Hardware / IoT Pentesting

Hardware / IoT Pentesting

IoT devices are a growing target of our test and assessment services. Hardware, firmware and (cloud dwelling) backends are all targets for attackers and often not very well understood.

Secura can test all these aspects, and also apply reverse engineering and firmware hacking techniques to find out which weaknesses exist. Interesting to note in this context is that Secura is also active partner in the INTERSECT research consortium that includes all Dutch Technical Universities and many multinationals, and is focused on developing new technologies for testing and securing (Industrial) IoT devices.

In general it depends largely on the device what exact steps are taken in an IoT assessment. However if hardware is in scope we will identify interfaces such as serial, SPI, I2C, JTAG and others. We will attempt to identify all components and their weaknesses. For certain components Secura can perform ‘chip-off’ techniques by removing the component from the PCB and placing it in a specific test bed. This is usually done to extract memory contents from the component for later analysis.

If an IoT device has a companion app, we can perform a Mobile app assessment on that part, and if the IoT device has a web interface, we can perform a web application assessment on that. Normally, we require several hardware samples to be delivered, that can be destructively tested (i.e.: do not count on getting them back in 1 piece).

Also read: From mattresses to artificial hearts: why IoT security is crucial

I'd like to know more about Hardware / IoT Pentesting



Secura is a leading cybersecurity expert. Our customers range from government and healthcare to finance and industry worldwide. Secura offers technical services, such as vulnerability assessments, penetration testing and red teaming. We also provide certification for IoT and industrial environments, as well as audits, forensic services and awareness training. Our goal is to raise your cyber resilience.

Secura is a Bureau Veritas company. Bureau Veritas (BV) is a publicly listed company specialized in testing, inspection and certification. BV was founded in 1828, has over 80.000 employees and is active in 140 countries. Secura is the cornerstone of the cybersecurity strategy of Bureau Veritas.

Related Services

CLOUD Pentesting

Article image

A Cloud penetration test (or pentest) assesses the strong and weak points in cloud-based systems to improve the overall cloud security level.

Wi-Fi Pentesting

Article image

Wireless technology remains a weak spot in many infrastructures. A Wi-Fi penetration test, or pentest, will reveal wireless weak points, exploit the vulnerabilities and provide clear advice on how to mitigate the risks to an acceptable level.

Infrastructure Pentesting

Article image

External, internet visible IT systems are attacked daily. It is therefore often required to test these systems periodically or when significant changes are applied.

Industrial Vulnerability Assessment / Pentest

Article image

Within industrial environments, cybersecurity testing requires a specialized approach. This is mainly due to the different risks and threat models within Operational Technology (OT).