Capability
IoT & IIoT Security testing
Your connected devices are more exposed than you think. The Swarm’s IoT security testing finds out exactly how, hardware and firmware included, before a real threat actor does.
CovertSwarm named in the Gartner® Hype Cycle™ for Security Operations, 2026
THE THREAT.
Every connected device is a door an attacker can walk through.
IoT and IIoT devices have become one of the largest and least-scrutinized attack surfaces in most organisations. Deployed fast, often by operational teams rather than security teams, default credentials go unchanged, firmware goes unreviewed, and because they are not traditional IT endpoints they are frequently invisible to your existing security tooling.
Attackers know this. A compromised sensor isn’t just a device problem. It’s your data, your camera feed, or your customer’s vehicle, exposed the moment the device’s own security fails.
You can’t patch what you can’t find.
Most organisations don’t have a complete picture of their connected estate. Attackers do.
Default credentials are an open door.
IoT devices ship with known credentials and most are never changed. That is where the Swarm starts.
A sensor is a stepping stone.
One compromised device is rarely the destination. It is the route into everything connected to it.
Your connected estate is an attack surface.
Real attackers do not stop at the network perimeter. They map every device, probe every interface, and follow every pathway your IoT estate creates. The Swarm works the same way.
Device and firmware security
What is inside your device’s firmware that a network scan would never surface. We extract and analyse firmware to find hardcoded credentials, insecure boot processes, and exploitable vulnerabilities before an attacker does.
IIoT and OT exposure
Industrial IoT deployments create pathways between connected devices and your operational systems that are rarely mapped and rarely monitored. We identify those paths and test whether a compromised sensor becomes a production risk.
Authentication and access controls
Default credentials and weak authentication on a single device can give an attacker persistent access that scales across your entire connected estate. We test every authentication pathway and find the entry points that survive a standard network review.
Network exposure and segmentation
Your IoT devices can reach systems they have no business accessing. We test whether your segmentation holds under real attack conditions or whether it only looks right on the diagram.
Hardware interface testing
Debug interfaces left accessible on deployed devices are an invitation into device internals that most organisations have never considered. We test JTAG, UART, and serial ports to find what physical access to a device actually unlocks.
Wireless protocol testing
Bluetooth, Zigbee, Z-Wave, and LoRaWAN create an over-the-air attack surface your devices broadcast continuously. We test for authentication weaknesses, replay attacks, and the traffic your devices should not be sending.
We know that real attack surfaces don’t come in neat categories. If yours doesn’t fit above, tell us what you’re working with.
What aN IOT/IIOT Finding Looks Like
Example: Medical device security assessment, healthcare sector
Critical
Finding
CovertSwarm intercepted the Bluetooth Low Energy communication of a medical device and found it used an insecure encryption method. That weakness let the operator manipulate the data in transit and replicate requests, both reading from and writing to the device.
Impact
The encryption weakness broke both confidentiality and integrity in the device’s communication channel. An unauthorised party could read from and write to a medical device without detection, turning a data exposure into a patient-safety issue.
Remediation
Replace the encryption method with a current, vetted standard for BLE communications, at minimum authenticated encryption rather than the scheme in use. Add message-level authentication so replayed or forged requests are rejected even if the channel is compromised, and audit every deployed unit of this device model since the flaw is in the implementation.
Board impact
A device that can be read from and written to by an unauthorised party is a patient-safety risk, not just a data-privacy one, and it sits inside regulatory regimes like FDA premarket cybersecurity guidance, EU MDR, and HIPAA.
Technical impact
Once the BLE traffic was decrypted, the operator could replay and forge read/write requests to the device on demand. That’s a full compromise of the communication channel, not a partial one.
Want the full picture?
The full range of offensive security the Swarm runs: every discipline, how they connect, and what each one tests.
No form fill required.
How it works
Your subscription starts with your Attack Strategy. What matters most, and what adversaries would target first.
Your Swarm then delivers realistic attacks against your whole organisation, and works within mutually agreed parameters without interruption to operations.
1
Scoped authorisation
Every engagement is explicitly authorised before any device is touched. The devices in scope, the techniques permitted, and the operational boundaries are agreed and documented before testing begins.
2
Passive observation first
For IIoT devices connected to operational systems, passive network observation precedes any active testing. We map what is there before we touch anything.
3
Active testing on isolated units
Where possible, firmware extraction and hardware testing are conducted on test devices or isolated units rather than live production hardware. The approach for each device class is agreed before the engagement begins.
4
Hardware testing logistics
Physical device access is required for hardware interface testing. Whether devices are shipped for lab testing or tested on site is agreed in advance. Nothing extracted is retained after the engagement closes.
Constant Cyber Attack™
We become the threat. You get the proof.
You don’t outpace attackers by waiting for your next test. You do it by facing an adversary that thinks, acts and strikes like they do.
CovertSwarm attacks your organisation the way the best attackers do: continuously, and using every tool available to reach their objective.
Digital. Social. Physical.
Your Swarm attacks across digital, physical and social vectors, chaining weaknesses to prove what a real attacker could achieve.
Constant pressure.
Your Swarm keeps attacking as your business evolves, adapting to changing systems, people and risks. Constant pressure, not a one-off test.
One simple subscription.
One subscription is all you need. Combine continuous offensive security, penetration testing, red teaming, bug bounty and more in one simple subscription.
Sharper, battle-tested SOC
Improve detection times
Fewer false positives
Prove ROI of security tooling
Stories from the Swarm
These stories are real, but the names are deeply redacted. We’ll tell you how we uncovered the threats no one else could see, and why constant cyber attack is the best way to outpace cyber threats.
Become a story well told. Contact us to discuss how Constant Cyber Attack will help you outpace cyber threats.
Frequently asked questions
Our IoT security testing aligns to the OWASP IoT Security Testing Guide (ISTG), ETSI EN 303 645 (the global baseline standard for consumer IoT security), and NCSC IoT security guidance. For IIoT environments, testing additionally aligns to IEC 62443. Engagements are delivered by CREST-accredited practitioners.
A standard network penetration test looks at what devices expose over the network. IoT testing goes further: we extract and analyse device firmware, probe hardware interfaces, test wireless protocols, and find vulnerabilities that only exist inside the device itself. A network scan tells you a device is there. IoT testing tells you what an attacker can do once they have it in their hands.
We test IoT and IIoT devices across all categories: industrial sensors and controllers, building management and smart facility devices, healthcare and medical devices, consumer connected products, network infrastructure with IoT components, and edge computing devices. If it connects to a network, it has an attack surface.
It depends on the testing scope. Firmware analysis and hardware interface testing require physical device access. This can be arranged through device shipment to our testing facility, on-site testing, or by using test units provided by the client. Network-layer and application-layer testing can be conducted remotely. The scope document defines which approach applies to each device class in the engagement.
Yes. Industrial IoT deployments, where sensors and controllers connect to operational technology and critical infrastructure, represent a distinct and higher-risk testing scope. For IIoT environments we apply the same passive-first approach used in OT security testing, with active testing scoped carefully to avoid operational disruption.
Findings are delivered in real time via the CovertSwarm Portal as they are discovered. The final deliverable includes an executive summary, technical findings per vulnerability, board-level and technical outcome lines, and specific remediation guidance. For manufacturer engagements, findings are documented in a format suitable for compliance evidence purposes.
ETSI EN 303 645 establishes the baseline security standard for consumer IoT products in the UK and EU. The Product Security and Telecommunications Infrastructure Act 2022 creates mandatory security requirements for UK-market connected devices. For IIoT environments, IEC 62443 provides the primary compliance framework. Our testing is structured to produce the evidence your compliance, legal, and procurement teams require.
Looking for something specific?
Talk to us. We’d love to hear from you.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security programme
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.