Penetration Testing
IoT Penetration Testing and Hardware Security Testing
IoT penetration testing is a hands-on security test of a connected device and everything it talks to: firmware, debug interfaces, radio links, companion apps and cloud APIs. Our IoT pentesting also covers POS and PIN entry devices, ATMs and kiosks, drawing on our work as a PCI SSC-approved QSA and Qualified PIN Assessor company.
Prefer to talk? Call +44 161 523 5276
- IoT, POS, PIN entry and ATM devices
- Firmware, interface and radio testing
- Payments-focused QSA and QPA expertise
Trusted by banks, payment providers and global brands
On this page
- What's included in an IoT penetration test
- What do our IoT penetration testing services test for?
- IoT security testing against ETSI EN 303 645 and the UK PSTI regime
- IoT penetration testing checklist
- How long does an IoT penetration test take?
- POS, PIN entry and ATM penetration testing
- How is an IoT penetration test carried out?
- Why choose Sovereign Secure for IoT and hardware penetration testing?
- Frequently asked questions
Overview
What is IoT penetration testing?
The short answer
IoT penetration testing is a hands-on security test of a connected device and everything it talks to. It covers firmware extraction and analysis, debug interfaces such as UART and JTAG, radio links, the companion app and the cloud APIs behind it, with particular depth on POS terminals, PIN entry devices and ATMs.
IoT and hardware penetration testing is a focused assessment of connected devices and embedded systems. We simulate the tactics an attacker would use in the field, looking for insecure firmware, exposed debug interfaces, weak communications and poor authentication that could lead to device compromise or a route into your network.
The work covers the whole device: the hardware itself, the firmware that runs on it, the protocols it speaks, the mobile app that controls it, and the cloud or network services it connects to. A weakness in any one of those is often enough to reach the others, so companion app testing and API penetration testing of the device’s back end are usually scoped alongside the hardware.
POS, ATM and PIN entry devices. As a QSA and Qualified PIN Assessor company, we pay particular attention to point-of-sale terminals, PIN pads, ATMs, kiosks and unattended payment hardware. Device testing supports secure deployment, complements PCI PIN security assessments and the tamper-protection checks in PCI DSS Requirement 9.5, and is not a substitute for PCI PTS device approval, which is a separate laboratory scheme. New to testing? Our guides to what penetration testing is and the types of penetration testing show where this test fits.
What's included
What's included in an IoT penetration test
A hardware engagement covers the device, its firmware and its supporting services.
- 01
Firmware analysis
Extraction and examination of firmware for hardcoded secrets, weak update mechanisms and insecure boot.
- 02
Physical interface testing
Assessment of debug and test interfaces that could give an attacker access to the device.
- 03
Communications testing
Analysis of wired and wireless communications for encryption, validation and resistance to interception and replay.
- 04
Authentication and access review
Testing of device credentials, access controls and administrative interfaces.
- 05
Back-end integration testing
The cloud and network services the device connects to, tested where in scope.
- 06
POS and PIN device focus
Particular attention to point-of-sale, PIN entry and kiosk hardware, given our payments background.
- 07
Manual verification
Every finding confirmed by hand, with clear evidence and reproduction detail.
- 08
Retest
A retest of remediated findings, scoped in your fixed-price proposal, with the report updated to show them closed.
What we test for
What do our IoT penetration testing services test for?
Coverage spans the hardware, its firmware, its communications and its back end.
Insecure firmware and boot
Unprotected or unvalidated system software that lets an attacker modify device behaviour.
- Missing firmware signature verification
- Firmware downgrade vulnerabilities
- Insecure over-the-air update mechanisms
- Hardcoded credentials or keys in firmware
- Absence of secure boot
Exposed debug and test interfaces
Physical access points left active that bypass normal protections.
- Accessible UART, JTAG or SWD interfaces
- Debug mode enabled in production
- Firmware extraction via exposed interfaces
- Bypass of bootloader protections
- Lack of tamper resistance
Insecure communications
Unencrypted or unvalidated communication that can be intercepted or manipulated.
- Unencrypted data transmission
- Insecure use of Bluetooth or Zigbee
- Missing certificate validation
- Replay and interception exposure
- Weak encryption protocols
Weak authentication and access control
Inadequate controls on device functions and administrative access.
- Default or hardcoded credentials
- Weak password policies
- Missing role-based access controls
- Unprotected admin panels or APIs
- Bypass of local authentication
POS, ATM and PIN entry devices
Considerations specific to point-of-sale, ATM, PIN entry and kiosk hardware.
- Exposed maintenance and service interfaces
- Insecure configuration of POS terminals and ATMs
- Weak protection of stored or cached data
- Insecure integration with payment back ends
- Kiosk lockdown and escape testing
Back-end and cloud integration
The services devices connect to, which often extend the attack surface.
- Insecure device-to-cloud APIs
- Weak device provisioning and enrolment
- Exposed management platforms
- Shared or reused device credentials
- Missing segmentation between devices and core systems
IoT security testing against ETSI EN 303 645 and the UK PSTI regime
Since 29 April 2024, manufacturers, importers and distributors of consumer connectable products sold in the UK have had to meet the security requirements of the Product Security and Telecommunications Infrastructure (PSTI) regime. There are three: no universal default or easily guessable passwords, a published way to report security issues, and a stated minimum period for security updates. The government’s PSTI regime guidance explains who must comply.
The regulations accept the matching provisions of ETSI EN 303 645, the European baseline standard for consumer IoT security, as one way to comply. EN 303 645 goes further than PSTI, with provisions on secure storage of credentials, secure communication, software integrity and minimising exposed attack surfaces, and IoT security testing gives evidence against them.
| PSTI requirement | EN 303 645 provision | What testing checks |
|---|---|---|
| No universal default passwords | 5.1-1 and 5.1-2 | Default and hardcoded credentials in firmware, set-up flows and admin interfaces, and whether unique passwords can be guessed |
| A way to report security issues | 5.2-1 | Whether the published reporting route exists and is easy to find (a documentation check rather than a technical test) |
| A stated minimum security update period | 5.3-13 | The published period is a documentation check; testing looks at the update mechanism behind it, such as signature checks and downgrade protection |
If you also sell connected products into the EU, the EU Cyber Resilience Act goes further: its vulnerability reporting duties have applied since 11 September 2026, and its main security requirements and CE marking apply from 11 December 2027. Test reports against EN 303 645 give you a head start on the evidence it asks for. Connected medical devices regulated under the EU medical device rules fall outside the CRA; their security evidence belongs in the device maker’s quality management system, which our ISO 13485 page explains.
IoT penetration testing checklist
An IoT penetration test should cover every layer of the product, not just the device on the bench. The checklist shows what a tester examines in each area and the ETSI EN 303 645 provision it gives evidence for, so you can brief your engineers or compare proposals.
| Test area | What the tester checks | ETSI EN 303 645 provision |
|---|---|---|
| Firmware | Extracts and unpacks the firmware, looking for hardcoded passwords and keys, outdated components and known vulnerabilities | 5.4 Securely store sensitive security parameters |
| Boot and updates | Whether firmware is signed, verified at boot and protected against downgrade, and whether updates are delivered securely | 5.3 Keep software updated; 5.7 Ensure software integrity |
| Debug interfaces | UART, JTAG and SWD connections on the board, and whether they give a shell or let firmware be read out | 5.6 Minimise exposed attack surfaces |
| Default credentials | Universal or guessable passwords in set-up flows, local admin pages and network services | 5.1 No universal default passwords |
| Radio and network | Bluetooth, Zigbee and Wi-Fi links for weak pairing, missing encryption and replay, plus any open network services | 5.5 Communicate securely; 5.6 Minimise exposed attack surfaces |
| Companion app | How the mobile app stores credentials and talks to the device and the cloud, and whether it can control other users’ devices | 5.5 Communicate securely; 5.8 Ensure that personal data is secure |
| Cloud API | Device-to-cloud and app-to-cloud APIs for broken authorisation between accounts and devices, weak device enrolment and injection | 5.5 Communicate securely; 5.13 Validate input data |
| Vulnerability reporting | Whether a published route for reporting security issues exists and is easy to find | 5.2 Implement a means to manage reports of vulnerabilities |
How long does an IoT penetration test take?
A single device with its companion app and cloud API is often tested in one to two weeks, with the report following. Several device models, deep firmware reverse engineering or proprietary radio protocols take longer, and we confirm the timeline in your proposal. These factors set the number of days:
| Driver | Effect on duration |
|---|---|
| Device types and models | Each model has its own hardware, firmware and attack surface to work through |
| Firmware access | Supplied firmware images save the time needed to extract them from the board |
| Radio interfaces | Bluetooth, Zigbee and proprietary radio links each need their own capture and testing |
| Companion app and cloud API | Testing the app and API alongside the device adds days; a large API may suit a separate API penetration test |
| Sample units | Spare units that can be opened or damaged let invasive testing start straight away |
| Payment devices | POS terminals, PIN pads and ATMs add checks on service interfaces, kiosk lockdown and payment back ends |
POS, PIN entry and ATM penetration testing
Payment hardware is where our PCI background matters most. Sovereign Secure is a PCI SSC Qualified Security Assessor, Qualified PIN Assessor and P2PE Assessor company, so we test POS terminals, PIN pads, ATMs and unattended payment kiosks with the controls an assessor will later examine in mind.
Testing covers exposed maintenance and service interfaces, terminal and ATM configuration, kiosk lockdown and escape, data cached on the device, and the connections to payment back ends. It complements PCI PIN security assessments and the device inspection checks in PCI DSS Requirement 9.5, but it does not replace PCI PTS device approval, which is a separate laboratory evaluation of the device design.
How it works
How is an IoT penetration test carried out?
- 1
Scoping
We agree the devices, sample units, firmware, interfaces and back-end services in scope, and fix the price.
- 2
Analysis
We examine the hardware, extract and review firmware, and map the physical and network attack surface.
- 3
Testing
Hands-on testing of interfaces, communications, authentication and back-end integrations.
- 4
Reporting
An executive summary and technical report with reproduction steps, CVSS ratings and remediation advice.
- 5
Debrief
A walkthrough with your team and hardware engineers covering the findings and the fixes.
- 6
Retest
Once remediated, we retest the fixed findings and reissue the report showing them closed.
Every test follows the five stages of penetration testing: planning and reconnaissance, scanning, gaining access, maintaining access, and analysis and reporting.
Why Sovereign Secure
Why choose Sovereign Secure for IoT and hardware penetration testing?
Established in 2012, we deliver PCI, ISO and Cyber Essentials work for banks, payment processors, card manufacturers and fast-growing companies.
Read client testimonials →- A payments-focused firm, so POS, PIN entry and kiosk hardware get proper attention.
- Full-stack testing: hardware, firmware, communications and back-end services.
- Manual, evidence-led testing rather than a checklist.
- Fixed scope and price, with any retest and its window agreed in your proposal.
FAQ
Frequently asked questions
Can't find your answer? Call us on +44 161 523 5276 or send us a message.
What kinds of devices do you test?
Connected and embedded devices of many kinds, with particular strength in point-of-sale terminals, PIN entry devices, self-service kiosks and payment hardware, alongside consumer and business IoT devices.
What do you need from us for an IoT or hardware penetration test?
Typically one or more sample devices, any available firmware images, documentation such as datasheets and architecture diagrams, and details of the back-end services the device uses. We confirm the detail during scoping.
Do you test the firmware as well as the hardware?
Yes. We extract and analyse firmware for hardcoded secrets, weak update and boot protections, and known vulnerabilities, alongside physical interface and communications testing.
Is a device left damaged after testing?
Hardware testing can involve invasive techniques, so we agree in advance which units may be treated destructively and which must be preserved. We plan the engagement to protect anything that needs to be returned intact.
How does this relate to PCI?
For payment hardware, device testing supports secure deployment and complements the controls examined in a PCI DSS assessment and a PCI PIN security assessment. It is not a substitute for PCI PTS device approval, which is a separate laboratory scheme.
Does IoT penetration testing prove PSTI compliance?
Not on its own. Under the PSTI regime the manufacturer is responsible for meeting the three security requirements and for the statement of compliance that ships with the product. Testing gives independent evidence that there are no universal default passwords and that the reporting route and update mechanism work as stated, which supports that statement.
How much does IoT penetration testing cost?
Cost depends on the number of device types, how much firmware analysis is needed, whether radio interfaces and the companion app are in scope, and whether units can be tested destructively. Our penetration testing cost guide explains the drivers; for a fixed figure, request an IoT penetration testing quote.
Last reviewed October 2026 by the Sovereign Secure assessment team.
Related services
- PCI PIN security auditsPCI PIN security assessments and audits by a PCI SSC Qualified PIN Assessor for acquirers, processors, key injection facilities, ATM and POS networks.
- Wireless testingWireless penetration testing for corporate and guest Wi-Fi networks: WPA2/WPA3, 802.1X, rogue and evil twin access points and PCI DSS 11.2 checks. Get a quote.
- Network & infrastructure testingNetwork penetration testing for UK firms: external perimeter, internal network and Active Directory attack paths, plus PCI DSS segmentation tests. Get a quote.
- Penetration testing costPen test cost in the UK for 2026: published day rates and penetration testing price ranges by test type, what drives cost, and how to get a fixed quote.
- Penetration testing quoteScope your test types and asset counts and get a fixed-price penetration testing proposal.
Free consultation
Talk to an assessor
We aim to reply within one working day, and send a fixed quote once your scope is confirmed.
- PCI SSC-approved QSA, QPA, CPSA, P2PE and 3DS assessors
- IASME-licensed Cyber Essentials certification body
- Clients across the UK, US, Europe, Middle East and Asia since 2012
“The Cyber Security Services were delivered on time and price was competitive.”
Call +44 161 523 5276
Email [email protected]