Benches

A Bench serves as the vital link for remote testing and attack surface discovery. Use this guide to configure your environment and download your custom firmware.

Most users are fully online and ready to test within 30 minutes.

Simulation Benches
If you do not have a physical Bench, supported Simulations can be selected as a Bench when creating a Test Run. Test Cases execute the same way as on a physical Bench.

System Requirements

Component	Recommendation	Why it Matters
Bench	Raspberry Pi 3, 4 or 5. A Pi 4 or Pi 5 with 4GB or more RAM is recommended.	Provides the necessary processing power for complex test cases and concurrent remote access.
SD Card	16GB (or larger) High-Endurance MicroSD	The image is about 3GB. 16GB leaves room for the OS, local log buffering and the tools you add.
Power Supply	Official Raspberry Pi 15.3W USB-C	Prevents undervoltage issues during high-load security assessments and discovery scans.
Network	Ethernet or Stable Wi-Fi	Low latency is critical for maintaining the remote interface between the cloud and the DUT.
Laptop	macOS, Windows or Linux	Required for downloading large system images (3GB+) and flashing the custom firmware to the MicroSD card.

Creating a Bench

Sign-in to vsec.blockharbor.io
Navigate to Test on the sidebar menu to enter the VSEC Test application and then select the Benches submenu.
Click the Add bench button to begin the process of creating a Bench. If the button is disabled, your workspace has reached its plan’s bench limit, and the page shows a Bench Limit Reached message. Upgrade your plan to add more Benches.

A Add new bench dialog window will pop-up with options for configuring the Bench. Complete the Required items below.

Field	Requirement	Description
Bench Name *	Required	A unique, short descriptor of 3 to 63 characters (e.g., `Lab-Alpha-01`).
Internet-facing interface (WAN) *	Required	How the Bench reaches the internet. Select Wireless (WiFi) or Cable (Ethernet) from the dropdown.
WiFi SSID *	Required for Wi-Fi	Name of the Wi-Fi network the Bench will connect to, 3 to 32 characters. This should be a segregated test network, see the warning below. Only shown when the WAN is Wireless (WiFi).
WiFi Password *	Required for Wi-Fi	The security key for the specified Wi-Fi network, 8 to 32 characters. Only shown when the WAN is Wireless (WiFi).
WiFi Country Code *	Required for Wi-Fi	Regulatory domain for Wi-Fi frequencies (Default: `United States of America (US)`). Only shown when the WAN is Wireless (WiFi).
Hostname *	Required	The network name for the device (e.g., `vsec-pi-01`). Filled in from the Bench Name until you edit it.
Use DHCP	Optional	When checked, the network automatically assigns an IP address to the Bench. When unchecked, enter the IP Address, Network Mask, Default Gateway and DNS Server.
Description (Optional)	Optional	Internal notes or context regarding the purpose of this Bench.
SSH Key (Optional)	Optional	Public SSH key (e.g., contents of `~/.ssh/id_ed25519.pub`) for passwordless remote access as the user `tester`. Only `ssh-rsa` and `ssh-ed25519` keys are accepted.
Use generic image and download configuration file only	Optional	Skips building a custom image and downloads only the configuration file. The configuration can then be applied to a generic Bench image, allowing the same base image to be flashed across many Benches for bulk deployments.

Connect the Bench to a segregated network, one per DUT. Whether it uses Wi-Fi or Ethernet, the Bench should sit on a dedicated lab network (a separate VLAN, guest network or physically isolated segment). The network only needs outbound internet access for the Bench to reach VSEC.

Keep it off corporate and production networks. The Bench runs security tooling, scans and attacks against the DUT. Traffic like this must not reach devices outside the test environment.
Treat the Bench as untrusted. It is not a hardened device. The tooling and services it exposes are designed for offensive testing, not for defending against attacks, and some of them may contain vulnerabilities of their own. Keep it away from any network it could be attacked from.
Use one segment per DUT. Each DUT and its Bench should have their own network rather than sharing one lab segment, so that attacks against one DUT cannot reach another and results are not contaminated by unrelated traffic.

After filling out the Required items, click the Create button to begin downloading the Bench image; a custom Raspberry Pi image named after the Bench hostname (e.g., vsec_rpi_vci_v1.0.0-vsec-pi-01.img). If generic image configuration was selected, a configuration file (vsec_config.txt) will be downloaded instead, see Manual Configuration for how to apply it.
The Bench image typically takes about 10-15 minutes to download depending on your internet speed.
Once the Bench image has downloaded, open Raspberry Pi Imager to begin the flashing process.
Please ensure a SD Card is plugged in before proceeding.
Follow the steps in Raspberry Pi Imager tool to flash the Bench image to a SD Card.
1. Device: Select your Raspberry Pi model.
2. OS: Scoll down and click Use custom. When prompted, select the recently downloaded Bench image.
3. Storage: Select your SD Card and click Write to flash the image.
Connect the Raspberry Pi to the network before powering it on. If the WAN interface is Cable (Ethernet), plug an Ethernet cable from the Pi into the segregated network you set up for this DUT. If it is Wireless (WiFi), make sure the Pi is within range of the Wi-Fi network you entered above. Do not connect the Bench to a corporate or production network.
After flashing the image, insert the SD Card into the Raspberry Pi and apply power.
Wait approximately 10 minutes for your Bench to initialize its local environment and establish a secure connection to VSEC.
Once this process is complete, your device should appear as “Online” in VSEC Test.

A Bench shows as Pending, with an amber clock, when it has been created but has never completed registration. See Troubleshooting.

A Bench shows as Online, with a green check, when it is connected.

A Bench shows as Offline, with a red minus, when it has registered before but is not connected now.

Note: We do not save your Wi-Fi credentials.

Troubleshooting: If your device doesn’t appear on VSEC Test, or its status stays on Pending, see the Troubleshooting page. If you have physical access, attaching a screen to review the terminal output often names the failure directly.

Migrating a Bench Between Workspaces

To move a Bench to a different workspace, re-configure it in the target workspace and then remove it from the original one:

In the target workspace, open the Add new bench dialog, fill in the configuration, check the Use generic image and download configuration file only option, and click Create. This creates a Bench without generating an SD card disk image for your Test Bench, it only downloads the configuration file.
Apply the downloaded configuration file (vsec_config.txt) to the Benches SD card. See Manual Configuration for the steps.
Manually delete the Bench from the original workspace.

Creating Multiple Benches

When deploying many Benches at once, you can flash a single generic image to every SD Card and apply a per-Bench configuration file to each, instead of building a unique image per Bench.

Click the Download generic image button on the Benches page, or the Download generic image icon ( ) next to the Use generic image and download configuration file only checkbox in the Add new bench dialog, to download the generic Bench image. Flash it to each SD Card using Raspberry Pi Imager (see steps 6-7 in Creating a Bench).
For each Bench, open the Add new bench dialog, fill in the configuration, check the Use generic image and download configuration file only option, and click Create.
A configuration file (vsec_config.txt) will be downloaded for that Bench.
Apply each configuration file to its corresponding generic-image SD Card. See Manual Configuration for the steps.
Insert each SD Card into its Raspberry Pi and apply power; the Bench will appear as “Online” in VSEC Test once it has finished initializing.