Why “Physical Access Required” Is No Longer a Valid Mitigation

"The attacker requires physical access to the device, so we rate this risk as Low / Informational."

This single sentence is responsible for millions of dollars in post-deployment recall and firmware patching costs across the embedded industry.

Why Physical Access Assumptions Fail in 2026:

• Supply Chain Interception: Hardware moves through third-party logistics, customs, and distribution warehouses before reaching end customers.
• Remote & Public Field Deployments: EV chargers, smart meters, solar inverters, and SATCOM dishes sit in parking lots, rooftops, and public streets.
• Tethered Physical Tooling: Tools that once required ,000 lab equipment (such as voltage glitchers and logic analyzers) now cost under on an ESP32 and execute in seconds.

"If an attacker having 10 seconds of physical access allows them to extract global cryptographic keys, you don't have a physical security problem—you have a fundamental architecture defect."