Overview
Firms that make or sell connected products in the UK face growing expectations around default passwords, update support and vulnerability handling. We take devices apart in a controlled lab, look at firmware, debug interfaces and radio traffic, then test the companion app and cloud service. The report separates design issues from quick fixes so product teams can plan both.
An IoT product is a full system scattered across a device, its radios, a mobile or web application, and a cloud backend, and an attacker can start from whichever is weakest. We test the whole picture, beginning with the device itself, because an adversary who holds the hardware can probe it in ways no network attacker can, and because flaws found there often affect every unit you have shipped.
On the hardware we look for exposed debug and serial interfaces, accessible storage, and the chance to read or modify firmware directly. Extracted firmware is analysed for hard-coded credentials, keys and certificates, insecure update mechanisms, and vulnerable components. We then test the radios and protocols the device speaks, how it pairs and authenticates, and whether its traffic can be intercepted or spoofed, before carrying the assessment through to the companion application and the cloud APIs that the device trusts.
The findings are framed by what an attacker gains and how widely it applies. A key extracted from one device that unlocks the fleet is a very different problem from a local-only weakness, and we make that distinction clear. Each issue is scored with CVSS v4.0 and paired with a fix at the right layer, secure boot and storage, signed updates, stronger protocol authentication, or backend changes, so your hardware and platform teams each know their part.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Device intakeWe take sample units, documentation and any companion app and credentials.
- Hardware analysisWe examine interfaces and attempt to access storage and firmware.
- Firmware reviewExtracted firmware is analysed for secrets, update flaws and components.
- Protocol & cloudWe test radios, protocols, the companion app and the backend APIs.
- Report & debriefFindings are framed by fleet impact, scored and explained by layer.
What you receive
- Findings across hardware, firmware, protocol and cloud
- Firmware analysis with extracted secrets where present
- Assessment of fleet-wide versus local-only impact
- CVSS v4.0 scores and layer-specific remediation
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP IoT Top 10
- PTES
- NIST SP 800-115
- OWASP MASVS
- OWASP API Security Top 10
- CVSS v4.0
- UK GDPR Art. 32
- Cyber Essentials controls
Frequently asked questions
How many devices do you need?
Usually two or three identical units. Hardware testing can alter or damage a device, so we need spares to continue after invasive work, and having more than one lets us compare behaviour and confirm that a finding applies across the product, not just one sample.
Do you keep or destroy our devices afterwards?
We return or securely destroy them as you prefer, and we never retain extracted firmware or secrets beyond the engagement. Devices we have opened or modified are clearly marked so they are not mistaken for production stock.
Is the cloud backend included?
The backend a device trusts is central to its security, so companion-app and cloud-API testing are part of a meaningful IoT engagement. A very large, unrelated platform may be scoped separately as an API test, which we confirm with you up front.
What permission do you need before testing our network?
Signed written authorisation from someone entitled to give it, which keeps the work on the right side of the Computer Misuse Act 1990. If a hosting company, landlord or managed IT provider runs part of the estate, we ask you to confirm their permission too.
Is this the same as a Cyber Essentials Plus audit?
No. Cyber Essentials Plus has a Certification Body check, hands-on, that the scheme's five controls are in place. An infrastructure pentest goes further, chaining weaknesses to show real attack paths. Many teams use our findings to tidy up before their Certification Body visits.