IoT & Hardware Security Testing

Not required, but highly recommended. We can perform black-box testing with just the physical device. White-box testing (with source code and hardware design files) provides more thorough coverage and enables earlier vulnerability identification. Most comprehensive assessments include both firmware analysis and source code review.

Typically 1-2 units. Hardware testing can be invasive - opening enclosures, probing interfaces, potentially damaging units. Having backup devices ensures complete testing even if one unit is affected. For products with multiple hardware variants, we may need samples of each.

Yes. Pre-production testing is often more valuable as findings can be addressed in hardware and firmware revisions before manufacturing at scale. We can work with development units and prototype hardware.

Yes, ecosystem testing is included or available as an add-on. The mobile application, web dashboard, and backend API are integral to the full-stack security posture of any connected device. Combined testing typically provides the most complete coverage.

Some testing methods are invasive and may damage units, particularly when accessing internal hardware interfaces, removing chips, or performing fault injection. This is why we require multiple samples. We always inform you before performing any potentially destructive testing and can adjust our methodology if device preservation is critical.

We test all types of connectivity including Bluetooth, Zigbee, Z-Wave, proprietary RF protocols, and even devices with no wireless connectivity. Non-connected devices still have attack surfaces through physical interfaces, local USB connections, and firmware vulnerabilities.

We routinely sign NDAs and maintain strict confidentiality. All testing is performed in our secure lab, and we never disclose findings publicly without explicit permission. Your firmware, schematics, and proprietary information remain confidential. We can also test on-site at your facility if preferred.

We provide detailed remediation guidance and recommendations, but we don't modify your firmware or hardware designs directly. This maintains independence and objectivity in our testing. However, we're available for consultation during your remediation process.

We immediately notify you of critical findings rather than waiting for the final report, typically within 24 hours of discovery, but usually sooner once we have confirmed our findings. This allows you to begin remediation immediately.

For products already deployed, we can help you develop a coordinated and responsible disclosure plan.

Timeline varies significantly based on device complexity:

• Simple devices (single function, basic connectivity): ~1 week
• Standard devices (typical IoT product with app/cloud): 2-4 weeks
• Complex devices (medical, automotive, multiple protocols): up to 6 weeks in some instances

We'll be able to provide a more concrete answer during a scoping conversation that's customised to your requirements. If we require additional time to complete testing up to our expected standard, then no additional time would be charged.