Our Services
Comprehensive cybersecurity solutions to protect your organization
✅ EN 18031 Compliance Testing
Ensure compliance with the mandatory European cybersecurity standard EN 18031 for all internet-connected radio equipment.
About the EN 18031 Series
EN 18031 is the harmonized standard of cybersecurity requirements necessary for all internet-connected devices with wireless modules to comply with the European Union (EU) Radio Equipment Directive (RED) Articles 3.3(d,e,f). This standard is critical CE certification for organizations selling or planning to sell equipment in the EU with a wireless module and the ability to connect to the internet. There are three main categories of systems that fall under this standard:
- EN 18031-1 - Art 3.3(d): Any internet-connected radio equipment
- EN 18031-2 - Art 3.3(e): Devices which track personal and/or location data and childcare, toys, and wearable radio equipment
- EN 18031-3 - Art 3.3(f): Internet connected radio equipment processing virtual money or monetary value
Our Compliance Services
- Gap Analysis: Comprehensive assessment of current security posture against EN 18031-1, -2, & -3 requirements
- Risk Assessment: Identify and evaluate network and security assets via all attack surfaces
- Security Architecture Review: Evaluate network segmentation, access controls, and defense-in-depth
- Policy Review: Ensure security policies are aligned with applicable EN 18031 requirements
- Technical Controls Assessment: Run penetration tests on access control, authentication, secure updates, DDOS resilience, secure communication, and critical storage mechanisms
- Incident Response Planning: Review and assess procedures for addressing, patching, and releasing security fixes for cybersecurity incidents
- Documentation & Reporting: Complete compliance documentation for audits including an ICS/IXIT, coonformity test report, and evidence bundles
- Training & Awareness: Staff training on EN 18031 requirements
Compliance Process
- Initial Assessment: Identify applicable standards and document current state in initial ICS/IXIT
- Testing & Validation: Verify controls and mechanisms meet applicable EN 18031 requirements
- Roadmap Development: If non-conformities are identified, create prioritized plan to achieve compliance
- Implementation Support: Provide guidance and support for security control implementation
- Optional Retest & Validate: Verify applicable non-conformant controls now meet compliance
- Documentation: Prepare compliance evidence bundle, pen-test reports, and final ICS
- Ongoing Monitoring: Maintain compliance through regular assessments
Key Compliance Areas
Access Control
Access Control
Management of entities' access to critical assets
Authentication
Authentication
Authenticator applicability, strength, implementation, change procedure and brute force protection
Secure Updates
Secure Updates
Update integrity and authenticity protection and atomicity
Secure Storage
Secure Storage
Critical asset and confidential configuration data protection
Secure Communication
Secure Communication
Communication protocols, encryption, replay protection, and data transmission security
Resilience
Resilience
DoS/DDoS protection and system recovery
Monitoring & Logging
Monitoring & Logging
Security event detection and incident response
System Hardening
System Hardening
Configuration and known exploitation management, input validation, and interface documentation
Cryptography
Cryptography
Use of best practice cryptographic algorithms, key generation and management
Pricing
EN 18031-1, -2 and/or -3 compliance projects typically range from $5,000 to $20,000+ depending on system complexity. Many systems require compliance only to EN 18031-1 to achieve full conformance.
Request a Quote🔍 CVE Vulnerability Scanning
Stay ahead of threats with comprehensive Common Vulnerabilities and Exposures (CVE) scanning across your entire infrastructure.
What We Offer
- Automated Continuous Scanning: 24/7 monitoring of your systems for newly discovered vulnerabilities
- Comprehensive Coverage: Scan networks, applications, operating systems, and third-party components
- Prioritized Risk Assessment: CVSS-based scoring with business context to prioritize critical threats
- Actionable Reports: Detailed vulnerability reports with remediation steps and timelines
- Threat Intelligence Integration: Real-time updates from global threat databases
- Compliance Mapping: Align findings with regulatory requirements
Our Scanning Process
- Asset Discovery: Identify all systems, applications, and devices in your environment
- SBOM Generation: Create Software Bill of Materials for all components
- Vulnerability Detection: Deep scanning using industry-leading tools and CVE databases
- Analysis & Prioritization: Risk assessment based on exploitability and business impact
- Reporting: Clear, executive-level summaries and detailed technical reports
- Remediation Support: Guidance and support for addressing identified vulnerabilities
Pricing
Custom pricing based on infrastructure size and scan frequency. Starting from $599/month for SMBs.
Request a Quote🛡️ Penetration Testing
Simulate real-world attacks to identify security weaknesses before malicious actors exploit them.
Testing Methodologies
- Network Penetration Testing: External and internal network infrastructure assessment
- Web Application Testing: OWASP Top 10 and beyond for web-based applications
- Mobile Application Testing: iOS and Android app security assessments
- API Security Testing: REST, SOAP, and GraphQL API vulnerability analysis
- Cloud Security Assessment: AWS, Azure, and GCP configuration and security testing
- Social Engineering: Phishing simulations and security awareness testing
- Wireless Network Testing: Wi-Fi, Bluetooth security assessments
Testing Approach
- Planning & Reconnaissance: Define scope, objectives, and gather intelligence
- Scanning & Enumeration: Identify potential attack vectors and vulnerabilities
- Exploitation: Attempt to exploit vulnerabilities in controlled manner
- Post-Exploitation: Assess the extent of potential compromise
- Reporting: Comprehensive report with findings, evidence, and recommendations
- Remediation Verification: Re-test after fixes to verify effectiveness
Certification & Standards
Our penetration testing follows industry standards including:
- OWASP Testing Guide
- PTES (Penetration Testing Execution Standard)
- NIST SP 800-115
- PCI DSS Requirements (if applicable)
Pricing
Starting from $5,000 for basic web application tests. Full network and larger infrastructure stack penetration testing from $12,000+.
Request a Quote📱 Device & Application Security Assessments
Identify exploitable weaknesses across your product's entire attack surface — from firmware and APIs to user interfaces and communication protocols.
What We Test
- IoT Devices: Smart home devices, industrial sensors, connected appliances
- Embedded Controllers: Microcontrollers, PLCs, industrial control units
- Mobile Applications: iOS and Android apps with cloud connectivity
- Desktop Applications: Windows, macOS, and Linux software
- Web Interfaces: Browser-based control panels and dashboards
- Firmware: Boot loaders, operating systems, and embedded software
Our Assessment Methodology
- Hardware Analysis: Physical security, debug interfaces, chip-level vulnerabilities
- Firmware Reverse Engineering: Binary analysis, update mechanism testing
- API Security Testing: REST, MQTT, CoAP, and custom protocol analysis
- Communication Security: WiFi, Bluetooth, Zigbee, LoRa protocol testing
- Authentication & Authorization: Token handling, session management
- Data Protection: Encryption implementation, key storage, data leakage
- UI/UX Security: Input validation, injection flaws, privilege escalation
Testing Process
- Attack Surface Mapping: Identify all interfaces, protocols, and entry points
- Threat Modeling: Analyze potential attack vectors and abuse cases
- Security Testing: Automated and manual testing of identified vulnerabilities
- Exploitation Validation: Prove exploitability with proof-of-concept attacks
- Impact Assessment: Evaluate business and user impact of findings
- Remediation Guidance: Detailed fix recommendations and secure coding practices
Pricing
Device and application security assessments start from $6,000 depending on complexity and scope.
Request a Quote🔧 Secure Development and Lifecycle Review
Assess and improve your development practices, update mechanisms, and configuration management for compliance with EN 303-645, ISO/IEC 27034, and EN 18031 Annex E.
Who This Is For
- Product Teams: Building connected products or IoT devices
- SaaS Platforms: Cloud-based software and services
- Embedded Development: Firmware and embedded systems teams
- DevOps Teams: CI/CD pipelines and infrastructure as code
What We Review
- Secure Coding Practices: Code review processes, static analysis integration
- Security Requirements: Threat modeling, security user stories, acceptance criteria
- Update Mechanisms: Secure OTA updates, version management, rollback procedures
- Configuration Management: Secrets management, secure defaults, hardening guides
- Testing Strategy: Security testing integration, vulnerability scanning automation
- Supply Chain Security: Third-party dependencies, SBOM generation, license compliance
- Incident Response: Vulnerability disclosure, patching processes, communication plans
Compliance Standards Covered
- EN 303-645: ETSI cyber security for consumer IoT
- ISO/IEC 27034: Application security guidelines
- EN 18031 Annex E: Secure development lifecycle requirements
- NIST SSDF: Secure Software Development Framework
- OWASP SAMM: Software Assurance Maturity Model
Our Assessment Process
- Discovery Workshops: Understand current development practices and tooling
- Maturity Assessment: Benchmark against industry standards and frameworks
- Gap Analysis: Identify compliance gaps and security weaknesses
- Risk Prioritization: Focus on highest-impact improvements
- Roadmap Development: Phased implementation plan with milestones
- Implementation Support: Guidance on tool selection and process improvement
- Training & Enablement: Developer security training and awareness
Pricing
SDLC reviews typically range from $8,000 to $25,000 depending on team size and complexity.
Request a Quote☁️ Cloud, API & Infrastructure Security Reviews
Ensure your cloud-connected backend infrastructure, APIs, and control dashboards are hardened and compliant.
What We Secure
- Cloud-Connected IoT Systems: Device management platforms, telemetry systems
- SaaS Backends: Multi-tenant architectures, data isolation, API gateways
- Control Dashboards: Admin panels, monitoring interfaces, user portals
- Microservices: Container security, service mesh, inter-service communication
- Serverless Architectures: Lambda functions, event-driven security
Cloud Platform Coverage
- Amazon Web Services (AWS): EC2, S3, Lambda, API Gateway, IoT Core
- Microsoft Azure: VMs, Storage, Functions, IoT Hub, API Management
- Google Cloud Platform: Compute Engine, Cloud Storage, Cloud Functions, IoT Core
- Hybrid & Multi-Cloud: Cross-platform security, unified access control
Security Review Areas
- Infrastructure Configuration: IAM policies, network security groups, encryption
- API Security: Authentication, rate limiting, input validation, API abuse prevention
- Data Protection: Encryption at rest and in transit, key management, data retention
- Identity & Access Management: SSO, MFA, RBAC, privileged access management
- Network Architecture: VPC design, segmentation, DDoS protection, WAF configuration
- Logging & Monitoring: CloudTrail, CloudWatch, SIEM integration, alerting
- Compliance Validation: GDPR, ISO 27001, SOC 2, industry-specific requirements
Assessment Methodology
- Architecture Review: Document and analyze cloud infrastructure design
- Configuration Audit: Automated scanning with manual validation
- API Security Testing: Authentication bypass, injection, business logic flaws
- Penetration Testing: Simulated attacks on cloud infrastructure and applications
- Compliance Mapping: Validate against relevant standards and frameworks
- Hardening Recommendations: Prioritized remediation with configuration examples
Pricing
Cloud and infrastructure security reviews start from $10,000 depending on environment size and complexity.
Request a QuoteAdditional Services
Free EU RED Article 3.3(d,e,f) and EN 18031 consultation
Determine what requirements of the directive apply to your system to maintain CE certification.
Security Awareness Training
Educate your team on cybersecurity best practices and threat awareness.
Security Consulting
Strategic guidance on security architecture and governance.
Managed Security Services
Ongoing security monitoring and management as a service.