Penetration testing and vulnerability discovery for edge devices, for the companies that build them and the firms that run them.
We test the hardware, firmware, radio links, companion app, cloud API and on-device AI of connected devices, in our lab or remotely, under Rules of Engagement your company signs first.
We found CVE-2026-24148 in NVIDIA Jetson.
NIST rates it 9.4 Critical and NVIDIA, as the CVE Numbering Authority, rates it 8.3 High. We reported it to NVIDIA, and it is fixed in Jetson Linux 35.6.4 and 36.5.
What we test
Hardware and firmware
Debug ports such as UART, JTAG and SWD, the firmware read off the device and taken apart, secure boot, how updates are signed, and the keys and passwords stored on the board.
Network and radio
The services the device exposes on the network, and its Wi-Fi, Bluetooth Low Energy, cellular and other radio links.
Companion app and cloud API
The mobile app that controls the device and the cloud API behind it, including whether one customer's account can reach another customer's devices.
On-device AI models
Whether the model can be copied off the device, fooled with crafted inputs, steered by prompt injection when it is a language model, or swapped for a tampered file.
From the first call to the retest
Scoping
We agree which devices, firmware versions, apps and cloud services are tested, and what stays out.
Contract and NDA
A non-disclosure agreement, then a contract that sets the price, liability and insurance.
Signed Rules of Engagement
Scope, test windows, the techniques allowed, contacts and the stop procedure, signed by someone with authority over every device in scope. No test starts before it.
Testing
In our lab on devices you send us, logged from arrival to return, or remotely over a connection you provide, always inside the signed windows. A critical finding is reported to you at once.
Report
Each finding with its severity, the evidence, the steps to reproduce it and how to fix it, and a meeting to go through it.
Retest and disclosure
Retesting what you fixed is included in the price. A flaw in another company's component is reported to that vendor with your agreement.
The signed Rules of Engagement
What is tested, what is not, and when
The devices, firmware versions, addresses, apps and cloud services in scope, the ones excluded, and the days and hours testing may run.
What we may and may not do
One line per technique, marked allowed, not allowed, or only with your written approval at the time. Tests that can damage a device run only on units you set aside for them.
Who can stop the test, and how
Either side can stop testing with one call to the other's emergency contact. Testing resumes only after your written confirmation.
Someone with authority over every device in scope
Testing a system without its owner's consent can be an offence under the UK Computer Misuse Act 1990 and the Turkish Penal Code, so nothing starts before this is signed. When a device or service belongs to someone else, such as a cloud provider or one of your customers, their consent is attached too.
Questions buyers ask
Who has to sign the Rules of Engagement?
Someone in your company with authority over every device and service in scope, usually a director or the head of security. If a service runs with a cloud provider or a device belongs to one of your customers, we confirm their permission before testing it.
Can testing damage our devices?
Some hardware tests can. They run only on units you set aside for them in the Rules of Engagement, and everything else is tested in ways that leave the device working.
What if you find a flaw in a chip or component we did not make?
We tell you first. With your agreement we report it to the component's vendor in confidence and request a CVE identifier. Your company's name stays out of any publication unless you agree to it.
Does this relate to the EU Cyber Resilience Act?
Since 11 September 2026, manufacturers selling in the EU must report actively exploited vulnerabilities in their products within 24 hours, and the Act's full requirements apply from 11 December 2027. Our report records what was tested, what was found and what was fixed.
Tell us which device you want tested.
We send a short scoping questionnaire, then a draft Rules of Engagement for you to review before anything is signed.
Talk to us