A computing device comprising: a memory component configured to store firmware of the computing device ; a bus device communicatively coupled to the memory component ; a bus filter driver configured to: attach to the bus device , retrieve bus device metadata from the bus device , wherein the bus device metadata indicates a date, wherein when the bus device metadata indicates a date less recent than a specified date, acquire a bus interface and utilize the bus interface to locate the memory component , and wherein when the bus device metadata does not indicate a date less recent than a specified date, use a specified memory location as a memory location of the memory component , retrieve a firmware image of the firmware of the computing device from the memory component , wherein the bus filter driver is configured to retrieve the firmware image responsive to receipt of a start message by the bus device at boot time of the computing device , and create an external component library, ECL, for communication with a kernel-mode component of a security agent ; and the computing device further comprises the security agent , wherein the security agent is configured to: retrieve, by the kernel-mode component of the security agent , via the ECL, the firmware image from the bus filter driver , and perform, by a user-mode component of the security agent , a security analysis of the firmware image. a memory component configured to store firmware of the computing device ; a bus device communicatively coupled to the memory component ; a bus filter driver configured to: attach to the bus device , retrieve bus device metadata from the bus device , wherein the bus device metadata indicates a date, wherein when the bus device metadata indicates a date less recent than a specified date, acquire a bus interface and utilize the bus interface to locate the memory component , and wherein when the bus device metadata does not indicate a date less recent than a specified date, use a specified memory location as a memory location of the memory component , retrieve a firmware image of the firmware of the computing device from the memory component , wherein the bus filter driver is configured to retrieve the firmware image responsive to receipt of a start message by the bus device at boot time of the computing device , and create an external component library, ECL, for communication with a kernel-mode component of a security agent ; attach to the bus device , retrieve bus device metadata from the bus device , wherein the bus device metadata indicates a date, wherein when the bus device metadata indicates a date less recent than a specified date, acquire a bus interface and utilize the bus interface to locate the memory component , and wherein when the bus device metadata does not indicate a date less recent than a specified date, use a specified memory location as a memory location of the memory component , retrieve a firmware image of the firmware of the computing device from the memory component , wherein the bus filter driver is configured to retrieve the firmware image responsive to receipt of a start message by the bus device at boot time of the computing device , and create an external component library, ECL, for communication with a kernel-mode component of a security agent ; and the computing device further comprises the security agent , wherein the security agent is configured to: retrieve, by the kernel-mode component of the security agent , via the ECL, the firmware image from the bus filter driver , and perform, by a user-mode component of the security agent , a security analysis of the firmware image. retrieve, by the kernel-mode component of the security agent , via the ECL, the firmware image from the bus filter driver , and perform, by a user-mode component of the security agent , a security analysis of the firmware image. <EOS>