Skip to content

IoT & hardware penetration testing

An IoT and hardware penetration test checks whether your connected product can be misused to reach user data, take over devices or attack the backend. Mr Cyber tests the device and its electronics, the firmware, the companion app and the cloud services together, with ETSI EN 303 645 and OWASP ISVS as checklists, at a fixed price, with a free retest.

Fixed price from €4,700 · 5 test days · retest included

See my fixed price

Prefer to talk first? Book a call

Parcel box Debug port open Companion app Open box
Parcel box, circuit board and app: an open debug port lets anyone with a cable read the board.
  • 5–10 test days5 test days in the starting price
  • ETSI EN 303 645+ 4 more standards
  • Report + debriefwithin 5 business days
  • Free retestwithin 60 days

Who it’s for

  • Manufacturers preparing for the EU Cyber Resilience Act
  • Makers of radio equipment covered by the RED cybersecurity requirements (EN 18031)
  • Smart home, building, medical and industrial device makers
  • Companies whose retail or enterprise customers ask for a security test before rollout

What we test

Device & electronics

  • Debug and service interfaces left open
  • Protection of firmware and keys stored on the device
  • Tamper protection and behaviour when opened

Firmware & updates

  • Secure boot and firmware signing
  • Update process and protection against downgrades
  • Default passwords and local services

Interfaces & radio

  • Network services on the device
  • Bluetooth and other radio interfaces
  • Pairing and onboarding

Companion app

  • Data stored by the app
  • Login and device control from the app

Cloud & backend

  • Device and user authentication
  • Separation between customers and devices
  • APIs used by the device and the app

Lifecycle & data

  • Reset and decommissioning
  • Handling of personal data
See my fixed price

Prefer to talk first? Book a call

Also covered. In the same test, or as an engagement of its own.

Hardware & embedded firmware

A deeper look at the electronics for products that hold keys, licences or personal data on the device. We check what someone with physical access could read or change: debug ports, firmware storage, secure boot and tamper protection. Best done before mass production or a new hardware revision.

No surcharge Add to my request

Automotive components

ECUs, telematics units, infotainment and charging systems, tested on a bench setup or in the vehicle by arrangement. The results are structured for your ISO/SAE 21434 work products and for OEM customers with UN R155 and R156 duties, and support TISAX evidence on secure development. Type approval is granted to the vehicle maker, not by us. Quoted per project.

Separate engagement, price on request Add to my request

No extra fee for the topic itself. If it needs more test days, the quote shows them upfront.

How we test your device. Five phases, one tester.

The same senior tester from first scope to retest.

test days in the starting price
5
business days to the report
5
days for the free retest
60

Typically 5–10 testing days, depending on device, app and cloud components in scope.

  1. Phase 1

    Scope & start date

    Price and start date online, or a call. NDA, signed scope and written authorisation come before any testing.

    You pick the date

  2. Phase 2

    Device & firmware analysis

    Hardware interfaces, firmware and companion app examined.

    Test day 1

  3. Phase 3

    Device + cloud testing

    Device, app and cloud backend tested together.

    From test day 2

  4. Phase 4

    Report & debrief

    Audit-ready report and ticket file, then a call.

    Within 5 business days

  5. Phase 5

    Free retest

    Your fixes tested again and confirmed in writing.

    Within 60 days

Methodology & standards

  • ETSI EN 303 645
  • OWASP ISVS
  • OWASP FSTM
  • OWASP IoT Top 10
  • CVSS 3.1

How we test connected products

We look at your product as a customer gets it: the device, the app and the cloud behind them. We map how the parts talk to each other and what each part trusts, then test each one by hand, with ETSI EN 303 645 and the OWASP IoT Security Verification Standard as checklists.

End to end

Many serious IoT findings sit between the parts, for example a cloud API that trusts any device. Testing everything together finds them.

Agreed depth for hardware

Before the start we agree how far the hardware analysis goes and which steps may damage a unit.

Critical findings don’t wait for the report

If we find something critical, such as access to other customers’ devices, you hear from us the same day.

Evidence for regulation

Findings are mapped to ETSI EN 303 645, which supports your work for the Cyber Resilience Act and the RED requirements.

What you get

  • Executive summary for management, product owners and auditors
  • Every finding with evidence, photos where useful, and fix guidance
  • Findings mapped to ETSI EN 303 645 provisions
  • CVSS 3.1 scoring plus business-risk rating and remediation priorities
  • Debrief call with your hardware, firmware and backend teams
  • Free retest and updated report

Always included

  • Free retest within 60 days
  • Debrief call with your team
  • NDA, DPA and testing authorisation with the offer
  • Critical findings reported the same day
  • Testing stops at any time on your call
  • Audit-ready report (PDF)
  • Ready-to-import tickets for Jira, ServiceNow, GitLab, Azure DevOps and GitHub
  • Email import for helpdesks like OTRS/Znuny, Zammad, TOPdesk and Matrix42
See my fixed price See the report
Pentest report · Admin & Söhne GmbH · MC-2026-020
Risk: Medium CVSS 3.1 · 5.3 Open · retest included

Bluetooth unlock signal of the parcel box can be recorded and replayed

Admin & Söhne smart parcel box · firmware, Bluetooth unlock

CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N

Description

Admin & Söhne sells a smart parcel box that customers unlock with the app over Bluetooth. The unlock message is the same every time: it contains no counter or changing code. Someone standing nearby while the owner opens the box can record this message and send it again later to open the box without the app.

Steps to reproduce

  1. Pair test box A with a test account and unlock it once from the app.
  2. Record the Bluetooth unlock message from a few metres away.
  3. Later, with the app closed, send the recorded message again: box A unlocks.
Unlock message, 1st use:  0x5A 0x01 … 0x7C   (redacted)
Unlock message, 2nd use:  0x5A 0x01 … 0x7C   (identical)
Replay after 24 h → box state "unlocked"

Business impact

A thief who stands nearby once can empty the box later. Missing replay protection is exactly what EN 18031 checks, so it can block CE marking and force an update or a recall of every box sold.

Remediation

Add a challenge-response step: the box sends a fresh random value, and the app must answer with a signed reply that is valid only once. Ship the fix as a firmware update and log unlock attempts with old or repeated messages.

OWASP IoT Top 10 2018: I3 Insecure Ecosystem Interfaces · CWE-294 (Authentication Bypass by Capture-replay) · EN 18031-1

Fixed price from

€4,700

5 test days · report in 5 business days · retest included

Services exclusively for businesses. · What drives the price

See my fixed price

Prefer to talk first? Book a call

Frequently asked questions

How much does an IoT and hardware penetration test cost?
Fixed prices start at €4,700 for one device with its app and backend at a basic scope. More device variants, deeper hardware analysis or several backends add effort. The quote form shows your binding fixed price instantly, and the written offer (PDF) is sent to you by email right after your request.
What do you need from us?
Two or three devices of the current version, the companion app, test accounts, access to a test backend, and firmware and documentation if available. One device may be opened during hardware analysis, so please plan a spare.
Does the test certify our product for the CRA or RED?
No. We do not certify products. The report gives you evidence for your own conformity assessment and for a notified body or test lab, if you need one.
Where does the test take place?
Device and hardware work happens in our lab. You send us the units, and we return or dispose of them as agreed. App and cloud parts are tested remotely.

Related services

NIS2 & Compliance

IoT & hardware pentest: your fixed price in seconds

Pick one to start your request. You get your binding fixed price instantly, and the written offer (PDF) by email right after your request.

See my fixed price

Prefer to talk first? Book a call