Energy & Utilities
Smart meters and grid sensors, a backdoor into critical OT if left exposed.
IoT Penetration Testing
Crack one open. Own the fleet.
The firmware inside one unit holds a key that unlocks every unit you have shipped. A senior U.S. engineer opens the case, dumps the chip, and reads it out.
-
01 · Hardware
Exposed UART
A debug header, no password.
No open ports
-
02 · Firmware
Shared key
The same in every unit.
Signed
-
03 · Cloud API
Trusts the key
No per-device identity.
TLS 1.3
-
04 · The fleet
Every device
One key unlocks them all.
One key. Whole fleet. Critical.
-
dump firmwareThe step out of one layer into the next - Signed What a scan checks, layer by layer
Nothing replaces skill. Illustrative device, synthetic key. Not one layer failed on its own.
Hardware
Exposed JTAG, UART, SPI, and SWD ports, removable storage, and the physical interfaces that hand over firmware and keys.
Firmware
Extracted and reverse engineered for hardcoded credentials, weak crypto, backdoors, and update mechanisms that fail to verify.
Wireless Protocols
Bluetooth, BLE, Zigbee, Z-Wave, LoRa, Wi-Fi, and cellular, tested for eavesdropping, replay, and command injection.
Cloud & APIs
The dashboards and backends behind the device, tested the way an API engagement would.
Companion App
The mobile app that pairs with the device: stored secrets, weak auth, and pinning bypasses.
Network Segmentation
Whether a compromised device can pivot from its own segment into your production systems.
01
Scope & Threat Model
We define the target devices and objectives, and build a threat model around how your product is actually deployed.
02
Recon & Profiling
We map the chipsets, firmware versions, protocols, and cloud dependencies before a single exploit.
03
Hands-On Exploitation
We probe the hardware, dump and reverse the firmware, intercept the radio, and attack the cloud, validating each finding with a working exploit.
04
Pivot & Report
We show what a compromised device reaches, then deliver findings in Raxis One with proof and a fix, and retest once you patch.
Default Credentials
Admin passwords baked in at the factory and never changed in the field.
Exposed Debug Ports
UART and JTAG headers on the board, wide open to anyone who removes the cover.
Shared Firmware Keys
One key compiled into every unit, so cracking one device unlocks the fleet.
Unsigned Updates
Firmware that accepts an update without checking who wrote it, an open door to persistence.
Unencrypted Radio
Commands sent in the clear, ready to be captured and replayed.
Flat Networks
Devices sharing a segment with production, one compromise from your crown jewels.
Transportation
Signaling, telematics, and fleet tracking, where a fault touches safety.
Water & Wastewater
Remote sensors and treatment controls, increasingly targeted.
Communications
Edge hardware and customer premise equipment across the network.
Healthcare & Medical Devices
Pumps, monitors, and imaging, where a flaw touches patient safety.
Connected Products
Pre-release testing that finds the flaw before it ships in your product.
Technical Findings
Each with proof-of-concept exploitation, reproduction steps, and a fix.
Attack Storyboard
The full chain, from the port we opened to the fleet we reached.
Executive Summary
A board-readable read on the risk and what it means for your product.
Included Retest
We verify your fixes and deliver a clean final report, at no extra cost.
FAQ: IoT Testing
What types of IoT devices can Raxis test?
Virtually any connected device: smart home products, industrial sensors, medical devices, wearables, automotive components, smart meters, embedded controllers, and custom hardware. If it has a processor and a communication interface, we can test it.
How is IoT penetration testing different from a standard network pentest?
IoT testing spans layers a traditional network test never touches: physical hardware, firmware, wireless protocols, embedded operating systems, and device-to-cloud communication. It requires specialized tools, a lab, and hands-on hardware expertise that go well beyond scanning IP addresses.
Do I need to send physical devices to Raxis?
It depends on scope. Hardware-level testing usually needs the physical device on a bench, shipped to our lab or worked on site. Cloud, API, and network-layer testing can often be done remotely.
How long does an IoT penetration test take?
A single consumer device typically takes one to two weeks. A multi-device ecosystem with firmware analysis, wireless testing, and cloud reviews can run three to four weeks. We give you a clear timeline during scoping.
Can Raxis test devices before they go to market?
Yes, and it is one of the most valuable times to test. Finding and fixing a flaw before launch is far cheaper, and less damaging to your brand, than a recall or a field patch after deployment.
What is the difference between IoT and OT penetration testing?
IoT testing focuses on connected devices, their firmware, wireless communications, and cloud integrations. OT penetration testing targets industrial control systems such as SCADA, PLCs, and RTUs in critical infrastructure. We offer both, and they often overlap where connected devices meet the plant floor.
Who performs the testing?
Senior US-based Raxis engineers holding certifications such as OSCP and OSCE. No outsourcing, and no junior testers learning on your product.