RF Cyber Security | Triarii Research

From RF Blind Spots to Threat Detection

Achieve Wireless Visibility, Real-Time Threat Monitoring and Mitigation

scaRF: Uncovering Hidden Threats in the RF Spectrum

Triarii scaRF delivers continuous monitoring of the RF and physical layers to uncover how wireless systems are exposed and strengthen security. Operating at the origin of communication—before packets and protocols—it provides actionable alerts that traditional OT/IT and system security solutions cannot.

security-information-and-event-management-in-one-i-P LR.png

Continuously monitors for signal activity

Automatic

Recording

Detects anomalous RF activity

Seamless SIEM Integration

Key Capabilities

Creates RF Visibility: Understand exposure at the physical layer across wireless systems.
Regulatory Enforcement: Identify illegal or unlicensed RF usage for compliance.
Forensic-Ready: Instantly capture abnormal RF activity for rapid investigation.
SOC/SIEM Integration: Seamlessly stream RF alerts into existing security workflows.

RF visibility & Anomaly Detection

RF Threat Hunting

antenna-tower-no-cube-under-P Firefly Upscaler 4x scale LR.png

RF Physical Device Identification

1. RF Visibility & Threat Detection: Identify and alert on Cyber, RF, and CRF attack attempts

Triarii scaRF strengthens industrial and system security by monitoring the RF spectrum for malicious activity that traditional OT/IT tools cannot see. It provides early alerts on attack attempts targeting wireless communications at the physical layer.

Examples of Attack Attempts in Industrial & Complex Systems

RF Jamming of Control Signals: Disrupting wireless links between sensors, PLCs, or safety-critical subsystems.
Replay Attacks on Safety Systems: Replaying valid RF commands to override shutdown sequences or trigger unintended actions.
Spoofing Wireless Devices: Impersonating authorised transmitters to inject malicious commands into mission critical systems.
Drone-Based RF Intrusion: Using drones equipped with RF transceivers to intercept or inject signals near mission critical systems and infrastructure.
GPS Spoofing for Autonomous Platforms: Misleading robotic machinery, vehicles, or drones in industrial yards or defence environments.
CRF Payload Injection: Exploiting RF channels to deliver malware into isolated OT networks or multi-system architectures without physical access.

2. RF Threat Hunting: Detect and Find Rogue Devices, Spectrum Misuse & Misconfigurations

Triarii scaRF enables proactive RF threat hunting by continuously monitoring the physical layer for anomalies and suspicious activity. It provides visibility and actionable alerts to uncover rogue devices, spectrum misuse, and misconfigurations that traditional security tools cannot detect.

Examples of Rogue Activity

Air-Gapped Systems Transmitting Wirelessly: Misconfigured devices unintentionally broadcasting RF signals from isolated networks.
Drone Intrusions: Detect and alert when drones approach restricted zones or critical infrastructure.
Hidden Rogue Access Points: Unauthorised wireless nodes creating backdoors into operational or safety systems and networks.
Spectrum Misuse: Overlapping frequencies causing interference or deliberate jamming.
Unlicensed Transmitters: Illegal RF emissions violating compliance and regulatory standards.
Rogue IoT Devices: Compromised or unauthorised sensors forming covert RF mesh networks within system-of-systems architectures.

3. RF Device Fingerprinting: Unique RF signatures for accurate device identity

In complex industrial and system-of-systems environments, knowing what is transmitting, where it is, and how it behaves is critical for security and operational integrity. RF Physical Device Identification extends beyond simple device recognition—it creates a unique RF fingerprint for every transmitter, enabling organisations to map assets, validate presence, and monitor behavioural patterns at the physical layer.

Examples of RF Physical Device Identification Capabilities

RF-Based Fingerprinting: Generate unique RF signatures for each device or system to ensure accurate identification and confirm presence and behaviour.
Asset Inventory & Tracking: Maintain a live database of all detected devices and systems for dynamic asset management.
Live Transmission Capture: Monitor real-time RF activity to validate operational status.
Active Interrogation: Trigger retransmissions with Sensor Wakeup signals to confirm device presence and integrity.
Forensic-Ready Logging: Instantly record RF activity for investigation, compliance, and lifecycle tracking.
Anomaly Detection: Flag unexpected or unauthorised devices to prevent rogue asset infiltration.