Witekio specializes in embedded software and IoT, adopting a system-wide approach that spans hardware to cloud. Since October 2019, Witekio joined Avnet, a global provider of electronics and IoT. As part of Avnet's strategic plan to strengthen the Group’s Center of Excellence in Embedded, we are launching the creation and expansion of several internationally oriented teams within Witekio, based in France.

Case studies: https://witekio.com/category/case-studies/

Key figures

• 5 entities: head office in Lyon with offices in Paris, Bristol, Stuttgart, and Seattle
• over 110 passionate experts
• over 20 years of experience in embedded software

Contexte The European Cyber Resilience Act (CRA) requires manufacturers of connected products to produce formal security documentation: threat models, attack trees, and risk analyses. Witekio supports its clients in this task and maintains an internal audit framework to conduct these analyses.

Today, this framework relies on XMind to construct attack trees, with a manually managed scoring system. Each project essentially starts from zero.

This internship aims to build an assisted threat modeling tool: a library of reusable attack paths by component, an automated scoring engine, and a lightweight interface to assemble the analysis and generate the three regulatory deliverables expected (attack tree, threat model report, CRA compliance document).

Objectifs

• Conduct a state-of-the-art survey of existing threat modeling tools and their limitations on embedded projects
• Design a library of reusable attack paths indexed by technical component
• Build an automatic suggestion engine: the project declares its components, the tool proposes relevant attack paths
• Automate the scoring of paths (replacing manual XMind scoring)
• Develop a lightweight web interface to assemble the analysis, refine scoring, and visualize the tree
• Automatically generate the three deliverables: attack tree, threat model report, and CRA document

Vos missions

• État de l'art
• Outils existants: OWASP Threat Dragon, Microsoft Threat Modeling Tool, IriusRisk, Threagile
• Formats standards: CAPEC (MITRE), ATT&CK, STRIDE, ADTool
• Analysis of the limits of each approach on embedded Linux, Cloud, and IoT systems
• CRA requirements: what the deliverables must formally cover
• Bibliothèque de chemins d'attaque
• Modeling a reusable path format (YAML/JSON): triggering component, steps, prerequisites, default scoring, associated countermeasures
• Building the library around common Witekio components: TLS/mTLS, MQTT, REST API, JWT authentication, OTA firmware update, serial communication, PKCS#11, D-Bus
• Mapping to CAPEC and MITRE ATT&CK for regulatory traceability
• Moteur de suggestion et scoring
• Project description via a configuration file (components, scope, criticality level)
• Automatic suggestion of relevant attack paths from the library
• Automated scoring (adapting Witekio’s internal scoring): likelihood, impact, attacker effort
• Aggregation into risk scores by path and attack surface
• Interface web légère
• Library view: navigation and search within available paths
• Project view: tree composition, scoring adjustments, ad hoc path additions
• Interactive attack-tree visualization
• Risk dashboard by component and criticality
• Génération des livrables
• Attack tree: export image (SVG/PNG) and structured format (JSON)
• Threat model report: Markdown → PDF, component-based structure with scoring, countermeasures, and CAPEC/ATT&CK references
• CRA document: regulatory template pre-filled from the analysis, covering the requirements

Pourquoi rejoindre Witekio ?

• A strong technical culture, with multidisciplinary teams and varied projects
• A collaborative and supportive environment that values curiosity, knowledge sharing, and autonomy, notably through Lunch & Learn
• A passion for innovation: tackling technological challenges, smart products, and customized solutions
• A commitment to transparency, with monthly Hangouts to share company information
• Witekian Days offering training on a wide range of topics
• Concrete and impactful projects

Processus de recrutement

• An initial phone screen with HR
• A quick technical test
• A technical interview with our team

Nous garantissons l'accessibilité de l'ensemble de nos opportunités professionnelles aux personnes en situation de handicap