Basic Input/Output System (BIOS)

What BIOS Does During Startup

BIOS is the first firmware layer that initialises core hardware, performs startup checks, and hands control to the next boot stage. Because it runs before the operating system, it helps establish the initial trust boundary for the entire device.

That early position is what makes BIOS operationally important. If the startup sequence is changed or the firmware itself is altered, the machine can still appear to boot normally while following a different, attacker-influenced path.

Why BIOS Matters for Integrity and Trust

Defenders care about BIOS because it influences what code gets control first, which boot device is trusted, and whether firmware-level tampering can survive across reinstalls. A compromised BIOS can undermine the operating system before host protections are active.

This is why boot order, firmware configuration, and platform integrity are security controls rather than simple setup options. If those values are weakly governed, an attacker may redirect booting to removable media, insert persistence, or weaken the device’s startup trust chain.

Common BIOS Security Weaknesses

BIOS weaknesses usually show up as insecure configuration, outdated firmware, or lack of visibility into hardware-level changes. The most serious failures are those that let unauthorised startup behaviour persist without clear signs at the operating-system layer.

Persistent malware at the firmware layer is especially dangerous because it can survive disk reimaging and can interfere with security tools that rely on a clean boot path. For that reason, BIOS integrity checks belong alongside endpoint and firmware monitoring, not after them.

How Organisations Should Govern BIOS

BIOS should be treated as part of the device security baseline. Organisations should know which platforms they own, which firmware versions are approved, and which settings are required for secure boot behaviour, admin protection, and controlled boot sources.

That governance also extends to change control and recovery. When firmware settings drift, or when a machine shows unexplained boot changes, teams need a documented way to verify configuration, restore a trusted baseline, and confirm the platform has not been altered below the operating system.

Risk and Threat Considerations

BIOS risk is concentrated in pre-OS persistence and boot-path manipulation. If an attacker can change firmware settings or implant code below the operating system, normal endpoint defenses may miss the compromise and the malware can remain after rebuilds.

Failure mechanism: The attacker abuses the early boot trust chain, using firmware access, insecure boot order, or tampered startup code to gain durable control before higher-level security tooling loads.

Impact: The device may boot into attacker-controlled code, expose credentials or secrets during startup, and require firmware-level remediation rather than ordinary malware removal.

Practitioner Guidance

Why practitioners should care: BIOS is not just configuration, it is a control surface for the system’s first trusted execution steps. If it is unmanaged, every later control inherits that weakness.

What to watch for: Unexpected boot device changes, unexplained firmware setting drift, or machines that keep showing suspicious behaviour after a standard rebuild. Those signals justify a deeper firmware review, not just an operating-system scan.

Practitioner takeaway: Treat BIOS as part of the platform trust boundary and include it in asset inventory, hardening, and compromise-response procedures.

Related resources from NHI Mgmt Group

• What breaks when LLM output is treated as trusted input?
• What breaks when teams trust model output more than user input?
• What breaks when an AI system validates its own output?
• Who should own incidents when a GenAI system exposes sensitive or harmful output?