In one embodiment, a request may be received to load firmware on a microcontroller of a device. A firmware transfer may be initiated to load the firmware on the microcontroller. Data traffic may be monitored at one or more locations on a communication path associated with the firmware transfer. It may be determined whether the data traffic matches a digital fingerprint associated with the firmware.