TL;DR
- The Exein Runtime Zephyr Agent is now in public beta, bringing runtime monitoring to microcontrollers running Zephyr RTOS.
- It is built into device firmware, with a footprint of tens of kilobytes.
- It flags memory and stack issues that can signal a bug or an attack, and reports them to the Exein Runtime platform.
- Detection only for now: on-device blocking is planned for a later release.
- Exein is now a Silver member of the Zephyr Project.
What do a refrigeration controller in a supermarket, a temperature sensor on a cold-chain trailer, a pump in a plant room have in common? They’re small devices built on microcontrollers, with a few hundred kilobytes of memory, connected via a cellular connection or Wi-FI, often somewhere nobody visits. This makes them hard to manage: when one is compromised or starts to fail, the teams responsible are left guessing, usually discovering the problem only after the damage is done.
Exein's mission is to secure the world of physical AI and connected devices, with protection that runs inside the device's own software, from the largest systems down to the smallest microcontrollers.
Today we’re marking a step towards that mission by introducing the Exein Runtime Zephyr Agent in public beta; this is a lightweight library built into device firmware that enables runtime monitoring for devices running the Zephyr real-time operating system (RTOS). Incidents appear in the same Exein Runtime platform used for other Exein agents, giving teams a single view to investigate signals across different kinds of devices.
Designed for devices with little to spare
Zephyr is an open-source RTOS used in embedded devices, from sensors and wearables to connected industrial equipment. Zephyr targets constrained devices where conventional agents don't fit due to their resource demands.
Our Zephyr Agent is designed for this environment, with a footprint measured in tens of kilobytes. It is lightweight to not interfere with the device's normal operation. Exact footprint and integration requirements depend on the device and its configuration, so teams should check them during the beta evaluation.
Most of the Zephyr security advisories published to date describe memory problems: leaks, out-of-bounds writes, buffer overflows. The agent watches for that class of trouble on the device, along with error-level log events: heap exhaustion, memory leaks and stack overflow risk. These are signals for investigation, but not always proof an attack has occurred. For instance, problems may also be caused by application defects.
The Zephyr Agent is in public beta. If you want to see it on your own hardware, book a demo.
From a device event to a Runtime incident
The workflow is straightforward:
- Build the agent into the firmware. The Zephyr Agent runs on the device alongside its application.
- Monitor relevant conditions. The agent observes supported memory, stack and log events as the device operates.
- Review incidents in Runtime. When a supported condition is detected and reported, teams can review the incident alongside other devices in the Runtime platform, or in your own SOC/SIEM via APIs and webhooks.
- Use Exein Runtime data to support regulatory incident reporting, such as European Union Agency for Cybersecurity (ENISA) notifications under the Cyber Resilience Act (CRA).
Devices are authenticated and traffic is encrypted. Reporting depends on the device's network connection; teams evaluating the beta should verify connectivity and delivery requirements for their deployment.
The beta focuses on detection and reporting; actively blocking unauthorized behavior on the device is planned for later.
A slow failure, caught in time
Imagine a temperature sensor on a cold-chain trailer crossing the country. It measures every few minutes and sends the readings over a cellular connection. For months it does its job without anyone thinking about it. Nobody visits it, because there is no reason to: the readings arrive, the dashboard updates, and the device is one line among hundreds in a fleet view. Those readings are how the team knows the load is still in range, the same way a refrigeration controller keeps a supermarket cabinet cold. The same is true of a pump in a basement plant room: devices far from the people responsible for them, where a visit costs time and money.
Then a small flaw in the sensor's software starts to cause trouble. Each time it takes a reading, it uses a little memory and forgets to give it back, like a desk that gets slightly more cluttered with every task until there is no room left to work. Then one day it runs out of room, and the device stops reporting or keeps restarting. The first sign of trouble is a load that has drifted out of range, and the team has no idea why.
With the Zephyr Agent, the team catches something going wrong earlier, before the issue starts to affect the system. The agent runs inside the sensor's software and monitors the sensor software itself. When memory usage passes a level the team has set, the agent reports an incident to Runtime while the sensor is still working and the readings are still arriving. The team can look into the software and plan a fix on its own schedule, instead of sending someone out in a hurry after the device has already started to fail.
The incident says that something is wrong, not why. Here it is a software bug, but the same warning sign can also point to an attack. Working out which is still the team's job.
"When hackers can change the settings on supermarket refrigeration systems, the consequences can reach far beyond IT. Recent attacks in France disrupted equipment used to monitor and control temperature — putting cold-chain operations at risk."
— Charles van Gorkum, New Business & Sales, IoT at Deutsche Telekom
From a LinkedIn post on the DT IoT × Exein partnership. Read the full post.
Building with the Zephyr ecosystem
Exein is now a Silver member of the Zephyr Project, a Linux Foundation project. That membership reflects our investment in the ecosystem used to build these devices, not just in a product we ship into it: an agent for Zephyr devices has to work the way Zephyr works, on the boards and configurations teams already build.
We are also working with Deutsche Telekom IoT to bring connectivity and device-level security together for cellular IoT. The partnership, announced in October, leans on Zephyr: DT IoT brings global connectivity, Exein brings device-level security designed to run on the device, and cellular IoT on Zephyr is where the two meet first. It is also where the risk above becomes concrete, on devices that are always connected, often unattended, and part of an operation that cannot pause.
At Electronica 2026 in Munich, Thomas Roos, Sr. Forward Deployed Engineer from Exein, and Dominic Richter, Product Manager from Deutsche Telekom, will lead a hands-on workshop on November 12. Participants will work with a cellular IoT device, pairing Deutsche Telekom's nuSIM offering with Exein Runtime for Zephyr. Attendees will receive an nRF9151 development kit. Register for the workshop, or book a demo if you would rather see the agent on your own hardware.
