Overview
Indian device makers are building smart meters, CCTV systems, payment terminals, wearables and connected medical equipment, often on shared reference designs. A weakness in common firmware can sit inside every unit you ship. We test the hardware, firmware, radio links, companion app and cloud back end together, working on samples you courier to us, and report findings that your engineers and component suppliers can act on.
An IoT product is a full system scattered across a device, its radios, a mobile or web application, and a cloud backend, and an attacker can start from whichever is weakest. We test the whole picture, beginning with the device itself, because an adversary who holds the hardware can probe it in ways no network attacker can, and because flaws found there often affect every unit you have shipped.
On the hardware we look for exposed debug and serial interfaces, accessible storage, and the chance to read or modify firmware directly. Extracted firmware is analysed for hard-coded credentials, keys and certificates, insecure update mechanisms, and vulnerable components. We then test the radios and protocols the device speaks, how it pairs and authenticates, and whether its traffic can be intercepted or spoofed, before carrying the assessment through to the companion application and the cloud APIs that the device trusts.
The findings are framed by what an attacker gains and how widely it applies. A key extracted from one device that unlocks the fleet is a very different problem from a local-only weakness, and we make that distinction clear. Each issue is scored with CVSS v4.0 and paired with a fix at the right layer, secure boot and storage, signed updates, stronger protocol authentication, or backend changes, so your hardware and platform teams each know their part.
How we work with Indian clients
- Fixed-price proposals in INR, with 18% GST shown separately on every invoice
- Remote-first delivery from Ahmedabad in IST working hours; on-site work can be discussed at scoping
- Signed authorisation, an NDA on request and agreed testing windows before any activity begins
- Reports and closure evidence shaped for RBI, SEBI CSCRF, IRDAI, DPDP, ISO 27001 and PCI DSS reviews
What's included
Our approach
- Device intakeWe take sample units, documentation and any companion app and credentials.
- Hardware analysisWe examine interfaces and attempt to access storage and firmware.
- Firmware reviewExtracted firmware is analysed for secrets, update flaws and components.
- Protocol & cloudWe test radios, protocols, the companion app and the backend APIs.
- Report & debriefFindings are framed by fleet impact, scored and explained by layer.
What you receive
- Findings across hardware, firmware, protocol and cloud
- Firmware analysis with extracted secrets where present
- Assessment of fleet-wide versus local-only impact
- CVSS v4.0 scores and layer-specific remediation
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- OWASP IoT Top 10
- PTES
- NIST SP 800-115
- OWASP MASVS
- OWASP API Security Top 10
- CVSS v4.0
- CERT-In Directions 2022
- RBI IT Governance Direction 2023
Frequently asked questions
How many devices do you need?
Usually two or three identical units. Hardware testing can alter or damage a device, so we need spares to continue after invasive work, and having more than one lets us compare behaviour and confirm that a finding applies across the product, not just one sample.
Do you keep or destroy our devices afterwards?
We return or securely destroy them as you prefer, and we never retain extracted firmware or secrets beyond the engagement. Devices we have opened or modified are clearly marked so they are not mistaken for production stock.
Is the cloud backend included?
The backend a device trusts is central to its security, so companion-app and cloud-API testing are part of a meaningful IoT engagement. A very large, unrelated platform may be scoped separately as an API test, which we confirm with you up front.
Can internal and Active Directory testing be done without a site visit?
Usually, yes. We connect through a VPN you provide or a small preconfigured device that your team plugs in at the office. On-site work can be discussed at scoping where a network needs it.
Will you look at our CERT-In log and time-sync settings?
When infrastructure is in scope, we note whether logs appear to be kept for the 180 days the 2022 CERT-In Directions require and whether systems sync time with NIC or NPL servers. Treat this as a technical observation, not a legal opinion.