Overview
Since April 2024, the UK Product Security and Telecommunications Infrastructure (PSTI) regime has required consumer connectable products to meet baseline security requirements, such as banning default passwords. Our testing helps manufacturers, importers and distributors find weaknesses before products reach UK shelves.
Smart devices — from building management systems and medical devices to cameras, wearables and industrial sensors — are increasingly connected to corporate networks and the internet. Many ship with debug ports left open, outdated firmware, hard-coded credentials and weak update mechanisms.
Our IoT penetration tests examine the full ecosystem: hardware interfaces such as UART and JTAG, firmware extraction and analysis, radio protocols, local network services, the mobile companion app and the cloud APIs that manage the device.
Whether you build devices or deploy them, we identify how an attacker could compromise a single device, a fleet or the network it sits on.
How testing works for UK organisations
- Signed scope and written authorisation before any testing, in line with the Computer Misuse Act 1990
- Testing windows agreed in UK time, including out-of-hours windows for production systems
- Fully remote delivery, with internal and wireless access via VPN or a posted test device, so there are no travel costs
- Reports mapped to ISO 27001, PCI DSS, UK GDPR Article 32 and customer questionnaires, with a fixed price in GBP
What's included
Our approach
- ModelUnderstand device architecture and trust boundaries.
- HardwareInspect interfaces and extract firmware.
- AnalyseFirmware, radio and service analysis.
- EcosystemTest apps, APIs and cloud management.
- ReportFindings with engineering-level fixes.
What you receive
- Device threat model
- Hardware and firmware findings
- Radio and app findings
- Cloud/API findings
- Remediation guidance and retest
Standards & frameworks
- OWASP IoT Top 10
- ETSI EN 303 645 / UK PSTI regime
- NIST IR 8259
- IEC 62443 (industrial)
- OWASP MASVS (apps)
- NCSC penetration testing guidance
Frequently asked questions
Do you need physical devices?
Yes, typically two or more units, as hardware testing can be invasive.
Can you test medical or industrial devices?
Yes, with appropriate safety controls and coordination with your engineering teams.
Do you help with IoT security regulations?
Our reports map findings to standards such as ETSI EN 303 645, which underpins several consumer IoT regulations.
Are you CREST or CHECK accredited?
We don't claim CREST or NCSC CHECK status on this site. Most private-sector tests, including those for ISO 27001, PCI DSS and customer due diligence, don't require either. If a contract, public-sector buyer or regulator specifically requires a CHECK or CREST-accredited provider, tell us at scoping and we'll tell you honestly whether we can meet it. See our CREST and CHECK guide.
Do you quote in pounds sterling?
Yes. UK proposals are fixed-price and quoted in GBP. Prices exclude VAT where VAT applies to cross-border services. We confirm the treatment for your organisation in the proposal.