Every device is a door.
We test all of them.
End-to-end security audit of your IoT product — hardware interfaces, firmware binaries, radio protocols, cloud backend, and companion mobile app. Aligned with OWASP IoT Top 10, NIST 8259 / SP 800-213, and ETSI EN 303 645. Certification-ready reports for regulators, retailers, and enterprise buyers.
A device isn't secure until every layer is.
Attackers don't stop at the chip. Neither do we. We audit the full ecosystem — where most audits only cover one or two layers.
Hardware
PCB analysis, JTAG/SWD, UART, SPI/I²C, chip extraction, fault injection.
Firmware
Binary extraction, reverse engineering, secrets hunt, OTA integrity, secure boot.
Radio
Wi-Fi, BLE, Zigbee, LoRaWAN, Z-Wave, Matter, Thread — sniff, replay, inject.
Cloud / API
MQTT, HTTPS, backend auth, IDOR, multi-tenant isolation, telemetry abuse.
Mobile App
Android/iOS companion — crypto, pairing, cert pinning, local storage, deep links.
Hands-on lab. Standards-aligned reporting.
Physical device access in our secure lab, paired with OWASP ISVS/IoT-TG testing discipline, ETSI EN 303 645 baseline verification, and MITRE ATT&CK for ICS/IoT TTP mapping.
Planning & ROE
Devices, layers in scope, destructive-testing allowance, CVD policy, legal sign-off.
Device Reconnaissance
Product teardown, PCB photography, chipset ID, FCC-ID recon, public-CVE triage.
Hardware Attack
UART/JTAG access, SPI flash dump, glitching, tamper-response validation.
Firmware Analysis
Binwalk/Ghidra reverse, hardcoded secret hunt, weak crypto, debug iface, secure boot.
Radio & Protocol
SDR capture, BLE/Zigbee/LoRa analysis, pairing attacks, replay, jam, relay.
Cloud & API Pentest
MQTT broker abuse, backend auth, IDOR, multi-tenant leak, OTA server integrity.
Companion App
OWASP MASVS review, cert pinning, local storage, deep-link abuse, pairing flow.
End-to-End Abuse
Chain findings across layers. Simulate real attacker flows: app → cloud → device → adjacent.
Report & CVD
Exec + technical report, CVSS, ATT&CK, standards mapping. CVD coordination if applicable.
Regulator-grade references. Not vendor marketing.
IoT Top 10 & ISVS
Consumer-IoT vulnerability categories plus IoT Security Verification Standard for structured verification.
- OWASP IoT Top 10 (2018/latest)
- IoT Security Verification Standard (ISVS)
- OWASP Firmware Security Testing Methodology
- OWASP IoT Attack Surface Areas Project
- OWASP MASVS / MASTG for companion apps
- OWASP API Security Top 10 (backend)
SP 800-213 & NISTIR 8259
Federal-grade baseline for IoT device cybersecurity capabilities and lifecycle management.
- NISTIR 8259A · Device Cybersecurity Core Baseline
- NISTIR 8259B · Non-Technical Capabilities
- NIST SP 800-213 · Federal IoT Guidance
- NIST SP 800-53 control mappings
- NIST SP 800-115 test methodology
- NIST CSF 2.0 function alignment
EN 303 645 & ATT&CK
The consumer-IoT baseline accepted across EU / UK / India, plus attacker-TTP mapping for SOC teams.
- ETSI EN 303 645 · Consumer IoT Baseline
- ETSI TS 103 701 · Conformance Assessment
- MITRE ATT&CK for ICS
- MITRE EMB3D · Embedded Threat Model
- IoXT Alliance Pledge alignment
- IoT Security Foundation · Compliance Framework
Your stack is our shelf.
SDR + purpose-built dongles + protocol analyzers in our lab. If it's on the device, we can capture, fuzz, and replay it.
WPA2/3, PMF, evil-twin, KRACK, WPS.
Pairing, GATT, sniff, MITM, replay.
Trust center, key transport, touchlink.
S0/S2, include-node attack, key scheme.
Join procedure, replay, ABP/OTAA keys.
Commissioning, DAC, operational cert.
Broker abuse, TLS, ACL, topic squat.
Mifare, relay, emulation, clone.
Every category. Hardware through cloud.
Each finding maps to the specific IoT Top 10 item plus the relevant ETSI 303 645 provision — so certification mapping is one-click.
Weak · Guessable · Hardcoded Passwords
Default admin creds, universal keys, factory pins, hardcoded MQTT/API tokens.
Insecure Network Services
Exposed telnet/SSH/UPnP/debug ports, unauthenticated services on LAN/WAN.
Insecure Ecosystem Interfaces
Weak cloud, mobile, API auth. IDOR in fleet management. Cross-tenant leakage.
Lack of Secure Update Mechanism
Unsigned OTA, rollback attacks, no anti-rollback, unencrypted update channel.
Insecure / Outdated Components
Known-vuln SDKs, EOL OSes, unpatched bootloaders, unsafe third-party libs.
Insufficient Privacy Protection
PII leakage in telemetry, unconsented data sharing, lack of local-only mode.
Insecure Data Transfer & Storage
Cleartext on radio, unencrypted flash, weak crypto, missing mutual-TLS.
Lack of Device Management
No fleet visibility, no revocation, no provisioning lifecycle, orphaned devices.
Insecure Default Settings
Services on by default, debug enabled, open pairing windows, weak out-of-box posture.
Lack of Physical Hardening
Exposed debug headers, unpotted chips, trivial enclosure, no tamper detection.
Get audit-ready for the market you sell into.
Evidence and report formats that satisfy labels, regulators, and enterprise buyer security reviews.
Domain-aware auditors. Not generalists.
Smart Home & Wearables
Locks, cameras, thermostats, fitness bands. ETSI 303 645 & Cyber Trust Mark readiness.
OT / ICS / IIoT
PLCs, gateways, sensors. IEC 62443 alignment, ICS-safe testing, air-gap considerations.
Medical Devices
Infusion pumps, patient monitors, imaging. FDA pre-market & post-market cybersecurity.
Connected Vehicles
Telematics, IVI, BLE keys. ISO/SAE 21434 & UN R155 alignment, V2X considerations.
Smart Buildings
Access control, HVAC, lighting, elevators. BACnet/Modbus/KNX safety in scope.
Retail & Payments
POS, PIN pads, kiosks, ESL. PCI-PTS alignment, tamper-evidence validation.
A lab full of tools. A team full of breakers.
Dedicated Hardware Lab
JTAGulators, logic analyzers, SDRs (HackRF/Ubertooth), bus pirates, chip-off rig — physical access is table-stakes for us.
Multi-Layer Chained Findings
We don't stop at a bad cloud API. We chain it with radio and firmware to prove real-world impact.
Certification-Ready Reports
Evidence mapped to ETSI 303 645 provisions, NIST 8259A capabilities, and OWASP categories simultaneously.
Shift-Left Friendly
We audit prototypes too. Catching issues at EVT/DVT is 10× cheaper than post-launch recalls.
Responsible Disclosure
We manage CVD when findings affect third-party components — protecting your brand and the broader ecosystem.
Device-Safe NDA
Samples returned or securely destroyed. Firmware images, schematics, and evidence stored encrypted under your control.
Kickoff to final report in 4-6 weeks.
Scoping & Device Intake
Free 30-min scoping call. NDA & ROE signed. Devices shipped. Firmware / app builds provided.
Recon & Hardware
Teardown, PCB mapping, debug-iface identification, flash extraction, boot chain analysis.
Firmware & Radio
Reverse engineering, secret hunt, SDR capture, protocol fuzzing, pairing attacks.
Cloud, API & Mobile
Backend pentest, MQTT analysis, MASVS review of companion app, end-to-end chaining.
Reporting & Debrief
Exec + technical report, CVSS/ATT&CK/ETSI mapping. Live walkthrough with your teams.
Remediation & Retest
Fix-support office hours. Free retest of critical/high findings within 45 days. CVD assistance.
What product teams ask us first.
How many physical devices do you need?
Do you need source code or schematics?
Will your testing destroy our devices?
Can you help us get ETSI EN 303 645 / Cyber Trust Mark / CRA ready?
What about handling third-party component vulnerabilities?
Do you test pre-production / prototype devices?
How much does it cost?
Ship a device attackers can't own.
Book a free 30-minute scoping call. Tell us about your product, your market, and your timeline — we'll send a fixed quote within 48 hours.