Embedded Device & IoT Security Testing

Not required, but highly recommended. We can perform black box testing with just the physical device, but white box testing (with source code and hardware design files) provides more thorough coverage and allows us to identify vulnerabilities earlier in development. Most comprehensive assessments include both firmware analysis and source code review.

Typically 1-2 units. We need multiple samples because hardware testing can be invasive (opening enclosures, probing interfaces, potentially damaging units). Having backup devices ensures complete testing even if one unit is damaged. For products with multiple hardware variants, we may need samples of each variant.

Some testing methods are invasive and may damage units, particularly when accessing internal hardware interfaces, removing chips, or performing fault injection. This is why we require multiple samples. We always inform you before performing any potentially destructive testing and can adjust our methodology if device preservation is critical.

Yes, we can assess production devices purchased on the market or provided by you. However, pre-production testing is more valuable as it allows you to fix vulnerabilities before deployment. Vulnerabilities found in deployed devices require firmware updates, customer communication, and potentially recalls.

We test all types of connectivity including Bluetooth, Zigbee, Z-Wave, proprietary RF protocols, and even devices with no wireless connectivity. Non-connected devices still have attack surfaces through physical interfaces, local USB connections, and firmware vulnerabilities.

We routinely sign NDAs and maintain strict confidentiality. All testing is performed in our secure lab, and we never disclose findings publicly without explicit permission. Your firmware, schematics, and proprietary information remain confidential. We can also test on-site at your facility if preferred.

We provide detailed remediation guidance and recommendations, but we don’t modify your firmware or hardware designs directly. This maintains independence and objectivity in our testing. However, we’re available for consultation during your remediation process.

Vulnerability assessments typically focus on network scanning and known CVEs. Embedded device testing is far more thorough and bespoke, involving hardware analysis, firmware reverse engineering, protocol testing, and physical security assessment. We identify vulnerabilities specific to your device that no automated scanner could find.

We immediately notify you of critical findings rather than waiting for the final report, typically within 24 hours of discovery, but usually sooner once we have confirmed our findings. This allows you to begin remediation immediately.

For products already deployed, we can help you develop a coordinated and responsible disclosure plan.

Yes, if the embedded devices also relate to a SaaS platform, administrative interface, or cloud service. The hardware device itself, mobile applications (iOS/Android), web dashboards, cloud APIs, and backend infrastructure can be included in an assessment scope.

Vulnerabilities often exist in how these components interact, not just in the device firmware itself.

Timeline varies significantly based on device complexity:

• Simple devices (single function, basic connectivity): ~1 week
• Standard devices (typical IoT product with app/cloud): 2-4 weeks
• Complex devices (medical, automotive, multiple protocols): up to 6 weeks in some instances

We’ll be able to provide a more concrete answer during a scoping conversation that’s customised to your requirements. If we require additional time to complete testing up to our expected standard, then no additional time would be charged.