Software & System Security

Thorough testing is essential for secure software, but in practice it is often complex and labour‑intensive. As a result, testing tends to focus on expected behaviour - the “happy flow” - leaving unexpected errors and vulnerabilities undetected. Automated testing techniques address this gap. TNO develops testing methods that analyse software deeply and efficiently, including fuzzing, Software Composition Analysis (SCA) and Dynamic Application Security Testing (DAST).

Fuzzing

In particular, fuzzing offers strong potential. By exposing software to unexpected or random input, errors and vulnerabilities surface quickly. However, the barrier to adoption is often high: configuring tools and interpreting results require specialist expertise.

TNO lowers this barrier through innovations that:

• simplify the use and configuration of fuzzing tools;
• automatically filter and categorise test results;
• leverage software knowledge to enable more targeted testing;
• integrate fuzzing into existing development and testing processes.

This makes deep testing accessible and practical for development teams and manufacturers.

Combining static and dynamic testing

Fuzzing is a form of dynamic testing, where software is executed during analysis. When combined with static testing techniques that analyse code early in the development phase, it forms a powerful testing regime. Smart combinations of these approaches detect errors sooner and reduce remediation time and costs.

Explore which methods and tools (pdf) can be used for software testing, and the specific value each provides.

Security demands continuous attention throughout the SDLC. DevSecOps embeds security structurally into development and delivery processes. TNO researches and develops proof of concepts for automated security controls within CI/CD pipelines, with a strong focus on practical effectiveness: what works in production environments and how it fits existing processes.

Modern software is built from third‑party components. Transparency across the supply chain is therefore essential. A Software Bill of Materials (SBOM) provides insight into dependencies and vulnerabilities and forms the foundation of a secure software supply chain.

TNO supports organisations in creating and applying SBOMs and develops practical knowledge and guidelines. In collaboration with the Dutch National Cyber Security Centre (NCSC) of the Ministry of Justice and Security, TNO publishes a series of papers to help organisations develop and implement SBOMs. Download the SBOM: What, why and how, starterguide.

Systems with stringent reliability requirements – such as those used in national security or critical infrastructure – demand additional assurance. Formal verification makes it possible to prove the absence of errors and vulnerabilities mathematically. TNO has deep expertise in applying these techniques to complex, safety‑critical systems.