StarWars Risk Assessment: R2-D2

Happy May the 4th! To spread holiday cheer, the CyberSpeak Labs conducted a fun (not real) risk assessment for R2-D2! Enjoy the cyber fun while reading this.

CyberSpeak Labs Risk Assessment

May 4th, 2025

Asset Number: R2-D2

Model: R2 Series

Model Year: 32 BBY

Manufacturer: Industrial Automation

Assesment Date: Unknown

System Owner/Department: Rebel Alliance Business Function: Starship repair, navigation, and legal slicing tools (hacking packs)

OS: Industrial Automation Droid Operation System

System Risk Level: Moderate to High

1. Threat/Hazard Identification

NIST SP 800-30

Hazard	Description
Unauthorized Shock Prod Use	R2-D2 is equipped with an electrical prod that has little to no guardrails.
Unauthorized Data Access	R2's can be integrated into outside Rebel technologies (Death Star).
Fire Hazard	No emergency plan for when system crashes due to overheating.
Physical Injury	Rapid movement, ejection mechanisms, and surprise tasers present human safety risks.
Behavioral Anomalies	Known for acting independently without command approval.
Malicious Reprogramming	Risk of Empire installing malicious firmware (backdoor protocol overrides).

2. Risk Analysis & Evaluation

Risk Determination (Likelihood × Impact)

Hazard	Likelihood	Impact	Risk Level
Shock Prod Misuse	High	Medium	Moderate
Unauthorized Access	High	High	High
Fire Hazard	Low	High	Moderate
Physical Injury	Medium	Medium	Moderate
Rogue Behavior	High	Medium	Moderate
Firmware Tampering	Medium	High	High

3. Existing Controls

NIST SP 800-53, CA & AC

• Role-based access to droid interfaces (AC-2)

• Behavioral heuristics AI monitoring (SI-4)

• Daily diagnostics (SI-7)

• Mission-specific programming limits (SC-12)

• Internal circuit auto-coolers (PE-13)