The framework starts
First lines of the ESP32 framework. Agents for IoT/OT security research.
What this is
Espilon is a French loi 1901 non-profit built around embedded, IoT and OT security. We're hardware people: we extract firmware, reverse it, find the bugs, report them, and write up how it was done. The tools we build to do that are open source, and the CTF we run exists so other people can learn the same tricks.
- Find and responsibly disclose vulnerabilities in embedded code
- Build and maintain the open-source ESP32 framework
- Run a hardware / IoT / OT CTF and publish the write-ups
- Share what we learn: talks, articles, students
How we got here
From a side project to a declared association with a CVE list.
2025 · Inception
Feb 2026 · Release
espilon-source v0.1.0
Core refactor, five new ESP32 modules, a stable modular architecture.
2026 · CTF
Espilon CTF: 28 challenges
A hardware CTF on IoT/OT and ESP32. 1,479 players showed up. Write-ups published. CTF →
14 Apr 2026 · Association
Association declared
Constituent assembly. A loi 1901 non-profit, on paper.
11 Jun 2026 · Release
Espilon Monitor v0.1.0
Universal serial monitor for embedded devices. Multi-port, pattern files for ESP32/STM32/Arduino, Python hooks, JSON stream, daemon mode.
2026 · Disclosure
20 published CVEs
Published advisories in Espressif, AWS/FreeRTOS, LibOSDP, Arduino, BACnet, BTstack, SOEM, Open5GS and Linux kernel code, with more in coordination. Advisories →
Work with us
Collaboration, an internship, a CTF, or you just want to support the work.
Association Espilon
Open to technical collaborations, academic partnerships and internships. If you want to support an independent non-profit doing this work, email us.
Non-profit association, loi 1901 · Declared April 2026 · France