IoT Penetration Testing

We test MQTT, Bluetooth (Classic and BLE), Zigbee, Z-Wave, Wi-Fi, cellular, and custom or proprietary RF protocols. The focus is on authentication, encryption, replay resistance, and whether an attacker can intercept, modify, or inject traffic between the device and the services it communicates with.

Yes. IoT devices rarely operate in isolation. We test the APIs, cloud platforms, and backend services that devices depend on, including how data flows between the device and the cloud, how identity and access controls are enforced, and whether a compromised device can be used to pivot into broader cloud infrastructure. We also analyze device communication patterns to identify where the device is sending data, how often, and whether any of those destinations are unexpected or unauthorized. If a device is phoning home to infrastructure you didn’t know about, we surface that.

When physical testing is in scope, we assess what an attacker with hands-on access to the device could accomplish. This includes probing debug ports, extracting firmware from flash storage, intercepting bus communications, and evaluating tamper-detection mechanisms. When firmware is encrypted, we evaluate the encryption implementation itself, attempt key extraction from the device, and assess whether the encryption actually prevents meaningful analysis or just slows it down. We coordinate physical testing logistics during scoping.

Yes. We assess SCADA systems, PLCs, industrial protocols, and operational technology environments. Safety is a primary consideration in OT testing. We coordinate closely with your operations team, establish strict rules of engagement, and avoid any actions that could impact physical processes or safety systems unless explicitly approved in a controlled environment.

At minimum, we need the physical device or devices to be tested and any available firmware images. If the device connects to cloud services, we need access to the relevant APIs and backend environments. Architecture documentation, network diagrams, and prior security assessments are helpful but not required. For devices managed through a mobile app, we test the app as part of the same engagement. We walk through all logistics during the scoping call.

Most IoT engagements run two to four weeks depending on the number of devices, firmware complexity, communication protocols in use, and whether physical hardware testing is included. Firmware-only assessments tend to be shorter. Engagements that include hardware teardown, protocol analysis, and cloud backend testing take longer. We provide a clear timeline during scoping, and if we discover a critical finding that poses an imminent threat, we escalate it to your team immediately.

The report is the beginning, not the end. You get a live debrief with the operators who ran the engagement, walking through every finding, its real-world impact, and specific remediation steps. If your team needs hands-on help remediating, we can work alongside your engineers to close the gaps. Once fixes are in place, we conduct retesting to verify they’re resolved.