Penetration Testing/IoT & Embedded Device Testing

IoT & Embedded Device Penetration Testing

IoT and embedded device penetration testing from the circuit board to the cloud

Hands-on testing of your device hardware, firmware, wireless interfaces, companion apps and cloud back end. Every finding comes with a reproducible proof of concept and a fix your engineers can ship.

Debug ports, flash extraction and the boot chain
Firmware secrets, outdated components and update integrity
Bluetooth, Wi-Fi and other radio interfaces
Medical devices, gaming consoles, POS terminals and smart products

Scope my device test See a sample report Talk to an expert →

The credentials behind every engagement

2026 CyberSecurity Breakthrough Awards winner

Penetration Testing Solution of the Year2026 CyberSecurity Breakthrough Awards

Reviewed by Omair Manzoor, Founder & CEO, ioSENTRIX · Updated November 2026

Key terms: What is embedded device security? · What is IoT security? · What is reverse engineering?

Trusted by security teams at

See it in action

A few minutes alone with your device.

Locks, kiosks and dashboards ship to places you do not control. We open them up and prove what an attacker could do.

Bench · Unit 1 of 3Bench · Unit 2 of 3Bench · Unit 3 of 3

TeardownMapExploitProveReport

01Device under test

02Layers we test

03What a few minutes alone with it gives

Smart door lock

123456789*0#

BLE

Replaying a captured Bluetooth packetwrite 0x0025 7E 01 A4 C3 · UNLOCK

Self-service kiosk

ACME CLINIC

Welcome.
Tap to check in

Print my receipt

Print dialog > Open file...

C:\Windows\system32>

whoami

kiosk-01\kioskuser

KIOSK MODE ESCAPED

Vehicle infotainment unit

NOW PLAYING

Morning drive

UART console · 115200 baud

root@headunit:~# id

uid=0(root) gid=0(root)

root@headunit:~# ip link

can0: UP · vehicle gateway

HEAD UNIT BOARD

TXRXGND

01HardwareUART, JTAG · flash · USB

02Firmware and OSSecrets · kiosk lockdown · updates

03Wireless and busesBluetooth · Wi-Fi · CAN

04App and cloudCompanion app · device API

Wireless

A captured Bluetooth unlock is replayed. The door opens.

High

Firmware

The same unlock key sits in every lock's firmware.

Critical

ImpactOne lock in hand opens every lock in the fleet.

Operating system

A print dialog escapes kiosk mode to the desktop.

High

Hardware

A USB keyboard on the back port types commands.

High

ImpactA path to patient data and the clinic network behind the kiosk.

Hardware

UART pins on the board give a root shell.

High

Vehicle bus

From the head unit, the vehicle gateway is reachable.

Critical

ImpactA path from the dashboard toward vehicle systems.

Also tested: medical devices, POS terminals, gaming consoles, cameras and routers.

Mapped toOWASP IoT Top 10ETSI EN 303 645ISO/SAE 21434 for vehiclesFDA premarket guidance

Swipe to see the full exhibit →

Physical access changes everything

Debug ports, USB and radios give a way in that a network scan never sees.

One device, the whole fleet

A key or password shared across units turns one break-in into thousands.

Fixes your engineers can ship

Each finding has a proof of concept and a fix, and we retest the unit once it lands.

Read this exhibit as text

We test each device across four layers: hardware, firmware and operating system, wireless interfaces and buses, and the companion app and cloud.
Smart door lock: a captured Bluetooth unlock is replayed and the door opens. The same unlock key sits in every lock's firmware, so one lock in hand opens every lock in the fleet.
Self-service kiosk: a print dialog escapes kiosk mode to the desktop, and a USB keyboard on the back port types commands. That gives a path to patient data and the clinic network behind the kiosk.
Vehicle infotainment unit: UART pins on the board give a root shell, and from the head unit the vehicle network gateway is reachable.
We also test medical devices, POS terminals, gaming consoles, cameras and routers. Findings map to the OWASP IoT Top 10, ETSI EN 303 645 and, for vehicles, ISO/SAE 21434.

Source: ioSENTRIX device testing methodology; OWASP IoT Top 10. Illustrative findings on fictional products, not client data.

The short answer

What is IoT and embedded device penetration testing?

IoT and embedded device penetration testing is a hands-on security test of a connected product and everything it relies on: the circuit board, firmware, wireless interfaces, companion apps and cloud services. Testers try to extract secrets, run their own code or take control of the device, and prove each weakness with a reproducible proof of concept.

Embedded devices ship to places you do not control, so an attacker can open the case, read the flash and study the firmware at leisure. Hardware penetration testing covers that physical layer, which a web or network test leaves out, then follows the device's data to the apps and APIs it talks to.

At ioSENTRIX, IoT and embedded device penetration testing is carried out by hand by certified testers at a CREST-accredited firm, with findings mapped to the OWASP IoT Security Verification Standard (ISVS) and the OWASP Firmware Security Testing Methodology and a free retest of every fix.

You need a device pentest if

You build medical devices, gaming consoles, POS terminals or smart products
You are preparing an FDA premarket submission for a cyber device
A retailer, platform owner or enterprise customer asked for device test evidence
You changed hardware, firmware or update infrastructure since the last test

What we test

Four layers, tested by hand

Scope follows how your product is built. Most device tests cover these four areas.

Layer 1

Hardware

What an attacker can do with the device in hand.

UART, JTAG & SWD debug ports
Flash & EEPROM extraction
Boot chain & secure boot
Tamper resistance & physical hardening

Layer 2

Firmware

What the code on the device reveals and allows.

Firmware extraction & unpacking
Hardcoded credentials & keys
Outdated components with known vulnerabilities
Update signing & rollback protection

Layer 3

Wireless & local interfaces

How the device talks to the world around it.

Bluetooth Low Energy pairing & services
Wi-Fi & local network services
USB & serial interfaces
Other radio protocols in scope

Layer 4

Apps & cloud

The ecosystem around the device, tested like any other attack surface.

Companion mobile & desktop apps
Device-to-cloud authentication
Fleet management & provisioning APIs
Cross-device & cross-account access

Methodology

How we test: example test cases

A sample of the manual test cases in a typical device penetration test, labeled by OWASP IoT Top 10 category. Your scope decides the full list.

Hardcoded and default credentials

We extract the firmware and search it for default, shared or hardcoded passwords, keys and certificates, then test whether they work on other units.

Exposed network services

We list every service the device listens on, including debug and maintenance services left enabled in production builds.

Cloud and companion app interfaces

Signed in as one owner, we try to read data from or control another owner's device through the mobile app and cloud APIs.

Firmware update integrity

We build a modified firmware image and test whether the device accepts it, including by rolling back to an older signed version.

Data at rest and in transit

We read stored data from flash and capture traffic to check whether patient, payment or user data is encrypted and keys are protected.

I10

Physical interfaces

We locate debug pins and test whether a console or bootloader on UART, JTAG or SWD gives access to the running system.

Sample finding

What a finding looks like in our report

An illustrative example in our report format. Not client data.

Finding 01 · IllustrativeCritical

Root shell on the UART header exposes a fleet-wide cloud API key

OWASP IoT I1 Weak, Guessable, or Hardcoded Passwords · I10 Lack of Physical Hardening

What we found

The production board left a UART header active. Connecting to it gave a root shell without a password. The firmware stored one API key that every unit used to authenticate to the cloud service, and that key could read telemetry from, and send commands to, any device.

Impact

Anyone with one device and brief physical access can read data from, and send commands to, every device in the fleet.

How to fix it

Disable or lock debug interfaces in production builds. Give each device its own credential, provisioned at manufacture and kept in secure hardware where available, and limit its cloud access to that one device.

What you get

What you get from every device pentest

Not a scan of an IP address. Proven attacks on the hardware, firmware and ecosystem, with fixes your engineers can act on.

Findings with proof, ranked by exploitability

Each finding has a severity, a reproducible proof of concept and remediation guidance, from the circuit board to the cloud API.

A report built for regulators and customers

The report records scope, duration, methods, tester independence and expertise, and results: the elements FDA's premarket cybersecurity guidance asks a penetration test report to include.

Walkthrough, then retesting

The tester who found each issue walks your engineers through it, and retesting is available once fixes land.

ioSENTRIX sample penetration test report cover

See how we write findings before you talk to us

A redacted sample penetration test report (web application): finding write-ups, proof-of-concept evidence and remediation. No form required.

Download the sample report (PDF) →

Devices we test

Smart lock, kiosk, automotive and medical device penetration testing

The same four layers, tested on the products you actually ship.

Smart locks

Smart lock and door lock penetration testing

We test how a lock decides to open: the Bluetooth or Wi-Fi unlock flow, the keypad, the companion app and the cloud that issues keys.

Bluetooth replay and relay
Pairing and key sharing
Keys shared across the fleet
Firmware and debug ports

Kiosks

Kiosk security testing and kiosk breakout

Self-service, check-in and retail kiosks, tested from the front of the screen and from the ports behind it.

Escape from kiosk mode
USB and keyboard injection
Stored credentials
What the kiosk can reach

Vehicles

Automotive and infotainment penetration testing

Head units and telematics units, from the circuit board to the apps and services they connect to.

UART, JTAG and USB
Bluetooth and Wi-Fi
Firmware and update signing
Path toward the vehicle network

Medical

Medical device penetration testing

Connected medical devices tested for FDA premarket cybersecurity submissions and for hospital buyers.

Hardware and firmware
Wireless and local interfaces
Companion apps and cloud
Report built for FDA review

Payments

POS terminal security testing

Payment terminals and mobile POS devices, tested for tamper paths and how card data moves.

Debug and service interfaces
Firmware and secrets
Network and cloud services
Physical tamper paths

Consoles

Gaming console and hardware security testing

Consoles and accessories tested against the threats that matter to them, such as cheating and piracy.

Boot chain and secure boot
Firmware extraction
Anti-tamper controls
Online service APIs

Smart home

IP camera, router and smart home testing

Cameras, routers, hubs and other connected products that sit on customer networks.

Default and shared passwords
Exposed network services
Update integrity
Cloud and app access

Firmware

Firmware security testing

Firmware pulled from flash or update files and analyzed for what it reveals and allows.

Hardcoded keys and passwords
Outdated components
Update and rollback protection
Memory-safety flaws

Device testing questions

Do you penetration test smart door locks?

Yes. We test the lock itself, its Bluetooth or Wi-Fi unlock flow, the companion app and the cloud service that issues keys. That includes replay and relay attacks on the unlock, how keys are shared and revoked, and whether one unit's firmware exposes keys used across the fleet.

What is a kiosk breakout test?

A kiosk breakout test checks whether someone standing at a self-service kiosk can escape the locked-down app to the operating system, for example through a print or file dialog, a gesture or a keyboard plugged into a USB port, and what they can reach on your network from there.

Do you test vehicle infotainment and automotive systems?

Yes. We test head units and telematics units across hardware debug ports, firmware, USB, Bluetooth, Wi-Fi and companion apps, and check whether a compromised head unit can reach the vehicle network. Findings can be mapped to ISO/SAE 21434.

Verified reviews

What security leaders say about working with us

★★★★★

“Unlike other providers, Omair and his team truly dive deep into our infrastructure, delivering findings that go well beyond the surface level. Communication is direct and seamless.”

Jesus B.

Cybersecurity Manager, Banking

Verified G2 review ↗

★★★★★

“We were impressed with ioSENTRIX’s ability to independently validate the security of our customer-facing product.”

Zeehasham R.

Data Scientist, Security Operations · Fortune 500 insurer

Verified Clutch review ↗

★★★★★

“The team at ioSENTRIX is professional and highly skilled at their craft.”

Awwab A.

SVP, Chief Information Security Officer

Verified G2 review ↗

How it works

How a device penetration test works

Four steps, so you know what happens and what you get.

Scope and threat model

We review the device architecture, interfaces, data flows and cloud services, and agree what is in scope.

Start

Hands-on testing

Testers attack the hardware, firmware, radio interfaces, apps and cloud APIs, mapped to the OWASP IoT Top 10.

Most of the engagement

Report

Each finding has a severity, a reproducible proof of concept and remediation guidance.

At close

Remediation support

We walk your engineers through the findings, and retesting is available once fixes land.

After fixes

Reply in under an hour → scoping call → fixed quote in writing → testing, by scope → report, walkthrough and retest

How we compare

Not a network scan of the device. Not an app test that ignores the hardware.

What a device pentest covers compared with the usual alternatives.

ioSENTRIX device pentest

Automated firmware scanner

Network or app pentest only

What is tested

Hardware, firmware, radio, apps and cloud

The firmware image only

The network or app interface only

Physical attacks

Debug ports, flash and boot chain tested by hand

Not tested

Update integrity

Modified and rolled-back images tested on the device

Static checks only

Not tested

Evidence

Reproducible proof of concept and a fix

Findings to triage

Finding list

Standards

OWASP IoT Top 10, OWASP FSTM, FDA premarket guidance

Varies by tool

OWASP Top 10 (web)

Scope my device test

Scope and price

What affects the scope and price of a device pentest

Device tests are priced on effort. These are the decisions that move the quote.

What moves the quote

01How many device models, firmware versions and interfaces are in scope
02Whether hardware attacks such as flash extraction are needed
03The radio protocols in scope
04Whether companion apps and cloud APIs are tested in the same engagement
05Black-box testing, or access to schematics, firmware source and design notes
06Regulatory evidence you need, such as for an FDA premarket submission

Read: Penetration Testing Cost & Pricing in 2026: What a Pentest Really Costs →

What we need from you to start

Several production-equivalent units, since hardware testing can damage a device
Firmware images and update packages, if you can share them
Test accounts for the companion apps and cloud services
Architecture notes: interfaces, protocols and cloud services
A technical contact for questions during testing

Scope my device test

Case studies

Engagements we have run

Anonymized examples of ioSENTRIX engagements. Clients are described by industry, not named.

Hospitality

Room automation system penetration test

A hotel room automation system controlled from Android tablets, where testing found weaknesses in network segmentation and password policy.

Read the case study →

Track record

Numbers you can check

Ratings you can verify on G2 and Clutch.

4.9 / 5

on G2 from 12 verified reviews

5.0 / 5

on Clutch, Premier Verified

2017

founded; CREST-accredited, ISO 27001 certified, SOC 2 Type 2 attested

Independently verified

Credentials held by the firm

Every engagement runs inside a company whose methods and own security are checked by outside bodies.

CREST-accredited for penetration testing

CREST assesses the firm's testing methodology, quality assurance and handling of client data.

View our CREST listing →

SOC 2 Type 2 attested

An independent auditor tested our own security controls over time.

Request the SOC 2 report →

ISO/IEC 27001 certified

Our information security management system is certified to ISO/IEC 27001.

View in our trust center →

Recognized independently

Penetration Testing Solution of the Year, 2026 CyberSecurity Breakthrough Awards. G2 High Performer, Fall 2026.

Award announcement →See our G2 reviews →

Founded in 2017.

Our commitments

What you can count on

Four promises we make on every testing engagement.

Free retest of every fixOnce your team fixes a finding, we test it again at no extra cost and update the report.
A fixed priceThe quote you sign is what you pay. The price only changes if you change the scope.
A report your auditor acceptsIf your auditor has questions about the report, we answer them and update it until it is accepted.
A reply in under an hourSend the form and we reply within an hour during US business hours.

Get a scoped quote

For your buying team

Everything your reviewers will ask for

Security, finance and procurement each need something different. Forward this page, or pull what each reviewer needs.

For security

Sample report

See exactly what you get: findings, proof of concept, fixes and retest results.

Download the sample report (PDF) →

For vendor risk

Trust center

Our SOC 2 Type 2 report and security documentation for your vendor review.

Open the trust center →

For procurement

Procurement pack

Master services agreement, sample statement of work, certificate of insurance and W-9.

Request the procurement pack →

For your team

Share this page

Send the link to the people who need to sign off.

Who you work with

Who does the work

Senior security engineers do the hands-on work and write up the results, so the person who found an issue explains it to your team.

Certified engineers

Each engineer holds one or more of OSCP, OSWE, OSCE, CISSP, CISA or AWS security certifications.

Accredited firm

ioSENTRIX is CREST-accredited for penetration testing, ISO/IEC 27001 certified and SOC 2 Type 2 attested.

Since 2017

Founded in 2017, with security work for Fortune 100, financial services, insurance and SaaS companies.

Ready to see what your device gives away with the case open?

We reply in under an hour · no sales pitch

Scope my device test

Standards

Frameworks we test and map to

◆OWASP IoT Top 10 (2018)◆OWASP Firmware Security Testing Methodology (FSTM)◆OWASP IoT Security Verification Standard (ISVS)◆FDA premarket cybersecurity guidance (FD&C Act section 524B)◆IEC 62443-4-2◆NIST SP 800-115

FAQ

Frequently asked questions

Do you test medical devices for FDA submissions?

Yes. FDA's premarket cybersecurity guidance recommends penetration testing for medical devices, and asks that reports state the testers' independence and expertise, the scope, duration and methods, and the results. Our reports include those elements. Read our guide to FDA cybersecurity compliance.

Do you test gaming consoles and POS terminals?

Yes. Gaming consoles, POS terminals, medical devices and smart products share the same layers: hardware, firmware, interfaces and back-end services. We focus the test on the threats that matter for each, such as cheating and piracy on consoles or card data on POS terminals.

Will testing damage our devices?

Some hardware techniques, such as removing a flash chip, can leave a unit unusable. That is why we ask for several production-equivalent units and agree in advance which techniques are allowed on which units.

Do you test the companion app and cloud as well?

Yes, when they are in scope. Many serious device findings sit in the cloud APIs and companion apps. See our mobile app penetration testing and cloud penetration testing.

How long does a device penetration test take?

Most device tests run days to weeks, depending on the number of models, interfaces and ecosystem components in scope. Plan for shipping test units too. We reply in under an hour during US business hours, and the scope, timeline and fixed quote follow the scoping call.

Resources

Go deeper before you scope a test

Practical guides from our testers on the questions buyers ask most.

Guide · 8 min read

IoT & Embedded Device Penetration Testing: A Practical Overview

Learn how IoT penetration testing works and how experts uncover security weaknesses across hardware, firmware, networks, wireless interfaces, APIs…

Read the guide →

Guide · 7 min read

Comprehensive Gaming Hardware Security & Penetration Testing

Discover how advanced pentesting protects gaming consoles against firmware, hardware, and network vulnerabilities. Learn why security is necessary…

Read the guide →

Guide · 6 min read

Understanding Medical Device Security Audit

This blog post highlights the important steps for conducting a thorough assessment and testing of cybersecurity risks in medical devices.

Read the guide →

Keep exploring

Related services

HubAll penetration testing services ServiceICS, OT & IIoT penetration testing ServiceMobile app penetration testing ServiceWeb application and API penetration testing ServiceCloud penetration testing SolutionFDA 510(k) cybersecurity

Ready when you are

Test your device before an attacker opens the case

Tell us what you build and where it ships. We will scope a test and send a fixed quote based on effort.

We reply in under an hour · Fixed quote in writing before work starts · Your details are never shared