Spy chips and fake parts: Australian operators start inspecting their hardware

Australian organisations that have to show they manage supply chain risk now have a way to check the hardware itself. BoardSafe, a hardware security service from Australian technology company Vedametric, inspects phone systems, servers, Wi-Fi routers, switches, firewalls, printers and building controllers for hidden spy chips, fake or swapped parts and altered firmware.

The service launched this month after trials with two Australian defence contractors. It is aimed at government agencies, defence suppliers, critical infrastructure operators and large companies, and at the vendors and integrators who sell equipment to them.

How the checks work

BoardSafe's technicians work on the customer's premises. An AI system compares each circuit board with the manufacturer's original design files, looking for components that should not be there or that do not match the design, and the device's firmware is checked against a known good version. The company says each circuit board takes under 60 seconds, and that in its internal testing the process found 97% of deliberately planted faults.

Devices that pass are closed with a serial-numbered, tamper-evident seal across the join in the case, and every inspection is recorded against that device. Customers can book yearly audits, on-site visits and re-checks after repairs. Design files and data stay on the customer's site, and the company says the checks run on its own models, with no data sent to outside AI services, systems or third-party staff.

Pricing is per device. Because the checks do not alter original components, the company says warranties are usually unaffected, although that depends on the device type. It works with hardware vendors directly and says the list of supported products is growing.

Why now

The launch lands in a busy month for technology regulation. On 10 November the Prime Minister announced mandatory AI safety and security protections, including rapid incident reporting and a new regulator for AI safety. The risk management program rules made under the Security of Critical Infrastructure Act already require responsible entities to identify and minimise supply chain hazards, and APRA's CPS 230 operational risk standard, in force since July 2025, requires banks, insurers and super funds to manage the risks that come from their material service providers.

The threat picture has shifted toward devices too. The Australian Signals Directorate's Annual Cyber Threat Report 2025-26 says most China-linked state hacking groups now run their operations through networks made up mainly of compromised office routers and smart devices. The same report counts more than 82,000 cybercrime reports in the year, one every six minutes. The Australian Institute of Criminology estimates that espionage cost the Australian economy A$12.5 billion in 2023-24, and says that figure is likely to be an underestimate.

Counterfeit equipment is a real problem as well. In the United States, a reseller who trafficked more than US$100 million of counterfeit Cisco networking equipment, some of which reached hospitals, schools and military systems, was sentenced to 78 months in prison. And Verizon's 2026 Data Breach Investigations Report found that 48% of breaches worldwide involved a third party such as a supplier or partner.

Demand from both sides of the contract

Vedametric's founder and CEO Kunal Miind said that most organisations can name every piece of software they run, but very few can prove the hardware underneath it is what the manufacturer shipped.

"Regulators are no longer satisfied with a policy document that says supply chain risk is managed. They want evidence," Miind said. "A sealed device with an inspection record is evidence. You can hand it to an auditor, a regulator or a customer, and they can check it for themselves."

Miind said interest is coming both from operators building their risk management programs and from the suppliers who sell to them.

"The vendors are often the ones who call us first," he said. "If you are bidding for a government or critical infrastructure contract, being able to show that the equipment you are supplying has been checked and sealed makes your proposal much easier to say yes to."

He said the service had been designed around the security expectations of defence and government customers. All BoardSafe staff hold security clearances and undergo mandatory police checks and mandatory substance testing, and Vedametric publishes an AI safety and security framework that commits it to notify serious incidents within 12 hours.

What it does not do

BoardSafe is not a certification scheme or a government approval, and a passed check does not guarantee a device cannot be compromised later. The seal and the per-device record are designed to show what was checked, when, and whether the device has been opened since.

For organisations weighing it up, the starting point is the same as for any supply chain review: list the devices that handle calls, data or building systems, rank them by what an attacker could do with them, and ask suppliers what evidence they can provide about where the hardware came from. Details of the service are at boardsafe.com.au.