Overview
US buyers and retailers increasingly ask connected device makers for security evidence, and NIST IR 8259 sets out baseline capabilities manufacturers should consider. Our testing covers hardware interfaces, firmware, radio protocols, cloud APIs and companion apps, helping you find weaknesses such as default credentials and unsigned updates before products ship.
Smart devices — from building management systems and medical devices to cameras, wearables and industrial sensors — are increasingly connected to corporate networks and the internet. Many ship with debug ports left open, outdated firmware, hard-coded credentials and weak update mechanisms.
Our IoT penetration tests examine the full ecosystem: hardware interfaces such as UART and JTAG, firmware extraction and analysis, radio protocols, local network services, the mobile companion app and the cloud APIs that manage the device.
Whether you build devices or deploy them, we identify how an attacker could compromise a single device, a fleet or the network it sits on.
How testing works for US organizations
- Signed scope and written authorization before any testing, including hosting and cloud provider permissions
- Testing windows agreed around your US time zone at scoping, including after-hours windows for production
- Fully remote delivery, with internal and wireless access via VPN or a shipped test device, so no travel costs
- Reports mapped to SOC 2, PCI DSS, HIPAA and customer questionnaires, with a fixed price in USD
What's included
Our approach
- ModelUnderstand device architecture and trust boundaries.
- HardwareInspect interfaces and extract firmware.
- AnalyzeFirmware, radio and service analysis.
- EcosystemTest apps, APIs and cloud management.
- ReportFindings with engineering-level fixes.
What you receive
- Device threat model
- Hardware and firmware findings
- Radio and app findings
- Cloud/API findings
- Remediation guidance and retest
Standards & frameworks
- OWASP IoT Top 10
- ETSI EN 303 645
- NIST IR 8259
- IEC 62443 (industrial)
- OWASP MASVS (apps)
- PCI DSS 11.4
Frequently asked questions
Do you need physical devices?
Yes, typically two or more units, as hardware testing can be invasive.
Can you test medical or industrial devices?
Yes, with appropriate safety controls and coordination with your engineering teams.
Do you help with IoT security regulations?
Our reports map findings to standards such as ETSI EN 303 645, which underpins several consumer IoT regulations.
Are you a PCI QSA or ASV, FedRAMP 3PAO or CMMC C3PAO?
No. We don't claim any of those statuses on this site. Most penetration tests for SOC 2, HIPAA, PCI DSS Requirement 11.4, the FTC Safeguards Rule and customer due diligence don't require them. If your contract, assessor or program requires a specific accredited provider, tell us at scoping and we'll say plainly whether we can meet it. See US compliance requirements.
Do you quote in US dollars?
Yes. US proposals are fixed-price and quoted in USD, with scope, effort, deliverables and payment terms set out in writing before work starts. See our US pricing guide for published market ranges.