Audit your connected fleet before someone else does.

No. A lab certification checks a product against a checklist, such as ETSI EN 303 645, and confirms whether the required controls are present. An IoT pentest proves what an attacker can actually do: whether one device on a bench yields a cloud key, a fleet-wide update, or another customer’s data. A product can hold a clean certificate and still be exploitable end to end. Most companies shipping connected products at scale do both, the certification tied to the product release, the pentest tied to firmware drops, hardware revisions and fleet milestones.

Through the parts every device shares. A single unit on a bench often reveals a hardcoded key, a cloud endpoint or an update mechanism that is identical across the fleet. From there, an attacker uses the shared cloud API, the over-the-air update channel, or weak separation between customers to move from one device to many. That is why we always test the path from a single device to the fleet, not just the device in isolation.

Usually yes, at least a small number. Genuine IoT testing means hardware on the bench: opening a unit, reading its debug ports and extracting firmware needs the physical device. We typically ask for two or three sample units, ideally with debug access enabled, plus access to the companion app and the cloud backend. Where physical access is impossible, we scope around what can be tested (firmware images, the app and the cloud) and say so plainly in the proposal.

No. We work on sample units and staging environments, not your customers’ live devices, and every engagement runs under documented Rules of Engagement with a critical-finding protocol. Fleet-wide and cloud tests are performed against a controlled test tenant or with explicit approval, never as destructive actions on production. You get the attacker’s view of your product without putting shipped devices at risk.

A single connected product with a documented cloud backend typically takes two to three weeks of active testing, given the hardware, firmware, radio and cloud work involved; multi-product families or complex radio stacks run longer. Scoping happens beforehand and the retest follows your fixes. We confirm the timeline in the proposal, delivered within 48 hours of the first call.

Price follows scope: the number of devices and layers, the radio protocols involved, and whether the fleet backend is included. We quote a fixed price with no hidden fees and no obligation to renew. A focused single-product engagement sits at the bottom of the range; multi-product families or engagements needing specialist radio hardware scale from there. The retest, against the same firmware and hardware revision, is always included.

The senior specialist you meet on the first call runs it end to end. Our team holds OSCP, OSCE³, OSWE and OSEP credentials, and our IoT practice adds hardware, firmware and radio expertise (tools such as Ghidra, HackRF, Ubertooth and JTAGulator). We are NASA Bug Bounty verified contributors with published findings against connected products. The same person scopes, executes and retests. They stay your point of contact throughout.