# IoT Security Assessment

> From $10K · Offensive Security · https://cisomarketplace.services/services/iot-security-assessment

Security testing of Internet of Things devices and infrastructure

## In scope

- Device hardware and debug-interface review
- Firmware extraction and analysis
- Wireless and network communications (WiFi, Bluetooth, Zigbee, cellular as applicable)
- Companion mobile application and cloud API testing
- Update mechanism and secure-boot review
- Default credentials, provisioning and lifecycle review

## Deliverables

- IoT device security report with reproducible findings
- Risk-rated findings per device model
- Hardening guidance for engineering
- Executive summary
- Retest of fixed findings

## Tiers

### Basic IoT Assessment: $10K

Security test of 1 IoT device model: network services, local interfaces, authentication, update mechanism and device-to-cloud traffic review, with architecture review and a findings report. No firmware extraction.

Limits: devices 1

Includes:
- Testing of 1 device model (network services, web/local interfaces)
- Authentication and default credential checks
- Update mechanism and traffic encryption review
- Security architecture review
- Report, executive summary and follow-up consultation

Excludes:
- Firmware extraction and reverse engineering
- Hardware teardown (UART/JTAG)
- Companion mobile app and cloud API testing
- Retest

### Advanced IoT Assessment: $18K

Security test of up to 3 device models. Adds firmware extraction and analysis, hardware interface testing (UART/JTAG/debug ports), wireless protocol review, and one retest.

Limits: devices 3

Includes:
- Everything in the Basic tier, for up to 3 device models
- Firmware extraction, static analysis and secrets review
- Hardware debug interface testing
- Wireless protocol review (e.g. BLE, Zigbee, Wi-Fi)
- One retest of fixed findings

Excludes:
- Companion mobile app testing
- Cloud backend / API penetration testing
- Network-wide deployment analysis

### Enterprise IoT Assessment: $30K

Ecosystem assessment: up to 6 device models plus 1 companion mobile app, 1 cloud API/backend and the deployment network. Includes firmware analysis, device-to-cloud trust review, network segmentation analysis, compliance mapping and an implementation roadmap.

Limits: devices 6, mobile apps 1, apis 1

Includes:
- Everything in the Advanced tier, for up to 6 device models
- Testing of 1 companion mobile app
- Testing of 1 cloud API / backend
- Deployment network and segmentation analysis
- Compliance mapping and implementation roadmap
- One retest

Excludes:
- Hardening implementation and monitoring setup (see IoT Security Hardening Program)
- Industrial / OT environments (see IIoT Security Assessment)
- More than 6 device models

## Terms

Starting price shown is the lowest published tier. A written proposal fixes scope, tier and price before anything is signed. Timeline is set in the SOW.

Scope this engagement: https://cisomarketplace.services/scope?service=iot-security-assessment