IoT Penetration Testing Service

An IoT systems are used in a wide variety of environments to provide a board set of services. These can range from Medical to Transport to Infrastructure Management. During an IoT penetration test, the consultant will perform a series of structure activities the goal of which is to identify and validate the security vulnerabilities contained within the IoT device. Within some domains an IoT penetration test can be used demonstrated regulator compliance.

Purposes for an IoT penetration test can include a) validation that regulatory requirements have been adhered, b) verification that intellectual property is being protected, and c) validate that the system can bot be accessed/modified in an unauthorised manner

Covid-19 : Remote Delivery Options

We want to reassure customers that we can still provide internal penetration testing services. We have a range of remote connectivity options and solutions for remotely testing, and we will work with you to ensure the testing can still go ahead as planned and on time.

Benefits of IoT Penetration Testing


Experienced Consultants

With over 15 years combined corporate expertise in the field of information assurance & penetration testing


Bespoke penetration testing

We will develop a test that fits your business needs


Testing Tools

We use open source and commercial tools and our own testing apps developed by our in-house software development team


Fully accredited

Certified by CREST and with qualifications from EC Council, Offensive Security and SANS



Clear and easy to understand reports including recommendations for remediation and improvement


Fair Pricing

Fixed price proposals with fully detailed project scope and no unexpected costs

Talk to us, before you need us

If you would like your internal or external network tested or you have a web application/portal that requires testing then we can help with any pen-testing project.

Definitive Outcomes Demand a Structured Approach

Highly secure IoT devices are essential for the day-to-day success of modern organisations, including those within the medical, transport, and infrastructure management sectors. Some organisations even require routine penetration testing reviews to meet certain regulatory and compliance obligations. Our structured and targeted approach to IoT penetration testing will enable your organisation to have full confidence in the security of your IoT devices — validating that your IoT devices cannot be accesses or modified by cyber criminals and ensuring your intellectual property remains secure 24/7

A Four-Step Penetration Test

Wizard Cyber’s IoT penetration test is designed to uncover routes that cyber criminals could leverage in order to gain access to your data as well as modify or destroy it. Our team will construct a detailed attack surface that will allow our experts to execute a range of attack principles that will reach far and wide across your system’s access points

To guarantee complete coverage across the attack surface, our team will conduct a detailed closed and open-source intelligence analysis. Fusing the intelligence analysis results with the attack surface, our team will produce invaluable insights into exactly where and how your IoT devices could be attacked. These IoT penetration test findings will then be extrapolated into an actionable report for your organisation’s consideration

Penetration Testing Services Available

Wizard Cyber offer a range of penetration testing services to fit your requirements. Please click on the links below to find out more information about each pentest service.


Our Process

The 5 steps below are broad categories and can generally be applied to multiple infrastructure assessment types, regardless of whether it is internal, external or some other combination.

Attack Surface Identification

This involves the analysis of the IoT device from a holistic perspective and covers everything from the device’s human machine interface to the printed circuit boards contained with the device. This element also focuses upon component identification. Key access points focused upon include:

WIFI, Bluetooth, Zigbee, RFID and CAT5/CAT6
Controller Area Network Bus and MODBUS

PCB Test Point identification and PCB X-Ray

Open Source Intelligence Analysis

The open source intelligence analysis makes use of a variety of data sources to validate the findings of the Attack Surface Identification phase and augment it. This augmentation will take the form of:

Identification of Flash and CPU components that can contain data/firmware and may have hidden access points.
Validation of identified access points and protocols used for data sharing.

Identification of the host operating system and/or firmware being executed by the device

Exploitation and Data Extraction

This element will include:

Execution of the attack surface via the various access points identified to perform:
data extraction and data recovery, and
data modification of data fabrication.
Direct hardware access for memory manipulation.
Chip-off and direct attack via Chip programmers and Chip Readers.

Protocol/network attacks and brute forcing of access points.

Data Fusion and Analysis

This involves the analysis and fusion of the data recovered from the device with a view to identification and validation of further points on the attack surface. This element also seeks to identify key element of intellectual property that are propriety to the manufacture of the IoT device. This element also draws upon all of the previous elements and fuses the data together to give a holistic picture of the IoT device’s security vulnerabilities.

Certified By



If you have any further questions about our penetration testing service that are not answered below please feel free to call us on 0333 311 0121 or book a meeting with one of our cyber security experts
What is penetration testing?
Penetration testing is where someone takes on a hacker’s role and attempts to compromise or gain unauthorised access to a network or an application. Also known as white hat hacking, a qualified professional will use automated tools and manual processes to uncover any vulnerabilities and misconfigurations that present a cyber-security risk. A penetration test will give companies an overview of their security posture, highlighting flaws and allowing them to be patched before malicious hackers target them. Also known as white hat or ethical hacking, penetration tests are a vital part of an effective security strategy and are a mandatory component of many compliance schemes.
What are the different types of penetration testing?
Several types of penetration testing can be defined as either black, white or grey box testing. It’s also worth specifying there is a difference between an application test and an infrastructure test. As the name suggests, an application test is where a tester looks for flaws within an application to see if there’s any way to get at data or manipulate functionality in a way that wasn’t intended. This can involve cookie theft, XSS, man-in-the-middle attacks etc. On the other hand, infrastructure tests are where the tester attempts to gain entrance to a corporate network.

Black box testing
Black box testing is the closest simulation of real-world hacking in that the tester will know very little, if anything, about the target other than what is publicly available. These are often the least time-consuming tests as it relies solely on the tester discovering vulnerabilities in outwardly facing components. However, whilst these tests accurately represent real-life situations, they will not pick up any vulnerabilities, or misconfigurations present internally. Therefore, they cannot predict what damage an internal threat may cause.

White box testing
White box testing offers the most thorough security test. The tester has a full understanding of the application or infrastructure, how it works, and access from various levels. Likely, they’ll even have access to the source code or have a full detailed map of the internal infrastructure. The tester will probe for vulnerabilities and misconfigurations to gain access from an external position and look to see what damage can be done from an internal perspective.

Grey box testing
Grey box testing is a blend of black and white box testing and is often the most popular test type. The tester will have limited knowledge of the target, potentially including some documentation. They will often have basic user-level access, allowing for partial testing of the target’s internals.
What is the difference between a vulnerability assessment and a penetration test?
The terms penetration test and vulnerability assessment are often wrongly used interchangeably. A vulnerability assessment uses an automated tool to scan a network or application for known vulnerabilities. A penetration test is more involved and encompasses many aspects, providing you with a more comprehensive overview of your overall security.

A vulnerability scan may well be used in the initial stages of a penetration test to see any easily exploited flaws to work with. The tester will then go a step further, using brute-forcing, code injections, social engineering and other methods to exploit the vulnerability to gain access.
What are the stages of a penetration test?
All penetration test projects will start with an accurate scoping. Once the boundaries have been agreed upon and a goal decided upon, testers will begin some reconnaissance. This is the starting point for any hacker and the beginning of the cyber kill chain. This may include looking for any related URLs or domains that could be considered in scope and increase the attack area or conducting some vulnerability scans on their target. If social engineering is included in the test, recon activity may include searching publicly available sources for staff contact details, staff pass designs or email address formats.

The testers will then attempt to exploit any weakness found to gain unauthorised access. This can often have a trial and error-based approach. If successful, the tester will find out the extent of a hacker’s potential reach, compile some evidence and then provide a detailed report along with remediation advice.

Tests will often follow these steps:

  • Scoping
  • Reconnaissance
  • Active Scanning and Vulnerability Analysis
  • Mapping and Service Identification
  • Application Analysis
  • Service Exploitation
  • Privilege Escalation
  • Pivoting
  • Reporting & Debrief
Do I need a penetration test?
It’s recommended that businesses perform penetration tests at least annually or whenever a significant change is made to the environment. Certain compliance packages, such as PCI DSS, make regular penetration tests mandatory. If you want good cyber security, you need a penetration test.
What will I find in my penetration test report?
The content of a report will always depend on who has written the report. Wizard Cybers reports always contain a high-level business executive summary before drilling into an in-depth breakdown of each vulnerability, weakness or misconfiguration discovered, along with the mitigation and remediation advice. We will provide this in order of severity and priority.
How often should penetration testing be carried out?
Penetration testing should be conducted at least once per year.

We would also recommend conducting a penetration test any time you make significant changes to your infrastructure or network, such as when you make an upgrade to software or move to a new office. Our team can advise the best solution for your organisation.

Contact us for more information

Please fill out the form below or call us directly on +44 (0) 333 311 0121.