One more thing, since the wording of your question seems to assume it: no, it is not sufficient to just test the software. For a hint why that might be true, c

One more thing, since the wording of your question seems to assume it: no, it is not sufficient to just test the software. For a hint why that might be true, consider the following observations: * some years ago, there was a scandal in Europe when it was discovered that some secretly added hardware in portable card payment terminals (the kind the waiter would bring to the table in a restaurant) transmitted credit card details over the GSM network to some unknown location. To speed up locating compromised devices, service workers were sent around with precision scales to physically weigh each unit. Given ongoing miniaturization, this may have already become an impractical approach. * Chip manufacturer Intel, to randomly pick one example, is known to include [hidden secondary systems] on their CPUs. From the linked article: MINIX [i.e. the secondary system] also has access to your passwords. It can also reimage your computer's firmware even if it's powered off. Let me repeat that. If your computer is "off" but still plugged in, MINIX can still potentially change your computer's fundamental settings. And than there's the [Management Engine] which runs "below the BIOS". Thanks but no thanks. [hidden secondary systems](https://www.zdnet.com/article/minix-intels-hidden-in-chip-operating-system/ https://www.zdnet.com/article/minix-intels-hidden-in-chip-op...) [Management Engine](https://www.theregister.com/2017/10/21/purism_cleanses_laptops_of_intel_management_engine/ https://www.theregister.com/2017/10/21/purism_cleanses_lapto...)