Most businesses have made real progress on endpoint security over the past few years. Antivirus is running. Endpoint detection and response (EDR) tools are deployed. Patching schedules exist. Employees are trained — at least annually — not to click suspicious links. It's not perfect, but it's a reasonable foundation.
And yet, a growing class of cyberattacks is designed to make all of that irrelevant.
Firmware and BIOS-level attacks operate beneath the operating system — in a layer of your hardware that most security tools never inspect, most IT teams rarely touch, and most businesses don't even know is vulnerable. When attackers establish a foothold at the firmware level, they can survive OS reinstalls, evade EDR tools, persist through hard drive replacements, and quietly maintain access to a compromised machine for months or years.
This isn't a theoretical threat. It's active, it's growing, and it's hitting businesses of every size.
What Is Firmware — and Why Does It Matter for Security?
Before we get into the attacks, it helps to understand what firmware actually is.
Every device in your environment — laptops, desktops, servers, routers, printers, cameras, even smart UPS units — contains firmware. Firmware is the low-level software embedded in hardware that initializes the device before the operating system loads. The most well-known example is the BIOS (Basic Input/Output System) or its modern successor, UEFI (Unified Extensible Firmware Interface), which runs on every PC and server.
Firmware sits below the OS, below your security software, and below virtually every monitoring tool in your stack. It's the first code that runs when a device powers on, and it controls the most fundamental operations of the hardware.
Because firmware runs before the OS — and therefore before your security tools — attackers who can write malicious code to this layer have an extraordinary advantage. They gain persistence that survives reimaging. They can disable security features at the hardware level. And they often go completely undetected, sometimes for years.
The Rise of Firmware Attacks: What the Data Says
For a long time, firmware attacks were considered the domain of nation-state actors with deep technical resources. That's no longer the case.
- A 2025 Microsoft Security Signals report found that 83% of organizations had experienced a firmware attack in the previous two years — yet fewer than 30% had meaningful protections in place.
- The National Institute of Standards and Technology (NIST) has formally classified firmware vulnerabilities as a top-tier risk in its updated frameworks, acknowledging that most enterprise security architectures have a significant blind spot at this layer.
- Security researchers have documented firmware implants deployed by criminal ransomware groups — not just intelligence agencies — demonstrating that this capability has become commoditized.
- In 2024 and 2025, several high-profile breaches were traced back to UEFI bootkit malware — malicious code embedded in the boot process that loaded before any security software could activate.
The cost implications are severe. Devices infected at the firmware level often need to be physically replaced rather than remediated. When you're talking about hundreds or thousands of endpoints across a distributed organization, that's a significant operational and financial event.
How Firmware Attacks Work
Understanding the mechanics of these attacks helps you make better decisions about defense. Here are the most common attack paths:
UEFI Bootkits
A bootkit is malware that infects the boot process itself. Modern bootkits target UEFI, embedding malicious code that executes before the operating system loads. Because the OS hasn't started yet, security software — including EDR tools and antivirus — can't see or stop the bootkit. Once loaded, the bootkit can manipulate the OS environment, disable security features, and maintain persistent access.
Notable examples include BlackLotus, a UEFI bootkit that appeared in the wild in 2022 and continued to evolve through 2025. BlackLotus can bypass Secure Boot on Windows 11 systems and has been observed in both targeted attacks and broader criminal operations.
Malicious Firmware Updates
Attackers who gain initial access to an endpoint or server — through phishing, credential theft, or a software vulnerability — can use that access to push a malicious firmware update. If the device or its management software doesn't validate the integrity of firmware updates cryptographically, the attacker can replace legitimate firmware with a trojaned version that persists even after the initial malware is cleaned up.
This is particularly dangerous in environments where IT teams use remote management tools to push firmware updates across fleets of devices — those same tools can be weaponized to distribute malicious firmware at scale.
Supply Chain Implants
Perhaps the most alarming vector: firmware can be compromised before a device ever arrives at your business. Supply chain attacks targeting hardware manufacturers or the distribution chain can result in devices that come pre-loaded with malicious firmware out of the box. While these attacks are rare and typically attributed to sophisticated threat actors, they have occurred — and the risk increases as hardware supply chains grow more complex.
BMC Vulnerabilities
Servers often include a Baseboard Management Controller (BMC) — a separate processor that allows remote management even when the main server is powered off. BMCs run their own firmware, and vulnerabilities in BMC firmware have been exploited to gain persistent, out-of-band access to servers. This is especially relevant for businesses running on-premises infrastructure or private cloud environments.
Why Traditional Endpoint Security Doesn't Catch This
The vast majority of endpoint security tools — including many modern EDR platforms — operate at the OS level or higher. They monitor processes, file system changes, network connections, and memory. This is genuinely valuable and catches an enormous range of threats.
But firmware-level malware doesn't play by those rules. By the time the OS loads and your security software starts running, a UEFI bootkit has already executed, established its hooks, and hidden itself. The EDR looks at the environment the bootkit has already shaped — and sees nothing unusual.
Similarly, most vulnerability scanners don't audit firmware versions or check for known firmware CVEs across a fleet of endpoints. Patch management tools that do an excellent job keeping Windows and applications up to date often have no visibility into whether device firmware is current or has been tampered with.
This isn't a failure of those tools — it's a recognition that the threat landscape has expanded into a layer that requires dedicated attention.
Industries at Elevated Risk
While firmware attacks can hit any organization, certain industries face heightened risk:
Financial Services — High-value targets with large fleets of endpoints, often including ATMs and point-of-sale systems with legacy firmware.
Healthcare — Medical devices frequently run firmware that is rarely updated and difficult to patch, creating persistent vulnerabilities across clinical environments.
Manufacturing — OT/IT convergence has introduced firmware vulnerabilities across industrial control systems and connected machinery.
Government and Defense — Nation-state actors with the most sophisticated firmware attack capabilities are most motivated to target government contractors and agencies.
Professional Services and Legal — Law firms and consulting companies are attractive targets due to the sensitive client data they hold, and often have fewer defenses than their clients.
Building a Firmware Security Strategy: Practical Steps
Firmware security doesn't require starting over — it requires adding intentional layers to your existing endpoint management strategy. Here's where to begin:
1. Take Inventory of Your Firmware Attack Surface
You can't protect what you don't know you have. Start with a complete inventory of every endpoint, server, network device, and peripheral in your environment — including the make, model, and current firmware version of each. This is often the hardest step because firmware versions are not always visible in standard asset management tools.
At Layer27, our Infrastructure Pro and Co-Managed IT clients benefit from deep asset visibility that goes beyond software inventory to include hardware-level details — including firmware versions that can be checked against known vulnerability databases.
2. Enable and Enforce Secure Boot
Secure Boot is a UEFI feature that verifies the cryptographic signature of boot software before execution, preventing unsigned or tampered code from loading. It's available on virtually all modern hardware but is not always enabled by default.
Enabling Secure Boot across your fleet is one of the most impactful controls you can implement. It directly mitigates many bootkit attacks by requiring all boot-time code to be cryptographically signed by a trusted authority.
This should be part of your baseline endpoint configuration policy — enforced through your endpoint management platform.
3. Establish a Firmware Patch Management Program
Firmware updates are released regularly by hardware manufacturers to address known vulnerabilities — but most businesses have no formal process for tracking or applying them. Treat firmware patching with the same urgency as OS and application patching.
This means:
- Subscribing to security advisories from your major hardware vendors (Dell, HP, Lenovo, Microsoft Surface, etc.)
- Including firmware version checks in your vulnerability assessment process
- Testing firmware updates in a controlled environment before broad deployment
- Documenting firmware versions as part of your change management process
4. Use Microsoft Pluton and Hardware-Based Security Where Available
Microsoft's Pluton security processor, now available in a growing range of Windows PCs, integrates security directly into the CPU and protects credentials, firmware, and encryption keys from attacks that operate below the OS. Combined with Trusted Platform Module (TPM 2.0) chips — now required for Windows 11 — hardware-based security creates measurable resistance to firmware-level attacks.
When refreshing hardware, prioritize devices with these built-in security features. This is especially important for remote workers and executives whose devices are most likely to be physically targeted or operated in untrusted environments.
5. Implement Privileged Access Controls Around Firmware Management
Firmware update capabilities should be tightly controlled. Require strong authentication — ideally MFA — to access firmware management interfaces, remote management tools, and BIOS/UEFI settings. Lock down BIOS configurations with strong passwords and ensure those passwords are managed in your privileged access system.
For server environments, BMC access should be restricted to a dedicated out-of-band management network that is isolated from your standard corporate traffic.
6. Monitor for Anomalous Boot Behavior
While EDR tools can't inspect firmware directly, some advanced tools can detect anomalies in boot sequences, unexpected changes in measured boot data (using TPM), or processes that attempt to write to firmware storage. Look for endpoint management platforms that include firmware attack surface reduction capabilities — an area where Microsoft Defender for Endpoint, CrowdStrike, and SentinelOne have all been expanding their capabilities.
Layer27's Protect Pro service includes advanced endpoint protection configurations that incorporate these firmware-aware security controls — ensuring that devices are hardened at every layer we can reach.
7. Extend Monitoring to Your 24x7 SOC
Even the best firmware security controls can fail. When they do, rapid detection is the difference between a contained incident and a catastrophic breach. Ensuring that your security operations center (SOC) is looking for indicators of firmware compromise — including unexpected behavior from recently reimaged machines, unusual boot-time events, and suspicious BMC activity — closes the detection gap.
Layer27's Managed Detection & Response (MDR) and 24x7 SOC services extend visibility into these lower-level threat indicators, correlating signals across your environment that individual tools might miss. When a machine that was just reimaged starts behaving identically to the compromised machine it replaced, that's a signal a human analyst needs to investigate.
8. Build Recovery Scenarios Into Your Business Continuity Plan
If a firmware attack is discovered, recovery is not as simple as restoring from backup. In many cases, affected hardware needs to be reflashed or physically replaced. Your incident response plan — and your recovery capabilities — need to account for this.
Backup-as-a-Service (BaaS) and Disaster Recovery-as-a-Service (DRaaS) are essential safety nets, but they need to be paired with clear playbooks for hardware-level incidents. Know in advance: if three laptops and a server are compromised at the firmware level, what's the process? Who authorizes replacement hardware? How quickly can you restore business operations on new devices?
These are questions worth answering before you need them.
The Human Factor: Don't Ignore Security Awareness
Firmware attacks don't happen in a vacuum. In most cases, attackers need some form of initial access before they can attempt to write to firmware. That access often starts with a phishing email, a credential theft, or a social engineering attack.
Security Awareness Training remains one of the most effective controls in your defense-in-depth strategy. Employees who recognize phishing attempts, protect their credentials, and report suspicious behavior are actively reducing the probability that attackers ever get close enough to attempt a firmware compromise.
Layer27's Security Awareness Training programs keep employees current on evolving threat tactics — including the kind of initial-access techniques that precede advanced attacks like firmware implants.
The Bottom Line: Your Security Stack Has a Floor — and It's Not the OS
For years, businesses have been told that keeping the OS patched and the antivirus updated is the foundation of endpoint security. That's still true — but it's no longer sufficient. The foundation has a sub-basement, and attackers have found the stairs.
Firmware security is no longer a niche concern for government agencies and critical infrastructure operators. It's a genuine and growing risk for businesses of every size, in every industry. The good news is that the controls are available, practical, and deployable — they just require intentional focus and a more complete view of what "endpoint management" actually means.
The businesses that get ahead of this threat in 2026 will be the ones that recognize that endpoint security extends all the way down to the hardware — and build their strategy accordingly.
Ready to Close the Gaps in Your Endpoint Security?
If you're not sure whether your current endpoint strategy addresses firmware-level threats, you're not alone — and this is exactly the kind of question Layer27 helps businesses answer.
Our team can assess your current endpoint posture, identify gaps at the firmware and hardware level, and build a practical remediation plan that fits your environment and your budget. Whether you need a full managed security partnership or support layered on top of your existing IT team, we have options that scale with your business.
Contact Layer27 today to schedule a conversation with one of our endpoint security specialists. No pressure, no sales pitch — just a clear-eyed look at where you stand and what you can do about it.