Hardware and IoT Penetration Testing
A hardware penetration test covers firmware, debug interfaces and physical access of embedded devices; retesting of remediated findings is included.
What is tested and why it matters
From physical inspection to firmware analysis, below the software layer.
Embedded devices operate in environments where software patching is difficult, firmware updates are infrequent, and physical access by untrusted parties is often possible. Debug interfaces left enabled after manufacturing, firmware stored without integrity protections, and weak bootloader configurations create attack vectors that traditional network or application security testing does not cover. A hardware security assessment examines the device from the physical layer up, identifying vulnerabilities that would allow an attacker to extract firmware, bypass secure boot, intercept communications, or gain persistent control of the device.
Who needs this assessment
Organisations that manufacture, deploy, or rely on embedded devices.
This assessment is designed for organisations where embedded hardware controls physical access, industrial processes, or sensitive data, and a compromise at the device level could affect the wider infrastructure.
Manufacturers of embedded devices, IoT products, or industrial controllers
Organisations deploying smart locks, gate controllers, or physical access systems
Companies operating industrial control systems (ICS) or SCADA equipment
Supply chain security teams validating third-party hardware components
Organisations in regulated sectors requiring hardware security validation
Organisations in regulated sectors (energy, healthcare, critical infrastructure) requiring hardware security validation as part of NIS2 or sector compliance obligations
Where these assessments are relevant
- Financial services: customer portals, payment processing, and cloud-hosted transaction infrastructure.
- SaaS and technology: application validation before production deployment or enterprise procurement.
- Healthcare: digital systems handling patient data, clinical records, and connected medical devices.
- Retail and e-commerce: web applications processing transactions, customer accounts, and payment data.
What the assessment produces
The insight and evidence delivered at the conclusion of the assessment.
Every assessment concludes with a structured report covering physical and logical findings, severity ratings, evidence, and remediation guidance. Reports are delivered through the Pentrox Portal and are available for download at any time.
- Identification of firmware extraction vectors and integrity protection gaps
- Documented debug interface exposure (JTAG, SWD, UART, USB) with exploitation evidence
- Validation of secure boot, bootloader locking, and firmware signing mechanisms
- Remediation guidance for both the current device revision and future manufacturing processes
- Portal access with real-time findings, retest workflow, and report downloads for the lifetime of the client account
How an assessment runs
- Scope and Intake
- Planning
- Assessment
- Reporting
- Findings & Retest
Retesting of remediated findings is included as standard with every assessment.
Assessment methodology
Five phases from physical inspection through verified remediation.
Each phase builds on the previous one. Physical inspection identifies interfaces, firmware extraction enables static analysis, and communication testing validates the device behaviour under attack conditions.
Physical inspection and interface enumeration
The device is inspected for debug headers and test points. JTAG, SWD, UART, and USB interfaces are enumerated and PCB layout is analysed for unlabelled pins.
OWASP IoT Top 10 (I1: Insecure Network Services), PTES (Physical Security)Firmware extraction and analysis
Firmware is extracted via JTAG, SPI flash, or update mechanisms. The image is analysed for hardcoded credentials, debug flags, weak encryption, and known CVEs.
OWASP IoT Top 10 (I5: Insecure Update Mechanism), NIST SP 800-183 (Firmware Integrity)Secure boot and bootloader assessment
The boot process is examined for secure boot enforcement and bypass paths. Firmware signing and integrity checks verify whether modified firmware can be loaded.
NIST SP 800-183 (Boot Integrity), OWASP IoT Top 10 (I5)Side-channel and communication analysis
Network traffic is captured with Bettercap and Wireshark to identify cleartext and weak TLS. Wireless protocols (Bluetooth, Zigbee) are tested where applicable.
OWASP IoT Top 10 (I7: Insecure Data Transfer), PTES (Communications Security)Reporting and quality review
Each vulnerability is documented with the attack path, evidence, and remediation. Recommendations cover the current device revision and future manufacturing hardening.
OWASP Risk Rating Methodology (severity rating), PTES (Reporting)Scope and deliverables
What is included, what is excluded, and what is delivered.
The statement of work defines the exact device models, firmware versions, and testing approach before the assessment begins. The lists below reflect the standard scope for a hardware security assessment.
In scope
- Physical inspection and debug interface enumeration (JTAG, SWD, UART, USB)
- Firmware extraction and static analysis
- Bootloader and secure boot bypass testing
- OS lockdown and BIOS/UEFI hardening review
- Network traffic capture and man-in-the-middle scenarios
- Side-channel analysis (timing, power) where applicable
- Supply chain validation and component authentication
- Wireless protocol assessment (Bluetooth, Zigbee) where applicable
Out of scope
- Destructive testing that renders the device permanently inoperable (unless explicitly agreed)
- Full chip decapsulation or electron microscopy analysis
- Testing of backend cloud infrastructure (covered under Cloud Security Review)
- Testing of companion mobile applications (covered under Mobile Application Security)
What you receive
- Executive summary Severity distribution, device security posture overview, and remediation priorities written for leadership.
- Detailed findings Each vulnerability documented with physical or logical attack path, evidence, OWASP risk rating, and remediation guidance.
- Technical conclusion Firmware integrity gaps, boot chain weaknesses, and structural recommendations for secure hardware lifecycle.
- Scope and strategy description Goals, test approach, and scope boundaries for audit traceability.
- Portal access Real-time findings, report downloads, retest workflow, and team management through a dedicated platform.
- Findings meeting A scheduled session to align on risks, priorities, and the remediation approach.
- Retest report Verification results after remediation, documenting each finding with its updated status.
Read more
Wireless network assessment in 2026
WPA3, Wi-Fi 6E and 6 GHz, and the findings that still matter.
What to expect during your first penetration test
The five stages from scoping to retest and what each asks of your team.
Broken access control on a smart pool controller
A field note from a real IoT assessment: how any account could drive another owner's heat pump, and the controls that close it.
When independent assessment is the right step
An independent assessment is required ahead of an audit, a product launch, or a funding round, and the organisation needs documented evidence from a third party.
Digital platforms handle revenue, customer data, or service delivery, and the security of those platforms has not been validated by an external party.
Existing security controls have been implemented but have not been tested from an attacker perspective to confirm they work as intended.
Timeline
Illustrative durations to support planning. Confirmed in the statement of work.
The duration of a hardware security assessment depends on the complexity of the device, the number of interfaces, and whether firmware source code is provided. The calibration bands below are indicative. Exact duration is confirmed in the statement of work.
What determines duration
- Complexity of the device and number of exposed interfaces
- Whether firmware source code is provided (white box) or only the physical device (black box)
- Presence and maturity of secure boot, firmware signing, and integrity verification
- Number of wireless protocols to assess (Bluetooth, Zigbee, or similar)
- Whether side-channel analysis (timing, power) is included in scope
Actual duration is confirmed during scoping and depends on device complexity and interface count. A statement of work confirms the exact scope and timeline before the assessment begins. The final report is delivered within five business days after completion of testing.
Why Pentrox
The operational standards behind every hardware security assessment.
These operational standards apply to every hardware security assessment Pentrox delivers, regardless of device type or complexity.
Physical and logical attack paths
Both layers of the hardware attack surface, assessed together.
Physical inspection is combined with firmware analysis and communication testing. Vulnerabilities at the intersection of physical access and software weakness are identified.
Firmware extraction and reverse engineering
The same techniques used in targeted hardware attacks.
Firmware is extracted through debug interfaces or flash storage and analysed for hardcoded credentials, weak encryption, debug flags, and known CVEs.
Secure boot and supply chain validation
Trust anchored at the boot process, validated from the ground up.
The boot chain is tested for bypass vulnerabilities. Component authentication is verified. Findings feed directly into secure manufacturing recommendations.
Direct access to the tester
No account managers between the client and the security expert.
Critical or blocking findings are escalated immediately through the channel agreed at kickoff. Remediation can begin before the final report is delivered.
Portal-delivered results
Findings visible in real time through the Pentrox Portal.
The Pentrox Portal provides remediation tracking, retest requests, report downloads, and team access management. Two-factor authentication and role-based access control are enforced on every account.
Frequently asked questions
Practical answers for security teams and procurement officers.
Which standards does this assessment follow?
The assessment is informed by the OWASP IoT Top 10, PTES, and NIST SP 800-183. The specific framework emphasis is adapted to the device type during scoping.
Is retesting included, and at what cost?
Retesting of remediated findings is included as standard with every assessment. There are no additional charges. For hardware, retesting typically requires a revised device or firmware revision to be provided for verification.
What clearances do the testers hold?
All Pentrox employees undergo PES (Personnel Screening) background checks upon commencement of employment. Team members hold one or more industry-standard certifications such as OSCP, OSCE, OSWE, eWPTX, eMAPT, CPTS, CWES and BSCP. Every assessment is performed or supervised by senior penetration testers.
Is the device returned after testing?
All testing is non-destructive unless destructive procedures are explicitly agreed in the statement of work. The device is returned to the client after testing. If additional units are needed for parallel testing, this is discussed during scoping.
Can findings be applied to future manufacturing revisions?
The report includes recommendations that address both the current device revision and future manufacturing processes. Findings related to debug interface exposure, firmware signing, and bootloader configuration are documented with specific guidance for production hardening.
Is reporting available in Dutch?
Reports are delivered in English by default. Dutch-language reporting can be arranged when required. The statement of work confirms the reporting language before the assessment begins.
How is assessment data handled and who has access to findings?
Findings, reports, and project data are stored in the Pentrox Portal, hosted on a dedicated VPS in a datacenter in the European Union. Access is controlled through mandatory two-factor authentication and role-based permissions. The client manages team membership. Data remains accessible for the lifetime of the client account and is removed only on explicit request.
What happens when a critical vulnerability is found during testing?
Critical or blocking vulnerabilities are communicated immediately through the channel agreed at kickoff. Findings are published in the Pentrox Portal as they are confirmed, so remediation can begin before the final report is delivered. The escalation path is documented in the statement of work.
Related assessment categories
Compliance and Standards
ISO 27001, NIS2, PCI-DSS, and DigiD assessments against a defined control framework.
Advanced Testing
Scenario-based assessments, red team exercises, mystery guest, and phishing simulations.
Pentest as a Service (PTaaS)
A continuous subscription covering recurring assessments across an agreed annual day allocation.