# IoT penetration testing companies: compared

Source: https://pentestcompare.com/services/iot-penetration-testing/
Publisher: Excession Labs (pentestcompare.com)
Last updated: 2026-11-09

IoT penetration testing companies from one sourced dataset, A to Z. See what a device test covers, the ETSI EN 303 645 baseline and what to ask each provider.

> **Short answer:** IoT penetration testing checks a connected device and everything it talks to: hardware ports, firmware, radio links, the companion app and the cloud API. Most providers publish no price, so scope drives the quote. ETSI EN 303 645 is a published baseline for consumer IoT security. The table lists providers whose record includes IoT testing, A to Z, with the date we checked each fact.

IoT penetration testing companies test a connected device and the systems it depends on. This page helps device makers and product teams pick a provider and write a scope. The table lists every provider in our dataset whose record includes IoT testing, in A to Z order. It is not a ranking, and no provider pays for position.

| Provider | Type | Delivery | Web | API | Cloud | AI apps | Published price | Turnaround | Retest | Sample report |
|---|---|---|---|---|---|---|---|---|---|---|
| [Bishop Fox](https://pentestcompare.com/providers/bishop-fox/) | Offensive security consultancy | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [BreachLock](https://pentestcompare.com/providers/breachlock/) | PTaaS platform | hybrid | yes | yes | yes | unknown | custom quote | Pentests can be scoped and started within 24-48 hours. | Free manual retests: 1 (Standard), 2 (Extended), custom (Extensive). The PTaaS product text also promises unlimited retesting. | on request |
| [Bugcrowd](https://pentestcompare.com/providers/bugcrowd/) | PTaaS platform | hybrid | yes | yes | yes | yes | custom quote | Tests launch in under 72 hours; Standard: launch within 3 business days. | Standard: one year of retesting with one report revision, for web apps, networks and APIs only. Plus: same terms for every asset type. Max: same as Plus. | public |
| [Compass Security](https://pentestcompare.com/providers/compass-security/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not published | on request |
| [Doyensec](https://pentestcompare.com/providers/doyensec/) | Boutique consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the homepage or company page. Some public reports are titled 'With Retesting' or 'After Retest'. | public |
| [Include Security](https://pentestcompare.com/providers/include-security/) | Application security consultancy | human-led | yes | yes | unknown | unknown | not published | Report target: a week after the assessment conclusion. | Not published | not published |
| [Integrity360](https://pentestcompare.com/providers/integrity360/) | Cyber security services provider | human-led | yes | yes | yes | unknown | custom quote | Not published | Continuous retest options are mentioned. | not published |
| [NCC Group](https://pentestcompare.com/providers/ncc-group/) | Security consultancy | human-led | unknown | unknown | yes | unknown | not published | Not published | Not published | not published |
| [NetSPI](https://pentestcompare.com/providers/netspi/) | Penetration testing as a service (PTaaS) | human-led | yes | yes | yes | yes | not published | Not published | Not published | not published |
| [Packetlabs](https://pentestcompare.com/providers/packetlabs/) | Penetration testing consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | The homepage says Packetlabs supports security teams with retesting; terms (window, number of rounds, cost) are not published. | on request |
| [Payatu](https://pentestcompare.com/providers/payatu/) | Security consultancy | hybrid | yes | yes | yes | yes | $3,500 per test (starts from) | Not published | Re-validation of fixes: 1 round (Express, Critical and High), 1 round (Expert, all severities), 2 rounds (Enterprise, all severities). | not published |
| [Penti](https://pentestcompare.com/providers/penti/) | AI-assisted testing service | hybrid | yes | yes | yes | yes | $20 per month ($216 per year billed annually) | Pentests done in hours, not months (tagline). On the free first test, agents start within an hour. No per-plan turnaround is stated. | Every plan includes free unlimited retests. | not published |
| [Prescient Security](https://pentestcompare.com/providers/prescient-security/) | Consultancy | hybrid | yes | yes | yes | unknown | from $6,000 per engagement (scope-based) | Not published | Cait: up to 2 retests within 30 days of each scan. No retest terms stated for Traditional and Compliance pentests. | not published |
| [Raxis](https://pentestcompare.com/providers/raxis/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote requests answered usually in one business day; PTaaS findings appear in real time. | Retesting is built into the PTaaS workflow; Raxis Attack includes year-round retesting of fixes. | public |
| [Schellman](https://pentestcompare.com/providers/schellman/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published | Not stated on the page. | public |
| [Secure Ideas](https://pentestcompare.com/providers/secure-ideas/) | Consultancy | human-led | yes | yes | unknown | unknown | $8,160 per test (flat fee, starting) | Testing usually starts two to four weeks after contracting; one to two weeks of testing. | Not included by default; retesting is listed as a factor that can change the quote. | public |
| [Software Secured](https://pentestcompare.com/providers/software-secured/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Quote within 48 hours; scheduling in 3-6 weeks, sometimes sooner; report within 48-72 hours of pentest completion. | Request retesting within 12 months of report delivery; auto-scheduled within 2 weeks. PTaaS page says unlimited retesting. | not published |
| [SySS](https://pentestcompare.com/providers/syss/) | Consultancy | human-led | yes | yes | yes | yes | custom quote | Not published. A Quick Penetration Test option can start right after the order and is done remotely. | A retest after fixes confirms the fixes work and checks for new attack points. | not published |
| [TrustedSec](https://pentestcompare.com/providers/trustedsec/) | Security consultancy | human-led | unknown | unknown | yes | yes | not published | Not published | Not published | not published |
| [Vumetric](https://pentestcompare.com/providers/vumetric/) | Penetration testing consultancy | human-led | yes | yes | yes | unknown | custom quote | Most penetration tests can be performed within a couple of days, but some span several weeks or months depending on complexity. | Not stated | on request |

Each cell comes from the provider's own pages, with the date we checked. "Not published" means we found no statement.

## What does an IoT penetration test cover?

An IoT penetration test covers the device and the path from the device to the cloud. A full scope has five layers, and a quote can include any of them.

| Layer | What testers look at |
|---|---|
| Hardware | Debug ports (UART, JTAG), storage chips, tamper protection |
| Firmware | Extracted images, hard-coded secrets, update signing, outdated components |
| Radio | Bluetooth Low Energy, Zigbee, Wi-Fi and other links the device uses to pair and talk |
| Companion app | Mobile app storage, pairing flow, API calls |
| Cloud | Device and user APIs, device identity, authorization between customers |

Many findings sit between layers. A device that holds one shared key for every unit turns one extraction into a fleet-wide problem. Ask providers to say which layers they test in-house and which they skip.

## Which standard applies?

ETSI EN 303 645 is a published baseline for consumer IoT. ETSI states that it specifies 13 provisions for the security of internet-connected consumer devices and their associated services, and lists connected toys, baby monitors, smoke detectors, door locks, smart cameras, TVs, speakers and wearables as in scope ([ETSI press release, June 2020](https://www.etsi.org/newsroom/press-releases/1789-2020-06-etsi-releases-world-leading-consumer-iot-security-standard), checked 9 November 2026).

A pentest and a standard are different things. The standard lists provisions. A pentest tries to break the product. Ask a provider whether its report maps findings to the provisions, and do not assume it does. We found no provider claim in the dataset that we could check against this standard, so the table does not carry one.

## Who needs it and when?

Device makers need IoT testing before a first release and after changes to firmware, the pairing flow or the cloud API. Buyers who integrate third-party devices also ask for results. Typical triggers are a retail launch, a customer security review and a new radio or chipset.

Test a build that is close to release. A test of an early prototype finds design flaws, but later firmware changes can reopen old issues.

## What to ask providers

Send the same questions to every provider and compare the written answers.

1. Which of the five layers do you test, and which do you subcontract?
2. Do you have lab tools for our radio protocols and our chipset family?
3. How many devices do you need, and what happens to them after the test?
4. Do you test the update path, including signature checks and rollback?
5. Will you test the cloud API with two customer accounts to check isolation?
6. Does the report map findings to a standard we name, such as ETSI EN 303 645?
7. Is a retest included, for how long, and on which firmware version?
8. Can we see a sample report? The table shows which providers publish one.

## Price drivers

Most providers in the table publish no price, so you will get a quote. What changes the quote:

- Number of device models and firmware versions in scope
- Layers included, especially hardware work, which takes lab time
- Radio protocols, since each needs its own tools
- Source code or firmware build access, which speeds analysis
- Number of devices you ship and whether they are destroyed
- Report format and retest terms

The guide on [penetration testing cost](/guides/penetration-testing-cost/) explains the units providers use when they do publish a price.

## How to read the table

The table has no IoT column, because the filter is the IoT service. A row appears when the provider's record lists IoT testing, which we read from its service pages. Cloud, Web, API and AI apps columns show other scope the provider states.

Check Type and Delivery first. An automated platform and a consultancy will not test hardware the same way, and the dataset records IoT as a stated service only. Then read Published price, Turnaround and Retest. Open the provider profile for the source link behind each claim.

## Common scoping mistakes

- Testing the device and leaving out the companion app and cloud API.
- Naming one firmware version, then shipping another.
- Giving no debug build or test accounts, so testers spend days on setup.
- Forgetting the update path. A signed, tested release can still accept an unsigned image.
- Ignoring device cost. Testers may destroy units, so agree a number.
- Skipping a retest after the vendor changes firmware.

## Where to go next

Compare providers across all services in the [provider directory](/directory/) or the [services index](/services/). For the cloud layer, see [cloud penetration testing companies](/services/cloud-penetration-testing/). Before you request quotes, read [questions to ask a pentest provider](/guides/questions-to-ask-a-pentest-provider/).

## Questions

### What is the difference between an IoT pentest and a web app pentest?

An IoT pentest adds the device. Testers work on hardware interfaces, firmware, radio protocols and the update path, then follow the device to its app and cloud API. A web app test covers only the web layer. Ask which layers your quote includes.

### Do I have to give the provider physical devices?

Usually yes. Hardware and firmware work needs devices, and testers often open or modify them. Agree how many units you ship, whether they come back, and who pays for devices that break. Some providers can test only the app and cloud layers.

### Which standard do IoT testers use?

ETSI EN 303 645 is a published baseline for consumer IoT security. It sets 13 provisions for internet-connected consumer devices. Other schemes cover industrial and medical devices. Ask the provider which one applies to your product and how the report maps to it.

### Can an IoT pentest be done without the cloud backend?

Yes, if you scope it that way. The risk then moves: many device flaws show up in the cloud API that the device calls. If the backend holds user data or can control devices, include it in scope or test it separately.

## Sources

- [ETSI: ETSI releases world-leading consumer IoT security standard (EN 303 645)](https://www.etsi.org/newsroom/press-releases/1789-2020-06-etsi-releases-world-leading-consumer-iot-security-standard)
- [PentestCompare provider dataset (filter: iot)](https://pentestcompare.com/data/providers.json)