-
EN 303 645 Testing
EN 303 645 is the European baseline cybersecurity standard for consumer IoT products. We assess your product against the standard's provisions, from forbidden default passwords and secure update mechanisms to data protection and communication security, produce gap findings and remediation advice, and support the assessment work that backs your declaration of conformity for the UK and EU markets.
-
EN 18031 Cybersecurity Testing
The EN 18031 series defines the cybersecurity requirements for radio equipment under the EU Radio Equipment Directive, mandatory in phases since August 2025. We evaluate connected products against the applicable articles covering access control, secure communication, software updates, and data protection, deliver gap analysis and remediation support, and prepare the technical evidence your conformity route requires.
-
Automotive Cybersecurity Testing
Cybersecurity assessment support for intelligent connected vehicles and their components, in-vehicle software, and connected cloud services. We work against ISO/SAE 21434 vehicle cybersecurity engineering and the UN R155 cybersecurity type-approval requirements, from CSMS gap analysis and threat analysis (TARA) to component and communication testing, and prepare the technical evidence your audit and type-approval route requires.
-
Cloud Security Assessment
Security assessment for cloud platforms and hosted business systems, covering identity and access management, service configuration baselines, network exposure, data protection, and workload security. We verify actual tenant-side configuration against cloud security baselines and compliance requirements, validate high-risk findings in a controlled manner, and deliver a prioritized remediation plan with recheck support.
Security Testing and Remediation
-
Penetration Testing
Authorized penetration testing that simulates real attacker techniques across web applications, mobile apps, host and intranet environments, and connected products. Engagements follow PTES and OWASP testing guidance to uncover exploitable weaknesses in authentication, access control, data protection, and configuration, and deliver a severity-rated report with reproduction steps, remediation advice, and retesting support.
-
Vulnerability Scanning
Periodic, tool-driven vulnerability detection across hosts, web applications, and network devices, with every finding verified manually by security engineers to remove false positives. Deliverables include a severity-rated risk summary, remediation priorities, and a post-remediation rescan comparison that closes the loop — a broad, repeatable baseline check that complements in-depth penetration testing.
-
Mobile App Security Testing
Security testing for Android and iOS applications, mini-programs, and H5 apps, covering client-side code and local data storage, transport security, and backend API interfaces. Testing follows OWASP MASVS and OWASP testing guidance, and delivers a severity-rated report with reproduction steps, remediation advice for both client and server sides, and retesting support after fixes.
-
Source Code Security Audit
White-box source code security auditing that combines automated analysis with manual review by security engineers, locating injection, access control, sensitive-data hardcoding, and other flaws at the code level — including their root causes. Covering OWASP Top 10 and common CWE weakness types across web back ends, mobile apps, and embedded software, with actionable fix guidance for development teams.
-
Firmware Security Analysis
Firmware extraction, unpacking, and static analysis for connected devices, detecting hardcoded credentials, debug interfaces, weak service configurations, and insecure update mechanisms. Firmware-level findings back the security-update, secure-storage, and communication-protection provisions of EN 303 645 and EN 18031 assessments and supply-chain security reviews.
-
Vulnerability Analysis and Remediation
Reproduction, impact analysis, severity rating, root-cause analysis, and remediation advice for security findings from penetration tests, vulnerability scans, or certification gap assessments — followed by regression verification that confirms issues are genuinely resolved. Remediation records are organized to support EN 18031 and EN 303 645 certification filings and customer security reviews.
