IoT and Connected Device Penetration Testing

Yes, at least two so one can be dismantled. We agree that during scoping.

Yes, and the report maps findings to its provisions alongside the PSTI requirements.

Hardware testing is destructive to at least one unit. We tell you which before we start.

Yes. Industrial and OT devices follow the same method with different protocols, and the safety constraints are agreed first.

We provide the evidence and the findings. The statement of compliance is yours to make, and we tell you what is missing.

Included by default. A connected product without its cloud is only half tested.

Yes. We test how a new device is provisioned onto the platform, whether an enrolment token can be reused, guessed or replayed to enrol a rogue device, and whether each device holds its own unique key rather than a key shared across the fleet. A shared key means one compromised device can be used to impersonate others.

Yes. We test whether devices can be reassigned between customers or sites cleanly, without one owner retaining access after a transfer, and whether commands sent to a device are authenticated and authorised so a device cannot be made to accept commands from anyone who can reach it on the network. We also check that command replay is not possible.

Yes. Most connected device deployments have a web portal where customers or operators enrol devices, view telemetry and send commands, and testing the devices without that portal misses how ownership and permissions are actually enforced. See our customer portal page for how we scope the two together in one engagement.

Yes. We test the backend behind connected vehicles, including how vehicle ownership and device pairing are recorded, so a device cannot be paired to the wrong account or transferred without the right checks. We also test dealer and customer portal boundaries, so dealer staff cannot reach data or vehicles outside their own accounts.

We test who can issue remote commands such as unlock, start or locate, and whether authorisation is checked correctly before a command reaches the vehicle. We also review telemetry handling for privacy, checking that location and usage data stays visible only to the account it belongs to, rather than being exposed through shared APIs or dashboards.

Yes. We test port community systems and vessel or cargo operations platforms for manifest integrity, checking that cargo records cannot be altered by a party without the right authority. We also test how shipping lines, agents and vendors are separated within the same system, so one party’s access cannot reach another party’s manifests or bookings.

IACS UR E26 and UR E27 set class-society requirements for vessel and onboard system cybersecurity, built around supplier and integrator verification testing rather than naming penetration testing directly. Where a vessel or port system falls under these requirements, we can test alongside that process, while class societies handle type approval.

Yes. We test ground-station portals, mission dashboards and telemetry APIs for command authorisation, checking that only the right operator or vendor account can issue commands to a satellite or ground asset. We also test how telemetry is authenticated, so a dashboard cannot be fed spoofed or replayed data without detection.

We map every vendor and contractor account that reaches a ground-station or mission system and test whether that access is limited to what each vendor actually needs. We also test handover points between vendor-managed and operator-managed systems; in our experience these boundaries are where permissions most often carry over further than intended.

Scoping, testing, the executive summary, the technical report, a walkthrough call and free retests until the finding is closed. One scope, one number, no follow-up invoices.

Scope to active testing in 24 hours once the scope is agreed, subject to tester availability in your window.

Yes. EJN Labs is a CREST member company and testing is delivered by CREST-qualified testers. The membership is verifiable on the CREST marketplace.