An attacker has physical possession of one of your devices. What should they be able to obtain, and what protects the rest of the fleet?

What is being tested

Whether you design for physical compromise as an expected event rather than an exceptional one.

What they should be able to obtain

Only that device's own credentials and its own data — and ideally not even the credentials.

With hardware-backed key storage, the private key is generated inside a secure element and never extractable. The attacker has a device that can act as itself while they hold it, and nothing more.

What must not be obtainable

• A shared fleet credential, which would be one compromise between an attacker and everything.
• Other devices' data or credentials.
• A bootstrap or enrolment credential that would let them provision new devices as legitimate.
• Server-side secrets embedded in firmware — a recurring and entirely avoidable finding.

What protects the rest of the fleet

Per-device identity, so compromising one grants exactly one.

Least privilege per device — a sensor publishes its own telemetry and nothing else. This bounds what the compromised identity can do, and it is the control that matters most.

Server-side authorisation on every action. Even an attested device is untrusted input. A design that treats an attested device as trusted is one failure away from a fleet-wide problem.

Revocation that works, plus short-lived credentials so exclusion is effective for devices that check in rarely.

Anomaly detection on device behaviour — a device sending unusual volumes, at unusual times, or to unusual endpoints.

The mechanisms that raise the cost

Secure boot, rooted in immutable hardware, so modified firmware will not run. The foundation everything else rests on.

Encrypted storage tied to the hardware, so removing the storage yields nothing.

Remote attestation, so the server can decline to serve a device running unexpected software.

Signed updates with rollback protection, so an attacker cannot force a downgrade to a version with a known vulnerability.

The principle

Never trust the device. Attestation raises the cost of compromise; it does not eliminate it. Treat device-supplied data as untrusted input and enforce authorisation server-side — which is the same zero-trust reasoning that replaced the network perimeter.