Midnight Blue

What Midnight Blue does

Midnight Blue is a boutique security consultancy firm headquartered in Enschede, Netherlands, founded in 2017, that specializes in embedded systems security for cyber-physical systems, communications equipment, industrial control systems, and automotive/IoT domains. The firm operates three core service lines: Systems & Vulnerability Research (threat modeling, vulnerability discovery, and full-stack reverse engineering), Capability Development (red team operations, tailored R&D, bespoke training, and specialized forensics), and Defensive Design (architecture and design reviews plus SDLC consultancy). It serves critical infrastructure operators, government agencies including law enforcement and intelligence services, technology companies manufacturing embedded and communications devices, automotive suppliers, and security services providers across EMEA with a claimed global footprint.

The firm's underlying technical capabilities rest on deep reverse-engineering expertise spanning PCB analysis, chip-off, bus sniffing, firmware and protocol analysis, alongside proprietary tooling such as "Where's Crypto?," which combines Data Flow Graph isomorphism with symbolic execution to automate identification of cryptographic primitives in binary code. Notable public research outputs include the TETRA:BURST (2023) and 2TETRA:2BURST (2025) vulnerability disclosures affecting the TETRA radio standard used across 100+ countries, with associated CVE assignments and Black Hat USA presentations. The firm has been an SME for the MITRE ATT&CK for ICS framework and operates a coordinated vulnerability disclosure process with the Dutch National Cyber-Security Centre.

Midnight Blue runs a quote-based, sales-led engagement model with structured intake, pre-study, plan of approach, and execution methodology. Commercial revenue derives from bespoke professional services engagements; non-dilutive research funding has been received from the NLnet Foundation via the European Commission's NGI0 Entrust fund for specific projects such as TETRA End-to-End Encryption analysis. The firm markets primarily through thought leadership at top-tier security conferences (Black Hat, DEF CON, USENIX, Chaos Communication Congress) and high-impact public vulnerability disclosures, with a stated headcount of 1-10 employees organized around three founding partners.

Name

Midnight Blue

Legal name

Midnight Blue

Website

https://midnightblue.nl

Company type

Private

Founded year

2017

Operating status

Operating

Headcount range

1–10 employees

Short description

Midnight Blue is a Netherlands-based boutique security consultancy specializing in embedded systems security for cyber-physical systems, communications equipment, and critical infrastructure, serving government agencies and Fortune 500 firms via bespoke vulnerability research, reverse engineering, and defensive design engagements.

Ownership category

akta.pro rank

Product category

Cybersecurity Consulting Services

NAICS

Other Computer Related Services (541519)

SIC

Services-Engineering, Accounting, Research, Management (8700)

akta.pro primary industry

Governance, Risk & Compliance (GRC) Managed Services (BPAEADAJ)

akta.pro secondary industry

IT Governance, Risk & Compliance (IT GRC) Platforms (HDAEALAK)

Keywords

• Embedded systems security
• Vulnerability research
• Security consultancy
• Reverse engineering services
• Cyber physical systems security

Headquarters

HQ city

Enschede

HQ country

Netherlands

HQ region

Europe

Offices1 record

Markets served

GTM type

B2B

Offering type

Services

Cost components

Personnel, Technology or R&D, Operations, Marketing or Sales

Revenue model

1. Security Consultancy Services: Boutique consultancy providing specialized security research and assessment services including vulnerability research, threat modeling, red team operations, training, and defensive design. Services tailored to client needs with intake, pre-study, plan of approach, execution, and conclusion phases.

Go-to-market motion1 record

Distribution channels1 record

Marketing channels3 records

Core offering

Midnight Blue is a boutique security consultancy delivering high-end security research and advisory services focused on embedded systems, cyber-physical systems, and communications/security equipment. The firm offers three core service lines—Systems & Vulnerability Research (threat modeling, vulnerability discovery, reverse engineering), Capability Development (red team operations, tailored R&D, training, specialized forensics), and Defensive Design (architecture reviews, SDLC consultancy)—to clients ranging from Fortune 500 firms to government agencies.

Product overview

Midnight Blue is a boutique security consultancy offering three core service lines: Systems & Vulnerability Research (threat modeling, vulnerability discovery, reverse engineering), Capability Development (red team operations, tailored R&D, training, specialized forensics), and Defensive Design (architecture reviews, SDLC consultancy). The company also conducts significant public security research including the TETRA:BURST and 2TETRA:2BURST vulnerability disclosures affecting TETRA radio communications. Training offerings include OT Device Security and Red Team SIGINT courses. The firm focuses on embedded systems, cyber-physical systems, communications, and security equipment across critical infrastructure, automotive, telecommunications, and finance sectors.

Differentiator

Problem solved

Functional benefit

Products and services

• Systems & Vulnerability Research Security assessment service enabling manufacturers and end users to understand complex embedded and cyber-physical systems and identify vulnerabilities, covering threat modeling, vulnerability discovery (white and black box), and full-stack reverse engineering from PCB analysis to firmware and protocol analysis.
• Capability Development Service to help organizations build in-house offensive security capabilities, including adversary simulation and red team operations, tailored R&D for proprietary tools (decompilers, fuzzers, protocol dissectors), bespoke trainings, and specialized forensics (BitLocker/TPM, self-encrypting drives, PLC/ECU data recovery).
• Defensive Design Security architecture and design service that helps re-architect legacy products for secure and future-proof operations, covering architecture and design reviews (secure bootloaders, trusted components, cryptographic architectures) and SDLC consultancy (gap analyses, threat modeling, counter-measure design, security automation).
• OT Device Security Training Hands-on adversary tactics training course for threat modeling and hardening of OT devices, covering RTUs, PLCs, IEDs, routers, and protocol converters, designed for OT equipment manufacturers and critical infrastructure operators.
• Red Team SIGINT Training Practical software-defined radio (SDR) hacking training course covering signals intelligence techniques and offensive RF operations.

Quantifiable outcome

• Discovered multiple critical vulnerabilities in TETRA standard affecting 100+ countries and critical infrastructure operators including rail, power, oil & gas, and water sectors
• +2 more outcomes

Segments7 records

Ideal customer profiles3 records

Technology focussed No

API detail

Has API

No

API docs

API detail

Core technology

AI maturity

App detail

Feature5 records

Partnerships

One partnership is on record.

• Dutch National Cyber-Security Centre (NCSC-NL)coreStrategic or Co-development PartnerCollaborative partner for coordinated vulnerability disclosure process. Detailed technical advisory distributed through NCSC for stakeholder and asset owner notification. Follows Dutch NCSC CVD guidelines with 6-month embargo period for hardware and embedded systems vulnerabilities.

Scale indicators3 records

Recent moves6 records

Expansion highlights5 records

Broad incumbents

• NCC Group: Large global security consultancy offering embedded/IoT security assessments alongside broader cybersecurity services. Overlaps with Midnight Blue on hardware security and research but operates at significantly larger scale across many domains.
• Dragos: Established OT/ICS cybersecurity vendor and services provider. Overlaps with Midnight Blue's critical infrastructure client base and ICS expertise, but operates at much greater scale with a primarily productized offering.
• ReVerse Labs: Binary analysis and threat intelligence firm with embedded security heritage. Comparable technical depth in reverse engineering and binary analysis, though operating as a scaled vendor rather than boutique consultancy.

Direct peers

• IOActive: Global security consultancy with industry-leading embedded systems, automotive, IoT, and ICS security research practices. Highly comparable in service offering (vulnerability research, reverse engineering, red team) but at larger scale than Midnight Blue.
• Cure53: Berlin-based boutique security consultancy offering penetration testing, code auditing, and embedded/web security research. Comparable boutique structure and research-driven culture, with overlap on threat modeling and vulnerability discovery.
• Atredis Partners: US-based boutique security research firm offering embedded systems, hardware, and software security assessments. Comparable in size, research orientation, and embedded/OT security focus, though with greater US government/enterprise penetration.
• Riscure: Dutch-based security consultancy specializing in embedded device security, smart card/RF analysis, and vulnerability research. Closely comparable to Midnight Blue in terms of geographic base, boutique size, and deep focus on hardware/embedded cryptographic systems.
• Trail of Bits: Boutique security research and consulting firm with strong cryptography and reverse engineering practices. Comparable in research-driven boutique model and conference presence, though more software-focused than Midnight Blue's embedded/CPS specialization.
• Quarkslab: Security research firm specializing in binary analysis, reverse engineering, and embedded/cryptographic system assessments. Closely comparable technical depth and boutique delivery model to Midnight Blue, particularly in custom tooling and academic-style research output.

Emerging players

• Claroty: OT security vendor with deep focus on industrial/ICS environments. Partial overlap with Midnight Blue's OT/ICS client base, but competes via a productized platform rather than bespoke embedded security research services.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat4 records

Key risks5 records

Key highlights6 records

Customer concentration

• Xx.com/midnightbluelab
• LinkedInlinkedin.com/company/midnight-blue-security

Revenue estimate

Valuation estimate

Number of profiles

Profiles3 records

Funding overview

Funding rounds

Investors

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about Midnight Blue