OT Cyber Security Assessment & IoT Penetration Testing

OT and IoT security assessment pricing typically ranges from £8,000 to £30,000 or more depending on scope, environment complexity, and testing depth. A standard OT architecture review and passive network assessment for a single site averages £8,000 to £12,000. Comprehensive assessments including firmware extraction, hardware hacking, and protocol fuzzing typically cost £15,000 to £25,000. Large industrial environments with multiple sites, complex SCADA/DCS architectures, or safety-critical systems under NIS Regulations scope typically cost £20,000 to £30,000 or more. Device-specific IoT penetration testing (single product, embedded device) starts from £6,000 for firmware analysis and hardware testing. We provide fixed-price quotes after reviewing your architecture diagrams and testing objectives.

IT security tools and methodologies are fundamentally incompatible with OT environments. Standard vulnerability scanners such as Nessus and Qualys can crash PLCs and SCADA systems. We have seen a basic nmap scan take down a production line. IT security teams prioritise confidentiality; OT prioritises safety and availability. Those are different risk hierarchies requiring different expertise. Industrial protocols (Modbus, DNP3, BACnet) require specialist knowledge that IT security teams rarely possess. OT vulnerabilities often exist in proprietary firmware, hardware interfaces, and protocol implementations that IT scanners cannot assess. IEC 62443 and NIS Regulations require OT-specific assessments by qualified specialists. Most organisations use their IT security team for corporate environments while engaging OT specialists for industrial control systems.

Only with extreme caution, and typically only passive analysis. On live SCADA and ICS networks, we use passive PCAP capture: asset enumeration, protocol fingerprinting, and communication mapping without sending unsolicited packets. Active exploitation is performed in a lab environment or during agreed maintenance windows to ensure no impact on safety systems or production continuity. For critical systems, we request a digital twin or test environment that mirrors production.

Yes. True air gaps are rare in modern industrial environments. Most air-gapped networks have some connectivity for remote monitoring, vendor support, or data historians. USB drives and maintenance laptops bridge air gaps (Stuxnet demonstrated this). Wireless protocols such as ZigBee, LoRaWAN, and proprietary RF may provide unintended connectivity. IT/OT convergence initiatives are deliberately connecting previously isolated systems. Even truly isolated systems require security assessment to identify vulnerabilities that could be exploited if the air gap is bridged in future. OT security assessment validates your segmentation controls and identifies risks regardless of connectivity assumptions.

Yes. Our hardware lab is equipped with logic analysers, soldering stations, hot-air rework stations, and chip readers to extract data directly from flash memory and EEPROMs. We perform chip-off NOR/NAND and eMMC extraction, JTAG/SWD debugging on ARM, MIPS, and RISC-V targets, and UART/SPI/I2C interface analysis. The extracted firmware is reverse engineered using Ghidra and binwalk to identify hardcoded credentials, backdoors, and exploitable vulnerabilities.

Yes. Our testers have backgrounds in industrial automation and control systems engineering. We speak Modbus, Profinet, EtherNet/IP, DNP3, BACnet, IEC 61850, and OPC UA. We understand that an unsolicited nmap scan can crash a PLC, and we know how to assess industrial protocol security without causing downtime. We are not IT penetration testers rebranded as OT specialists.

In IT, confidentiality is the priority. In OT, safety and availability come first. That difference drives every aspect of methodology: passive-first on live networks, isolated lab environments for active and destructive testing, engineering-language reporting, and compliance mapping against IEC 62443 and NCSC CAF rather than CVE databases alone. Our methodology is designed by engineers who understand that a misconfigured scan can halt a production line.

Yes. For Operators of Essential Services under the UK NIS Regulations 2018, our assessment methodology maps directly to NCSC CAF Objectives B4 (System Security) and B5 (Resilient Networks and Systems), the two objectives most commonly flagged in OT improvement notices. Our deliverables include a CAF objective mapping table showing achieved, partially achieved, and not achieved status for your OT environment, an executive summary suitable for board reporting, and a technical findings annex formatted for engineering and IT teams. The assessment documentation can be submitted to your competent authority to demonstrate meaningful progress against an improvement notice. We have delivered assessments for Operators of Essential Services in energy, water, and transport sectors.