A computing device (102, 500) comprising: a memory component (112, 502) configured to store firmware of the computing device (102, 500); a bus device communicatively coupled to the memory component (112, 502); a bus filter driver configured to: attach to the bus device, retrieve bus device metadata from the bus device, wherein the bus device metadata indicates a date, wherein when the bus device metadata indicates a date less recent than a specified date, acquire a bus interface and utilize the bus interface to locate the memory component (112, 502), and wherein when the bus device metadata does not indicate a date less recent than a specified date, use a specified memory location as a memory location of the memory component (112, 502), retrieve a firmware image of the firmware of the computing device (102, 500) from the memory component (112, 502), wherein the bus filter driver is configured to retrieve the firmware image responsive to receipt of a start message by the bus device at boot time of the computing device (102, 500), and create an external component library, ECL, for communication with a kernel-mode component of a security agent (122, 124); and the computing device (102, 500) further comprises the security agent (122, 124), wherein the security agent (122, 124) is configured to: retrieve, by the kernel-mode component of the security agent, via the ECL, the firmware image from the bus filter driver, and perform, by a user-mode component of the security agent, a security analysis of the firmware image. a memory component (112, 502) configured to store firmware of the computing device (102, 500); a bus device communicatively coupled to the memory component (112, 502); a bus filter driver configured to: attach to the bus device, retrieve bus device metadata from the bus device, wherein the bus device metadata indicates a date, wherein when the bus device metadata indicates a date less recent than a specified date, acquire a bus interface and utilize the bus interface to locate the memory component (112, 502), and wherein when the bus device metadata does not indicate a date less recent than a specified date, use a specified memory location as a memory location of the memory component (112, 502), retrieve a firmware image of the firmware of the computing device (102, 500) from the memory component (112, 502), wherein the bus filter driver is configured to retrieve the firmware image responsive to receipt of a start message by the bus device at boot time of the computing device (102, 500), and create an external component library, ECL, for communication with a kernel-mode component of a security agent (122, 124); attach to the bus device, retrieve bus device metadata from the bus device, wherein the bus device metadata indicates a date, wherein when the bus device metadata indicates a date less recent than a specified date, acquire a bus interface and utilize the bus interface to locate the memory component (112, 502), and wherein when the bus device metadata does not indicate a date less recent than a specified date, use a specified memory location as a memory location of the memory component (112, 502), retrieve a firmware image of the firmware of the computing device (102, 500) from the memory component (112, 502), wherein the bus filter driver is configured to retrieve the firmware image responsive to receipt of a start message by the bus device at boot time of the computing device (102, 500), and create an external component library, ECL, for communication with a kernel-mode component of a security agent (122, 124); and the computing device (102, 500) further comprises the security agent (122, 124), wherein the security agent (122, 124) is configured to: retrieve, by the kernel-mode component of the security agent, via the ECL, the firmware image from the bus filter driver, and perform, by a user-mode component of the security agent, a security analysis of the firmware image. retrieve, by the kernel-mode component of the security agent, via the ECL, the firmware image from the bus filter driver, and perform, by a user-mode component of the security agent, a security analysis of the firmware image.