CESH 380 Firmware: State-of-the-Art Agentic Exploitation

AI Acceleration · 3 days · Not assessed

About the course

This is the current frontier, where AI agents drive the firmware reverse-engineering-to-exploit loop and a human stays firmly in the chair.

Your team learns to build and steer autonomous and semi-autonomous LLM agents that unpack and triage firmware, assist decompilation and code understanding, hunt for vulnerabilities, and draft and validate candidate exploits. We stay honest about it: where these pipelines genuinely save time, where they confidently waste it, and where closing the gap still comes down to an experienced human.

Your people leave able to put an agent workflow together, supervise it without being taken for a ride, and weigh its output against what they already know about real firmware. It is a grounded look at the state of the art, not a sales pitch for it.

Want to know what to expect in the classroom? Find out more about our training approach and how we turn technical concepts into practical, hands-on skills.

Skills and topics covered

This list shows the various main topics we cover during the course:

Building autonomous and semi-autonomous LLM agent pipelines
Automated firmware unpacking and triage
Agent-assisted decompilation and code understanding
Machine-driven vulnerability hunting
Drafting and validating candidate exploits with agents
Steering and prompting agents for reverse-engineering work
Spotting agent hallucination and false leads
Keeping a human in the supervisory loop
Judging where agents help and where they fall down
Folding agent output into work your team already does

What will a new trainee gain?

A new trainee gets a realistic feel for what AI agents can and cannot do in firmware work, which is worth a great deal more than the inflated version they will have read about online. They leave able to run an agent pipeline under supervision and sanity-check its findings, so your organisation gets a junior who treats these tools as instruments rather than oracles.

What will an experienced team member gain?

An experienced engineer learns to fold agents into the reverse-engineering and exploit work they already do well, so they can cover more targets without dropping their standards. For your organisation, that is a senior who can set up, steer and audit these pipelines for the rest of the team, and say plainly when a result should not be trusted.

Who this course is for

This advanced course is for firmware analysts, reverse engineers and security professionals who already understand firmware analysis and want to explore how AI agents can accelerate their existing workflows. It is suited to both experienced engineers integrating agents into established processes and newer practitioners who need to learn how to supervise, validate and challenge agent-generated results.

Not sure where you fit? Find out more about our training audience and prerequisites.

Required equipment, tools, and software

You will need a laptop with at least 8GB RAM, preferably 16GB, an up-to-date and stable operating system, and an Ethernet port or reliable Ethernet dongle. Your laptop must be fully under your control so that you can install tools and dependencies and run arbitrary code.

It is useful to have the ability to run virtual machines. Any VMs provided during the course will be suitable for importing into VirtualBox; if you use a different hypervisor, you should be comfortable importing VMs from OVF file formats.

Any firmware images, AI agent environments and course-specific software required for the practical exercises will be provided. No specialist hardware is required.

We put together a goodie bag which directly relates to the activities in the course. The free goodie bag is yours to keep at the end of the course, just make sure you have enough luggage space to take it home. The exact details of what is in it will vary depending on availability but we always make it a useful and interesting collection. We provide any other tools needed to complete all the tasks set, aside from a laptop.

You don’t need to bring anything extra other than your enthusiasm!

Venue and travel information

The classroom

The classroom is well appointed, has good WiFi and hot and cold drinks, it’s spacious, comfortable, has plenty of power sockets, lots of natural light, and is wheelchair friendly. The course is delivered in English and digital versions of slides and handouts will be provided where appropriate.

Food and refreshments

Lunch and morning and afternoon snacks are provided so please make sure you let us know about any dietary needs at least a week before we get started. With the exception of the social night, all other meals are for you to organise. We suggest getting a hotel that provides breakfast, and there are many good restaurants in Manchester for your evening meals. We will try and facilitate additional social arrangements, but, this is down to the individuals present.

Staying in Manchester

There are a number of good and affordable hotels in the Manchester area. We are based in an area called Media City and we are in the same complex as the northern headquarters of the BBC. This means that there are lots of facilities locally and you could choose to not venture into the city centre.

Getting here

If you do choose to look further around there are good tram links that can take you into the city as well as to key travel hubs such as Piccadilly, the national railway station, and Manchester International Airport.

Please check the weather before you travel and bring suitable clothes for the season. If in doubt, assume you will need a waterproof coat and an umbrella. The locals will tell you that Manchester is one of the rainiest places in the world, its not actually true but it does drizzle more than you might expect, even in summer.

Ready to put AI agents to work on firmware?

Explore the current frontier of AI-assisted firmware security without losing sight of where human expertise matters. Over three days, you’ll build and steer agent workflows for firmware triage, code analysis, vulnerability hunting and candidate exploit development, learning how to validate their output and recognise when it cannot be trusted.

Back to all courses