IoT Security Testing
from Chip to Cloud
for Connected Products
IoT security testing
End-to-End Testing of Devices, Firmware, Radio, Apps and Cloud
Connected products are only as secure as their weakest layer, whether that is an exposed debug port, unsigned firmware, an unauthenticated Bluetooth service or a cloud API. iSpyCyber tests the whole ecosystem in our lab and yours, from hardware and firmware to radio protocols, companion apps and back-end services, and delivers validated findings your engineering teams can fix before and after launch.
Why organisations choose iSpyCyber
Hardware hacking
UART, JTAG and SWD interfaces, flash extraction and board-level analysis in a dedicated test setup.
Firmware analysis
Extraction, unpacking and review of firmware for secrets, vulnerable components and insecure update paths.
Radio and wireless
BLE, Zigbee, Wi-Fi, LoRa and sub-GHz radio traffic captured, analysed and tampered with.
Apps and cloud
Companion mobile apps and cloud APIs are tested as part of the same attack surface.
Near-zero noise
Every issue is reproduced by hand, so your team only receives real, exploitable findings.
Continuous validation
Retesting confirms every fix, and iefyx, our AI-native VAPT platform, keeps cloud and app exposure visible between engagements.
Coverage
What We Test in Your IoT Ecosystem
Our testers follow the OWASP IoT Security Testing Guide and ISTG methodology, mapping findings to consumer and industrial IoT baseline requirements.
Hardware interfaces
UART, JTAG, SWD and test points, debug access, tamper resistance and secure element use.
Flash and storage
Chip-off and in-circuit extraction, stored credentials, keys, certificates and personal data.
Firmware
Hard-coded secrets, outdated components, binary vulnerabilities, secure boot and signature checks.
Update mechanism
OTA update authentication, integrity, rollback protection and delivery channel security.
BLE and short-range radio
Pairing, bonding, GATT authorisation, replay, sniffing and spoofing across BLE, Zigbee and Z-Wave.
Network services
Exposed ports, local web interfaces, Telnet and SSH, MQTT, CoAP and UPnP configuration.
Companion mobile apps
Android and iOS app storage, device pairing flows, certificate pinning and API use.
Cloud back end
Device identity, provisioning, MQTT broker authorisation, APIs and multi-tenant isolation.
Authentication and privacy
Default and shared credentials, account takeover, data minimisation and user data deletion.
Methodology
A Proven Six-Phase Testing Methodology
Aligned to the OWASP IoT Security Testing Guide, ETSI EN 303 645 and NIST IR 8259, and tailored to your device architecture and target markets.
- OWASP ISTG
- OWASP IoT Top 10
- ETSI EN 303 645
- NIST IR 8259
- CVSS 3.1
3–5
weeks for a typical engagement
6
standards-aligned phases
100%
findings manually validated
01
- Days 1–3
Scope and plan
Devices, firmware versions, apps, cloud services and shipping logistics agreed up front.
Key activities
- Confirm device models, firmware and components in scope
- Arrange shipment of multiple units for destructive tests
- Agree cloud test tenants, accounts and rules of engagement
- Output: Signed rules of engagement
02
- Days 3–6
Map and model
Board, interfaces, protocols and data flows mapped from chip to cloud and threat-modelled.
Key activities
- Tear down hardware and identify components
- Map radio, network and cloud communication
- Threat-model device, user and fleet-wide attacks
- Output: Ecosystem map and test plan
03
- Days 5–16
Discover
Hands-on hardware, firmware, radio, app and cloud testing in our lab.
Key activities
- Probe debug interfaces and extract firmware
- Analyse firmware, radio and network traffic
- Test companion apps and cloud APIs
- Output: Candidate vulnerability list
04
- Days 13–20
Exploit and validate
Impact safely proven on test units, attack chains built and false positives eliminated.
Key activities
- Prove device compromise and data access
- Chain local flaws into fleet-wide attack paths
- Rate every finding with CVSS and product context
- Output: Validated, risk-rated findings
05
- Days 20–24
Report and debrief
Executive summary, technical findings and a walkthrough with your hardware, firmware and cloud teams.
Key activities
- Executive summary for leadership
- Findings mapped to ETSI EN 303 645 provisions
- Live walkthrough and Q&A with your teams
- Output: Final report and debrief
06
- After remediation
Fix and retest
Remediation guidance and retesting of updated firmware, apps and services.
Key activities
- Engineering Q&A while fixes are built
- Retest updated firmware and services
- Updated report confirming closure
- Output: Retest report
Effort distribution
Where the testing time goes
Most of every engagement is spent on hands-on hardware, firmware and radio analysis in the lab. Percentages are indicative for a typical grey box IoT product test.
Quality built into every phase
Every finding reproduced
Nothing is reported until a tester has reproduced it on a test unit.
Risk rated in context
Severity reflects physical access, scale and user safety.
Agreed rules of engagement
Destructive tests run only on units you have agreed to.
Closure confirmed
Retesting proves each fix actually works on new firmware.
Engagement models
Choose the Testing Approach That Fits Your Risk
Every approach uses the same methodology. The difference is how much context our testers start with, and how deep they can go.
Black box
Retail devices and public apps only, simulating an attacker who buys your product. Best for validating what any buyer or attacker can reach.
Grey box
Device units, firmware images, test accounts and architecture notes to test every layer in depth. Best for most connected products before and after launch.
White box
Schematics, source code and cloud configuration for the deepest coverage. Best for medical, automotive, industrial and other safety-relevant devices.
Not sure which approach you need?
Our specialists will recommend a scope based on your device architecture, target markets and regulatory obligations.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Clear business context for decision-makers, precise technical detail for engineers and evidence your auditors can rely on.
Executive summary
Overall product risk posture, key themes and business impact in plain language for leadership and product owners.
Technical findings
Every vulnerability with CVSS rating, affected component, reproduction steps and proof-of-concept evidence.
Remediation roadmap
Prioritised fixes across hardware, firmware, app and cloud so teams resolve the highest-impact issues first.
Retest report
Independent confirmation of which findings are closed on updated firmware, ready to share with customers and regulators.
Supports your compliance and assurance requirements
- ETSI EN 303 645
- NIST IR 8259
- OWASP ISTG
- EU Cyber Resilience Act
- UK PSTI Act
- ISO/IEC 27001
- IEC 62443-4-2
- DPDP Act 2023
- CERT-In guidelines
- GDPR
iSpyCyber provides independent security testing that supports these requirements. Certification and attestation are issued by accredited bodies and licensed auditors.
IoT security testing for every industry
The basics
What is IoT security testing?
IoT security testing is a hands-on assessment of a connected product and its ecosystem, covering hardware, firmware, wireless communication, companion apps and cloud services, to find and safely prove exploitable weaknesses and explain how to fix them.
Which wireless protocols do you test?
We commonly test BLE, Wi-Fi, Zigbee, Z-Wave, LoRa, NFC and sub-GHz proprietary radio, depending on the product and the equipment the engagement requires.
Can testing help with ETSI EN 303 645 or the EU Cyber Resilience Act?
Yes. We map findings to relevant provisions to support your conformity work. Formal certification and conformity assessment are carried out by accredited bodies.
Working with us
How many device units do you need?
Usually two to three units per model, so that one can be used for invasive hardware work while others remain available for functional and radio testing.
How long does an IoT penetration test take?
Most engagements take three to five weeks, depending on the number of devices, protocols, apps and cloud services in scope, plus shipping time for hardware.
Will you damage our devices?
Some hardware techniques are invasive, so we agree in advance which units can be opened or modified. Non-destructive testing is used wherever it gives the same insight.
Do you retest after we fix the issues?
Yes. We retest updated firmware, apps and services and issue an updated report confirming which issues are closed.
Get started
Ship Secure Connected Products.
From Chip to Cloud.
Talk to our IoT security specialists about a scoped test of your devices, firmware, apps and cloud services.
- ISO/IEC 27001 and ISO 9001 certified
- 40+ enterprise and government clients
- 15+ countries