.png)
Hardware can be obtained from a variety of sources: the manufacturer, authorized sellers, distributors, retailers, unauthorized resellers, and the grey market.
A manufacturer is the original producer of goods, responsible for the design, creation, and quality control of a product. Manufacturers may sell directly to consumers through their own stores or websites, or they may supply goods to intermediaries liked distributors or retailers. Since there are no middlemen, manufacturers often offer the most competitive pricing and maintain full control over their branding and customer experience.
An authorized seller or authorized reseller is a third-party entity that has received explicit permission from a manufacturer to sell its products. These sellers are typically certified or trained by the brand and often appear on the manufacturer’s official list of partners. Customers benefit from purchasing through authorized sellers because they are more likely to receive legitimate products, full warranties, and brand-backed customer service.
A distributor acts as an intermediary between manufacturers and sellers such as retailers or resellers. Distributors purchase goods in large quantities from manufacturers and manage the logistics of warehousing, transportation, and sometimes regional marketing. They rarely sell directly to consumers but may sell hardware in large quantities to integrators and OEMs.
A retailer is the end-point seller who offers products directly to the final consumer. Retailers can operate through physical storefronts, online platforms, or a combination of both (known as omnichannel retail). They often determine their own pricing structures and may be either authorized or unauthorized to sell certain brands depending on their relationship with manufacturers or distributors.
Authorized seller are often hailed as a trustworthy source, because they have a stamp of approval by the manufacturer through the authorized seller program.
Authorized seller programs are initiatives established by manufacturers to control the distribution of their products, protect brand integrity, and ensure a consistent customer experience. These programs typically involve formal agreements that grant specific third-party retailers or resellers permission to sell a brand’s products, often in exchange for meeting certain requirements related to pricing, marketing, customer service, and adherence to brand guidelines. Authorized sellers may receive benefits such as access to official inventory, training, promotional materials, and eligibility for manufacturer-backed warranties and support services.
Authorized Sellers do not seem to be a rare resource. Here are some statistics that show the complexity and scale of these programs:
It is difficult to believe that these companies can practically enforce consistency and quality across that many partners, and many partners are specific to certain countries or categories. For example, CISCO offers three different authorization levels (“Select”, “Premier”, and “Gold”) for each of four different categories (“Integrator”, “Provider”, ”Developer”, and “Advisor”). For selling, it also seems to have different tiers of sellers as indicated in their application guide.
CISCO provides detailed information on how to become a reseller:
The program does not specify what exactly Cisco will verify or assess before granting partner approval. In fact, online forums contain more posts from frustrated authorized resellers criticizing Cisco's mishandling of the process than from those questioning rejections based on valid grounds. Of course, it’s also possible that less scrupulous sellers simply choose not to voice their complaints publicly.
All this information begs the question: Does buying from an authorized seller automatically imply a very low risk of getting duped? In other words, is it safe to buy from Authorized Sellers and not perform detailed inspections?
The number of authorized sellers and the variety of the programs for some of the examples given above does not provide confidence. Can Cisco really perform an in-depth check of nearly 14,000 partners in the G7 countries alone? How does Sandisk enforce similar standards for the different types of authorized sellers across all these different countries? For example, in the EU a German buyer can approach a French reseller without worrying about trade restrictions.
Palitronica has been analyzing 2FA USB keys for a customer to detect manufacturing variability, implants, and unauthorized changes. Manufacturing variability refers to the natural differences that can occur during the production process of electronic components or devices, even within the same batch or from the same manufacturer. These variations may include differences in electrical characteristics, timing behavior, or physical layout, and serve to scorecard the quality of the OEM’s manufacturing process. Implants are covert modifications—often malicious—introduced into a device’s hardware during or after manufacturing, which may compromise security by leaking data, enabling unauthorized access, or altering the device’s functionality.
The goal of this analysis is to provide the customer with detailed information of the manufacturing capability, the manufacturing variability, and device integrity for 2FA USB key solutions.
We’ve redacted the identifying details—but you can still play “spot the difference.” The variation in physical shape is immediately noticeable. In reality, the manufacturer shipped a mix of very old(revision 1.0) and newer (revision 3.2) systems. From a quality assurance and security standpoint, these revisions should be treated as entirely separate products, each requiring its own testing and validation process. But how would you even know to do that without using Anvil to detect the discrepancy? The packaging alone does not give it away.
It appears the manufacturer took advantage of the large order to offload outdated inventory. Not on Anvil’s watch.
Anvil quickly and easily flagged the inconsistency—identifying different products within the batch using a simple test that took only seconds and a few button presses.
Now our customer knows which supplier to avoid for 2FA keys. The real question is: do you know who to trust for the COTS systems you’re buying?
Key reasons on avoiding suppliers like the one we talked about include:
Each hardware revision we received contains a different Hardware Bill of Materials (HBOM). This means each variant potentially exposes different vulnerabilities and requires separate monitoring, patching, and inventory tracking. However, because the supplier failed to disclose these hardware changes, effective security management is rendered impossible.
Authorized seller programs can be intricate ecosystems — some manufacturers maintain tens of thousands of registered resellers — making it difficult to ensure product consistency and traceability. In a seemingly routine case, Palitronica was tasked with evaluating manufacturer and product integrity for a customer through a comprehensive Anvil CheckPoint scorecard assessment.
During this evaluation, we uncovered a critical supply chain vulnerability: one manufacturer had silently shipped two fundamentally different hardware revisions within a single order — one modern and one outdated. This was not a minor version increment, but a significant design divergence with distinct hardware Bills of Materials (HBOMs),introducing different security implications, monitoring requirements, and compliance risks.
Anvil detected the silent switch. Anvil raised the red flag.
Thanks to this detection, our customer now has clear, actionable intelligence about their supplier’s practices and can proactively mitigate procurement and compliance risks. What seemed like a simple delivery revealed a profound breakdown in secure supply chain practices—exactly the kind of silent threat that leads to cybersecurity failures.