 87 real firmware images (58.6%) ran in an emulator, which imitates the device's hardware. A network service answered after a full boot in 13 of 87 (14.9%). These are our numbers on our sets, and we have no measurement of ONEKEY's product and claim none.

Open source, if you want to run it yourself

EMBA and FACT (Fraunhofer FKIE's Firmware Analysis and Comparison Tool) are free under the GPL-3.0 licence and run on your own machines. STQC, the testing body under India's IT ministry, names FACT in its CCTV test procedure. It is given as an example of an automated tool a lab may run on the firmware to check the maker's SBOM. If your team has the time to operate them, they are worth a trial alongside any commercial platform.

How to decide

Shortlist two vendors, and give each the same three images of your own: one easy, one old, one encrypted or unusual. Compare the outputs against the twelve questions. The vendor whose report admits what it could not read is usually the one you can defend to a lab.