A Hak5 Rubber Ducky is sold openly online for less than the price of a steak dinner. It looks like a thumb drive. Plug it into a corporate workstation and it types a thousand-line script into the operating system in three seconds. Carriers have started asking about removable-media controls because the underwriting math now reflects how ordinary this hardware is: it sits in the bottom drawer at every Black Hat conference.
The hardware, briefly.
Five categories are worth knowing by name. The Hak5 Rubber Ducky pretends to be a USB keyboard and types scripted keystrokes at machine speed. The Flipper Zero does the same thing in a different form factor, one that looks like a child's electronic toy. The O.MG cable hides the same script-injection capability inside a USB charging cable that looks just like the one shipped with an iPhone. BadUSB-class HID-spoofing devices declare themselves to the operating system as keyboards while really being storage or network adapters. Rogue USB mass storage with autorun-class payloads is the oldest of the group, and the easiest to overlook because it presents as exactly the thumb drive it appears to be. The entry-price tier of all of it is under $100.
Why NAC and EDR miss it.
USB attack hardware is built to ride a port the network already authorized. The workstation is still on its switchport. Same MAC, same OUI. NAC sees no posture change. EDR sees the spawned activity but cannot reliably attribute it to the device that spawned it. Switch-side device-identity tooling sees the same workstation it saw a minute ago. Detection has to happen at the USB stack on the host, because that is where the device is visible. Everything above Layer 1 is blind to it by design.
The five frameworks that ask about it.
PCI DSS 4.0 Requirements 9.5 and 9.6 cover physical handling of removable media. HIPAA Security Rule ยง164.310(d)(1) Device and Media Controls covers receipt and removal of hardware and electronic media containing ePHI. SOC 2 CC6.7 (Restriction of Information Assets) covers transmission, movement and removal of information to authorized users and processes. CMMC Level 2 MP.L2-3.8.7 (Control Removable Media) names it outright. NIST CSF 2.0 PR.PT-2 cross-cites all of the above. Five checkboxes, one question: can you prove that an attack tool plugged into the controller's workstation would not have had free run?
The carrier questionnaire.
Healthcare cyber-insurance underwriters have asked about removable-media controls since the 2024 renewal cycle. SMB carriers caught up in 2025. The questionnaire asks some variant of "describe controls in place to prevent the introduction of unauthorized removable media." A policy document no longer passes: the underwriter wants evidence of technical enforcement. Brokers report that "we have a policy" answers come back with follow-up requests, while questionnaires with detection-feed evidence clear first-pass review.
What detection looks like.
The mechanism is simple. Done well, the false-positive math is favorable. A small endpoint agent enumerates the USB device tree the operating system already exposes (VID, PID, device class, descriptor, serial) and matches every observed device against a curated signature database of known attack hardware. That database covers the Rubber Ducky family, the Flipper Zero HID profiles, the O.MG cable signatures and the BadUSB-class re-flashed-firmware patterns. The match is deterministic: same descriptor, same result. False positives cluster on legitimate multi-interface hardware such as docking stations, which the per-host allow-list handles. Suppressed entries are logged for the auditor, so a quiet feed is itself evidence.
What detection leaves to other controls.
Detection isn't prevention. A USB-port lock at the OS level still belongs in the endpoint policy, and a DLP suite still handles file-content analysis. A USB attack-tool detection feed catches the class of hardware those policies cannot identify on their own: the device pretending to be a keyboard, the cable pretending to be a charger. Run it alongside the policy and the DLP.
The workstation agent is an optional part of RoomIQ and SpacesIQ. The detection mechanism has three parts: the workstation agent, the signature database, and USB-Ethernet detection on the network side. The 30-day pilot can include an optional USB-agent rollout to high-risk endpoints, and the pilot page has the general terms. For the framework-mapped evidence pack, write to contact_us@cybriq.io.