IoT penetration testing companies: compared
IoT penetration testing checks a connected device and everything it talks to: hardware ports, firmware, radio links, the companion app and the cloud API. Most providers publish no price, so scope drives the quote. ETSI EN 303 645 is a published baseline for consumer IoT security. The table lists providers whose record includes IoT testing, A to Z, with the date we checked each fact.
IoT penetration testing companies test a connected device and the systems it depends on. This page helps device makers and product teams pick a provider and write a scope. The table lists every provider in our dataset whose record includes IoT testing, in A to Z order. It is not a ranking, and no provider pays for position.
20 of 20 providers shown (67 in the full table). Sorted A to Z, not ranked. Checked up to 9 November 2026.
| Provider | Delivery | Web apps | APIs | Cloud | Network | Mobile | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|---|
| Bishop FoxOffensive security consultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Not published | Not published | Not published | not published |
| BreachLockPTaaS platform | hybrid | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive).… | on request |
| BugcrowdPTaaS platform, United States | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Tests launch in under 72 hours; Standard: launch within 3 business… | Standard: one year of retesting with one report revision, for web… | Public |
| Compass SecurityConsultancy, Switzerland | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not published | on request |
| DoyensecBoutique consultancy | human-led | Yes | Yes | Yes | ? | Yes | Yes | Custom quote | Not published | Not stated on the homepage or company page. Some public reports are… | Public |
| Include SecurityApplication security consultancy, United States | human-led | Yes | Yes | ? | ? | Yes | ? | Not published | Report target: a week after the assessment conclusion. | Not published | not published |
| Integrity360Cyber security services provider, Ireland | human-led | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Not published | Continuous retest options are mentioned. | not published |
| NCC GroupSecurity consultancy, United Kingdom | human-led | ? | ? | Yes | Yes | ? | ? | Not published | Not published | Not published | not published |
| NetSPIPenetration testing as a service (PTaaS) | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Not published | Not published | Not published | not published |
| PacketlabsPenetration testing consultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | The homepage says Packetlabs supports security teams with retesting;… | on request |
| PayatuSecurity consultancy, India | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $3,500 per test (starts from) +1 more | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1… | not published |
| PentiAI-assisted testing service | hybrid | Yes | Yes | Yes | Yes | Yes | Yes | $20 per month ($216 per year billed annually) +5 more | Pentests done in hours, not months (tagline). On the free first… | Every plan includes free unlimited retests. | not published |
| Prescient SecurityConsultancy | hybrid | Yes | Yes | Yes | Yes | Yes | ? | from $6,000 per engagement (scope-based) +5 more | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms… | not published |
| RaxisConsultancy, United States | human-led | Yes | Yes | Yes | Yes | ? | Yes | Custom quote | Quote requests answered usually in one business day; PTaaS findings… | Retesting is built into the PTaaS workflow; Raxis Attack includes… | Public |
| SchellmanConsultancy, United States | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published | Not stated on the page. | Public |
| Secure IdeasConsultancy | human-led | Yes | Yes | ? | Yes | Yes | ? | $8,160 per test (flat fee, starting) +4 more | Testing usually starts two to four weeks after contracting; one to… | Not included by default; retesting is listed as a factor that can… | Public |
| Software SecuredConsultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner;… | Request retesting within 12 months of report delivery;… | not published |
| SySSConsultancy, Germany | human-led | Yes | Yes | Yes | Yes | Yes | Yes | Custom quote | Not published. A Quick Penetration Test option can start right after… | A retest after fixes confirms the fixes work and checks for new… | not published |
| TrustedSecSecurity consultancy, United States | human-led | ? | ? | Yes | ? | ? | Yes | Not published | Not published | Not published | not published |
| VumetricPenetration testing consultancy, Canada | human-led | Yes | Yes | Yes | Yes | Yes | ? | Custom quote | Most penetration tests can be performed within a couple of days, but… | Not stated | on request |
No provider matches every filter. Remove a filter to see more.
"?" means the provider does not say on its public pages. It does not mean "no". Prices use each provider's own unit: a test, a year, a month or credits. Do not compare them as equal units. How we collect and check this data.
Each cell comes from the provider's own pages, with the date we checked. "Not published" means we found no statement.
What does an IoT penetration test cover?#
An IoT penetration test covers the device and the path from the device to the cloud. A full scope has five layers, and a quote can include any of them.
| Layer | What testers look at |
|---|---|
| Hardware | Debug ports (UART, JTAG), storage chips, tamper protection |
| Firmware | Extracted images, hard-coded secrets, update signing, outdated components |
| Radio | Bluetooth Low Energy, Zigbee, Wi-Fi and other links the device uses to pair and talk |
| Companion app | Mobile app storage, pairing flow, API calls |
| Cloud | Device and user APIs, device identity, authorization between customers |
Many findings sit between layers. A device that holds one shared key for every unit turns one extraction into a fleet-wide problem. Ask providers to say which layers they test in-house and which they skip.
Which standard applies?#
ETSI EN 303 645 is a published baseline for consumer IoT. ETSI states that it specifies 13 provisions for the security of internet-connected consumer devices and their associated services, and lists connected toys, baby monitors, smoke detectors, door locks, smart cameras, TVs, speakers and wearables as in scope (ETSI press release, June 2020, checked 9 November 2026).
A pentest and a standard are different things. The standard lists provisions. A pentest tries to break the product. Ask a provider whether its report maps findings to the provisions, and do not assume it does. We found no provider claim in the dataset that we could check against this standard, so the table does not carry one.
Who needs it and when?#
Device makers need IoT testing before a first release and after changes to firmware, the pairing flow or the cloud API. Buyers who integrate third-party devices also ask for results. Typical triggers are a retail launch, a customer security review and a new radio or chipset.
Test a build that is close to release. A test of an early prototype finds design flaws, but later firmware changes can reopen old issues.
What to ask providers#
Send the same questions to every provider and compare the written answers.
- Which of the five layers do you test, and which do you subcontract?
- Do you have lab tools for our radio protocols and our chipset family?
- How many devices do you need, and what happens to them after the test?
- Do you test the update path, including signature checks and rollback?
- Will you test the cloud API with two customer accounts to check isolation?
- Does the report map findings to a standard we name, such as ETSI EN 303 645?
- Is a retest included, for how long, and on which firmware version?
- Can we see a sample report? The table shows which providers publish one.
Price drivers#
Most providers in the table publish no price, so you will get a quote. What changes the quote:
- Number of device models and firmware versions in scope
- Layers included, especially hardware work, which takes lab time
- Radio protocols, since each needs its own tools
- Source code or firmware build access, which speeds analysis
- Number of devices you ship and whether they are destroyed
- Report format and retest terms
The guide on penetration testing cost explains the units providers use when they do publish a price.
How to read the table#
The table has no IoT column, because the filter is the IoT service. A row appears when the provider's record lists IoT testing, which we read from its service pages. Cloud, Web, API and AI apps columns show other scope the provider states.
Check Type and Delivery first. An automated platform and a consultancy will not test hardware the same way, and the dataset records IoT as a stated service only. Then read Published price, Turnaround and Retest. Open the provider profile for the source link behind each claim.
Common scoping mistakes#
- Testing the device and leaving out the companion app and cloud API.
- Naming one firmware version, then shipping another.
- Giving no debug build or test accounts, so testers spend days on setup.
- Forgetting the update path. A signed, tested release can still accept an unsigned image.
- Ignoring device cost. Testers may destroy units, so agree a number.
- Skipping a retest after the vendor changes firmware.
Where to go next#
Compare providers across all services in the provider directory or the services index. For the cloud layer, see cloud penetration testing companies. Before you request quotes, read questions to ask a pentest provider.
Questions
What is the difference between an IoT pentest and a web app pentest?
An IoT pentest adds the device. Testers work on hardware interfaces, firmware, radio protocols and the update path, then follow the device to its app and cloud API. A web app test covers only the web layer. Ask which layers your quote includes.
Do I have to give the provider physical devices?
Usually yes. Hardware and firmware work needs devices, and testers often open or modify them. Agree how many units you ship, whether they come back, and who pays for devices that break. Some providers can test only the app and cloud layers.
Which standard do IoT testers use?
ETSI EN 303 645 is a published baseline for consumer IoT security. It sets 13 provisions for internet-connected consumer devices. Other schemes cover industrial and medical devices. Ask the provider which one applies to your product and how the report maps to it.
Can an IoT pentest be done without the cloud backend?
Yes, if you scope it that way. The risk then moves: many device flaws show up in the cloud API that the device calls. If the backend holds user data or can control devices, include it in scope or test it separately.
Sources
- ETSI: ETSI releases world-leading consumer IoT security standard (EN 303 645) (checked 9 November 2026)
- PentestCompare provider dataset (filter: iot) (checked 9 November 2026)
Compare like with like
An automated scan, a manual test and annual credits are different units. Check scope, delivery and retest terms before price.