Hardware & IoT
Board-level attack surface: UART, JTAG/SWD, SPI/I²C flash, debug interfaces, radios and physical tamper paths. We take the device apart so attackers can't.
Offensive security for connected products
Security testing
from firmware to cloud.
We're a small, senior team that tests the products you build: circuit boards, firmware, apps, APIs and the cloud behind them. We work by hand, from both the attacker's and the defender's side.
- L5CloudIAM · storage · tenancy
- L4Web / APIauthz · BOLA · logic
- L3Appsmobile · desktop
- L2Firmwareboot chain · OTA · secrets
- L1HardwareUART · JTAG · SPI · RF
● 5 layers in scope · one team · one report
- Manual-firstAI-assisted, human-driven
- Red + BlueFindings with fixes
- NationwideRemote, lab and on-site
- 1 business dayResponse to every inquiry
Services
Every layer an attacker would touch.
Connected products fail at the seams, where hardware meets firmware and firmware meets the cloud. We test across the whole stack so nothing falls between vendors.
Firmware Analysis
Extraction, unpacking and reverse engineering of embedded images. Secure boot, update signing, hardcoded secrets, memory-safety bugs and outdated components.
Web Apps & APIs
Manual testing of the web portals and APIs that devices and apps talk to, including broken object-level authorization (BOLA), authentication, business logic and multi-tenant isolation.
Cloud Security
Configuration and identity review of the AWS, Azure or GCP backend behind your product: device provisioning, IAM, storage exposure and blast radius.
Mobile Apps
iOS and Android companion apps: local storage, pairing flows, certificate pinning, API abuse and the trust the app places in the device.
Desktop Applications
Thick-client and desktop tooling: configuration utilities, update mechanisms, local privilege escalation, IPC and the protocols they speak to hardware.
Compliance Testing
Independent testing and documentation to support regulatory and customer requirements, with evidence written for the auditor as well as the engineer.
Not sure where to start?
Tell us what you're shipping. We'll recommend the smallest engagement that answers your real question.
Talk it throughApproach
Two faces. One engagement.
Janus, the Roman god of gates, looks in both directions at once, and so do we. Every engagement pairs an attacker's mindset with a defender's follow-through.
Offense
Think like the adversary
We chain small weaknesses into real impact, the way an actual attacker would. That's how we find what automated scanners miss.
Defense
Fix it so it stays fixed
Every finding comes with root cause, remediation and hardening guidance your engineers can act on right away.
-
01
Scope & threat model
Red + BlueWe map your architecture, trust boundaries and what an attacker actually wants from your product. Testing starts only after the rules of engagement are written down and agreed.
deliverable → Test plan · threat model
-
02
Attack-surface mapping
RedEvery way in: debug headers, radios, update paths, API endpoints, cloud identities and the people and processes around them.
deliverable → Attack-surface inventory
-
03
Hands-on exploitation
RedManual, expert-driven testing. AI handles the tedious work, like triage, diffing and enumeration, so our time goes to the bugs that matter. We report critical findings the day we confirm them.
deliverable → Same-day critical alerts
-
04
Defensive analysis
BlueFor each finding we trace the root cause and give remediation, hardening and detection guidance written for your actual stack, not generic advice.
deliverable → Remediation guidance
-
05
Report & readout
Red + BlueAn executive summary for leadership and reproducible technical findings with evidence and severity ratings, followed by a live walkthrough with your engineers.
deliverable → Report · readout call
-
06
Retest & attestation
BlueOnce fixes ship, we verify them and give you a letter of attestation to share with customers, partners or regulators.
deliverable → Retest report · attestation letter
FAQ
Straight answers.
What do you need from us to get started?
A short call and whatever you have: architecture diagrams, API docs, firmware images, or just the device in a box. We turn that into a written scope and fixed quote, usually within a few business days.
How long does an engagement take?
Most focused assessments run one to three weeks of testing. Full-stack device engagements covering hardware through cloud usually run longer. We'll give you a timeline with the quote.
Do you work on-site or remotely?
Both, nationwide. Most hardware is shipped to us for lab testing. Web, API and cloud work is done remotely, and we travel when the work requires it.
Will you sign an NDA?
Yes. Mutual NDAs are standard, and we're happy to review yours before scoping.
How do you use AI?
As an assistant, not the assessor. People drive every test and validate every finding. AI speeds up repetitive work like triage and enumeration. We only use AI tooling on your data when your engagement's rules of engagement allow it.
What does the report look like?
A concise executive summary, then each finding with severity, affected components, reproduction steps, evidence and specific remediation. We walk your team through it live.
Can you help with FDA premarket or other regulatory submissions?
We provide independent penetration testing and documentation that supports cybersecurity sections of premarket submissions and standards like ETSI EN 303 645 and IEC 62443. We don't replace your regulatory counsel.
Do you retest after we fix things?
Yes. Retesting is part of how we work, and it ends with an attestation letter you can share.
Do you build software?
Our focus is assessment, but we take on select custom security tooling and software projects. Ask us.
Contact
Tell us what you're building.
A few details help us come back with a useful answer instead of a sales call. Replies within one business day.
- emailcontact@janussecurity.org
- phone+1 (309) 621-1474
Careers
We're not hiring right now. If you break hardware for fun and write clear reports, send us a note anyway. We keep a short list. contact@janussecurity.org