A. Emerging technology security basics
A1What does the programme cover?
The security of systems a conventional assessment does not reach: AI and LLM applications and their governance, smart contracts, protocols, nodes and custody, OT/ICS and IoT, smart city, drone and vehicle platforms, and the cryptography all of them depend on, including post-quantum readiness. It combines threat modelling, specialist technical testing, governance review, risk rating and board-level reporting.
A2How is this different from a VAPT?
A VAPT looks for known weakness classes in web, API, network and infrastructure layers. This programme looks for failure modes specific to the technology: indirect prompt injection, reentrancy, flat OT segmentation, unsigned firmware, quantum-vulnerable cryptography. It starts with a threat model of the whole system, uses specialists in each domain and reviews governance as well as code. Codec Networks' VAPT service covers the conventional layers around the new technology when needed.
A3Do we need all of it?
Rarely. Most clients combine three to six of the twelve services in one of four engagement models: AI/LLM Risk Review, Smart Contract Audit, OT/IoT Assessment or Emerging Tech Retainer. The scoping call identifies which technologies, systems and obligations matter and sizes the engagement to them.
A4What is a threat model, and why do you start with one?
A structured description of the system's assets, actors, trust boundaries, data flows, dependencies and abuse cases, built with the client's architects. It decides what to test, what to review by inspection and what matters most, so that testing effort goes where the risk is rather than where the tools point.
A5Does an assessment guarantee the system is secure?
No. It reduces risk by finding and prioritising weaknesses on the evidence available at a point in time for the scope assessed. Codec Networks does not warrant that all vulnerabilities, contract defects, AI risks, OT/IoT risks or future cryptographic risks have been identified, and does not certify systems. Retests and the retainer exist because systems change.
A6Is this a certification?
No. Codec Networks provides assessment, readiness and advisory services; it does not issue ISO/IEC 42001 or any other certification, safety certification, legal opinion, regulatory approval or investment advice. An ISO/IEC 42001 readiness report prepares an organisation for a certification body's audit.
A7Who takes part from our side?
A sponsor, a product or engineering lead, security or IT, and legal or compliance, plus the specialists in each technology: data scientists and application engineers for AI, protocol engineers and custody owners for Web3, plant and OT engineers for OT/IoT, PKI and architecture owners for cryptography. Architecture workshops are the biggest time commitment.
A8How often should we assess?
Before launch, deployment or connection; after major changes to models, contracts, plants or fleets; and at least annually. Programmes that change continuously, which most AI and Web3 programmes do, are better served by the Emerging Tech Retainer than by an annual report.
B. AI, LLM and Web3 assessments
B1What do you test in an AI or LLM application?
The application as a system: prompts and system instructions, retrieval pipelines and vector stores, tools and plugins, APIs and data stores, authentication and tenant isolation, logging and monitoring. Tests cover direct and indirect prompt injection, data leakage, access control, misuse and excessive agency, against the OWASP Top 10 for LLM Applications 2025 and MITRE ATLAS, within rules of engagement and rate limits.
B2Do you test the model itself or our application?
Primarily the application and how it uses the model, because that is where most exploitable risk sits and what the client controls. Model-level risks such as training data provenance, vendor terms and model change control are covered in the governance review and supplier assessment.
B3What is ISO/IEC 42001 and do we need it?
ISO/IEC 42001:2023 is the international standard for an AI management system: governance, AI risk assessment and treatment, lifecycle controls and continual improvement. Whether to certify is the client's decision; many organisations use the readiness assessment to structure AI governance that customers, investors and regulators increasingly ask about, with or without certification.
B4Does the EU AI Act or Indian AI guidance apply to us?
Codec Networks does not give legal opinions. As general information: the EU AI Act (Regulation (EU) 2024/1689) applies to providers and deployers whose AI reaches EU users, with obligations phased in to 2027; in India, MeitY's AI governance guidelines (November 2025) and RBI's FREE-AI report (August 2025) set out principles for their audiences. The governance review maps the client's controls to these as general guidance; the client's counsel determines applicability.
B5What does a smart contract audit involve?
Manual and automated review of contract logic, access controls, arithmetic, reentrancy, upgradeability and initialisation; review of protocol and business logic including tokens, governance, liquidation, staking, bridges and oracles; exploitability validation on a fork or testnet; a report with code references, severity and remediation; and a retest of critical and high findings after fixes.
B6Do you audit protocols on any chain?
Codec Networks audits EVM-compatible contracts and protocols as standard and scopes other chains and languages per engagement. The scoping call confirms the chains, languages, frameworks and integrations involved before a proposal is issued.
B7How do you review wallets, keys and custody?
By reviewing custody design (hot, warm and cold tiers, multisig thresholds, HSMs), key generation, storage, rotation, backup and recovery, signing flows and approvals, exposure of keys in code and pipelines, admin and deployer key controls and operational procedures. Codec Networks never takes custody of keys or assets.
B8Can you watch our contracts and models after the audit?
Yes. Continuous monitoring support reviews smart contract changes and events, AI/LLM logs, IoT exposure or OT controls on a monthly retainer, and Codec Networks' managed SOC can watch the signals the assessment identifies.
C. OT, IoT, drones, vehicles and smart cities
C1Will testing disrupt our plant?
No. OT work follows safety constraints agreed with the client's engineers: passive discovery, configuration and architecture review, replica or offline systems and maintenance windows where active testing is needed, a plant engineer present, and no disruptive testing unless separately authorised and safely controlled. Systems that cannot be tested safely are reviewed by inspection.
C2What standards do you use for OT?
IEC 62443 (zones, conduits, security levels and programme requirements), NIST SP 800-82 Rev. 3 (September 2023) and sector guidance such as the Central Electricity Authority's cyber security guidelines (October 2021) for power, as general guidance. Findings are mapped so that the client's OT security programme and auditors can use them.
C3What is the biggest OT risk you find?
Remote access: vendor and engineer VPNs and remote tools that terminate inside the control network with shared or standing credentials, combined with segmentation that exists on the diagram but not in practice. Together they turn a third-party compromise into a plant compromise.
C4What do you test on an IoT device?
Device identity and credentials, firmware (update mechanism, signing, rollback, secrets, debug interfaces, third-party components), communication security, device APIs and the mobile and cloud back-ends behind them, tenant isolation, network placement and patchability. Hardware teardown and chip-level analysis are separately scoped.
C5Can you assess devices we are buying rather than building?
Yes. Procurement assessments review a vendor's device, firmware, cloud and documentation against the client's requirements, with the vendor's authorisation for any testing of their systems. The result feeds procurement decisions and contract requirements.
C6What does a smart city or drone review cover?
Multi-vendor architecture, data flows, sensors, APIs, dashboards, privacy and resilience dependencies for city and digital twin platforms; command and control, telemetry, authentication, cloud connectivity and fleet management for drones; vehicle network exposure, telematics, firmware, communication channels and navigation risk for vehicles. RF testing and safety certification are separately scoped.
C7Do you cover 5G?
Yes, at the level of device identity, SIM and eSIM handling, slicing assumptions, roaming and exposure, edge and cloud interfaces and the IoT fleets 5G connects. Core network and radio testing for operators is scoped separately.
C8How do findings reach our monitoring and incident process?
The assessment ends with monitoring and incident readiness recommendations: what to log, what to watch and how safety escalation fits the incident process. Codec Networks' managed SOC and incident response services can implement them, and tabletop exercises can rehearse them.
D. Post-quantum, safety, standards and regulation
D1Is post-quantum readiness urgent?
For some organisations, yes. NIST finalised post-quantum standards in August 2024 and its draft transition plan describes deprecating RSA and ECC after 2030. Data that must stay confidential beyond then can be harvested now and decrypted later, and device fleets and PKI take years to migrate. The first step, a cryptographic inventory, is urgent for anyone with long-lived data, national-interest systems or large fleets.
D2What does a post-quantum readiness assessment produce?
A cryptographic inventory and dependency map, a data-longevity analysis, a cryptographic exposure assessment, a crypto-agility score and a prioritised migration roadmap with owners, phases and vendor dependencies, mapped to NIST FIPS 203/204/205 and NIST IR 8547 as general guidance.
D3What authorisation do you need?
Written authorisation for all testing activities and third-party components, approved rules of engagement covering systems, environments, safety constraints, permitted and excluded actions and emergency contacts, and notice of safety-critical, production-critical or legally restricted systems before testing. Nothing runs without it.
D4Is anything destructive?
No. Codec Networks does not perform destructive testing, denial-of-service testing, unsafe physical actions or live fund-transfer abuse unless explicitly authorised and safely controlled. Smart contract exploits are validated on forks and testnets; OT and device work uses replica, offline or maintenance-window systems where active testing is needed.
D5Do RBI, SEBI, IRDAI or other supervisory instruments describe the expectation that this?
Codec Networks does not state what any regulator requires. As general guidance: RBI's Master Direction on IT Governance (RBI/2023-24/107, November 2023), SEBI's Cyber Security and Cyber Resilience Framework (August 2024) and IRDAI's Information and Cyber Security Guidelines (April 2023) describe technology risk governance for the entities they supervise, and the CEA guidelines (October 2021) describe cyber security expectations for the power sector. Clients should check the official text with their compliance teams.
D6How do CERT-In and DPDP apply to AI, Web3 and IoT platforms?
The CERT-In Directions of 28 April 2022 describe six-hour reporting of listed incidents and log retention for service providers, data centres and corporates; the DPDP Rules, 2025 describe safeguards, breach reporting and consent duties for personal data, which AI prompts, logs, sensors and city platforms generate. The governance review maps the client's controls to both as general information; the client and its counsel determine applicability.
D7Can the reports support ISO/IEC 27001, SOC 2 or customer audits?
Yes. Findings are mapped to ISO/IEC 27001:2022, NIST CSF 2.0, ISO/IEC 42001, IEC 62443 and customer frameworks as an add-on, and the evidence pack organises reports and summaries for auditors, enterprise buyers and insurers.
D8Is Codec Networks itself certified?
Codec Networks is CERT-In empanelled for information security auditing services, empanelled with NICSI (start-up category), and certified to ISO 9001:2015, ISO/IEC 27001:2022 and ISO/IEC 20000-1:2018.
E. Sectors, commercials and working with us
E1Which sectors do you work with?
AI start-ups and product companies; fintech and digital finance; blockchain, Web3 and DeFi platforms; manufacturing and industrial enterprises; energy, utilities and critical infrastructure; automotive and mobility; smart city and government innovation programmes; healthcare and med-tech; SaaS and cloud platforms; telecom and 5G ecosystems.
E2How is the programme priced?
On scope, finalised after discovery. Drivers are the number of AI applications and models, the number and complexity of smart contracts, OT/IoT asset count and site complexity, environment type, depth of reporting, urgency, on-site requirements and retest scope. Fixed-scope assessments are priced per engagement; the Emerging Tech Retainer is a monthly fee billed monthly or quarterly in advance. Travel, site access, safety induction, special tooling and hardware are at actuals or as agreed.
E3How long does an engagement take?
An AI/LLM Risk Review two to five weeks; a Smart Contract Audit two to six weeks including retest; an OT/IoT Assessment four to ten weeks; the Emerging Tech Retainer runs monthly. Timelines depend on scope, environment readiness, code availability, safety constraints and review cycles.
E4What do we need to provide?
Scope details, architecture diagrams, asset lists and contacts; written authorisation; safe test environments or approval for production testing; timely access to environments, repositories, contract code, documents, logs, tools and test accounts; site rules and engineer availability for OT work; and draft report review within the agreed timeline.
E5Can you work at design stage, before we build?
Yes, and it is the cheapest time to find a design flaw. Threat modelling and architecture review at design stage, with developer workshops, are available as a fixed advisory pack or on time and material, and feed the assessment once the system exists.
E6Can we start small?
Yes. Many clients begin with one Basic-level review of the system that matters most, then add governance review, retest and further systems at Medium, and move to a retainer once the programme is ongoing. The risk model and maturity score carry across, so the trend starts from the first engagement.
E7What is out of scope unless we contract it?
Legal, regulatory, financial, actuarial, cyber insurance underwriting or formal certification opinions; remediation implementation; hardware reverse engineering, chip-level analysis, RF testing, safety or lab certification; production-impacting attack simulation; third-party vendor testing without their authorisation; and ongoing monitoring or retainer advisory not included in the package.
E8How do we start?
With a 60 to 90 minute discovery discussion with business, technology and security stakeholders to agree the technology scope, environment boundaries, access model, safety constraints and reporting expectations. A proposal or custom statement of work follows, then NDA, MSA, SOW and DPA, kickoff, access readiness and rules of engagement before assessment starts.
