Hardware & IoT security testing · Netherlands
Independent security testing of connected devices and embedded products: from the circuit board and firmware to the app and the cloud behind them.
What is a hardware pentest?
Once a device is sold, anyone can open it up. A hardware security test looks at what they would find: ports left on the board, firmware that can be read out, wireless connections and the apps and cloud services the device relies on. The goal is to find weaknesses before your customers or attackers do.
Scoped to your product
Not every test covers every area. Which ones make sense depends on your device, and we agree the scope with you before testing starts.
EU rules for connected products
Applies since 1 August 2025
Internet-connected radio equipment sold in the EU, such as smart home devices, wearables and connected toys, must meet requirements on network protection, personal data and fraud. Harmonised standards EN 18031-1, -2 and -3 are one way to show this.
Reporting since 11 September 2026 · fully applies 11 December 2027
Covers hardware and software products with digital elements on the EU market. Among other things, products may not ship with known exploitable vulnerabilities, and manufacturers must handle and report vulnerabilities. Fines can reach €15M or 2.5% of global turnover.
A security test is not a certification or conformity assessment. It gives you findings and evidence you can use in your own security and compliance work.
How it works
Scope
You tell us about the product. Together we agree what is tested, the rules of engagement and what you provide, such as test units and documentation.
Testing
Specialists test the product within the agreed scope.
Report
You receive the findings, the evidence behind them and recommendations for fixing them.
Questions, answered
A hardware security test, or hardware pentest, examines a physical product the way an attacker with the device in their hands would. Testers look at the circuit board, the firmware, wireless connections and the apps and cloud services the device uses, to find weaknesses before someone else does.
The CRA does not prescribe a specific test. It does require that products are placed on the market without known exploitable vulnerabilities and that manufacturers handle vulnerabilities throughout the support period. Security testing is one common way to find vulnerabilities and document your efforts.
No. A security test gives you findings, evidence and recommendations. It is not a conformity assessment or certification. Where a third-party assessment is required, it is carried out by a notified body.
That depends on the product and scope. Hardware testing usually needs physical test units, and documentation helps. We agree the details during scoping.
WebSafety Ninja is based in the Netherlands. Contact us about products from elsewhere in the EU too.
It depends on the product, the scope and the number of interfaces involved. After a free consultation we give you a clear quote before any work starts.
Book a call
20-minute call. No sales pitch.
You'll leave with a scope and a price range.
Tell us what the device does, how it connects and what's driving the question: a launch, a customer or regulation. We'll help you work out a sensible scope.
Prefer email? hello@websafetyninja.com
