What to Include in Product Security Testing
What is included in a Product Security Test, often referred to as “the scope”, greatly depends on the product’s features and the customer’s specific security objectives. Each test is tailored to the technology stack, threat landscape, and operational context of the product, ensuring relevant and high-impact coverage.
During our planning with the customer and what we discover as penetration testers, we might find the testing to include a variety of elements, all which our team can assess. These layers are on hardware, infrastructure, software and network, as the picture below shows:
The Layers
Digging deeper into the layers, we see evidence of deeper layers, which our team can help assess. Read more about them in the grouping below.
Hardware Testing
Our hardware testing focuses on uncovering weaknesses across critical physical components. This includes chips and system-on-chips (SoC), memory such as DRAM and SRAM, storage types like ROM, EEPROM, Flash, and eMMC, as well as internal buses and SPI interfaces. Each of these layers exposes unique attack surfaces, and our specialized testing ensures they are thoroughly evaluated for security before your product reaches the field.
Mobile Security Testing
By analyzing the mobile application, we gain valuable insights into both the product’s features and potential vulnerabilities. This often reveals exposed functionality, weak authentication flows, or insecure data handling that could be leveraged in a broader attack against the product ecosystem.
Radio and WIFI
Wireless communication is a growing attack surface in modern products. Technologies like Bluetooth, Zigbee, LoRa, and sub-GHz protocols often suffer from weak encryption or flawed authentication, leaving them open to sniffing, replay attacks, fuzzing, or over-the-air exploitation. Wi-Fi adds further risk through insecure onboarding, poor network segmentation, and vulnerabilities which have enabled remote code execution even across air-gapped environments. At River Security, we assess these interfaces, uncovering real-world threats that traditional network testing often overlook.
Network Protocols & Interconnectivity
How a product communicates, internally and externally, is a critical factor in its security. Protocols like HTTP, MQTT, Modbus, CoAP, and even custom TCP/UDP implementations can expose products to risks such as unauthorized access, data leakage, and machine-in-the-middle attacks. Many embedded and IoT systems also rely on outdated or proprietary protocols with weak or no encryption. At River Security, we test these communication paths to uncover flaws in trust boundaries and interconnectivity that attackers could exploit to pivot, escalate privileges, or exfiltrate data across systems.
Infrastructure and Cloud
Cloud infrastructure and IoT cloud platforms are integral to modern product security testing, as they handle device management, data processing, and user interactions. Vulnerabilities in APIs, authentication mechanisms, cloud storage, or misconfigured identity roles can expose sensitive data or allow attackers to gain remote control over devices. These weaknesses can also enable lateral movement or pivoting between different customers’ environments!
Effective testing must assess both edge-to-cloud communication and backend infrastructure to prevent cross-customer compromise and ensure end-to-end product security.
Embedded Web Servers and More
Embedded web servers and HTTP-based interfaces are high-value targets in product security testing because they often serve as the primary interface for configuring, monitoring, or controlling a device. These components are frequently used in IoT, industrial control systems, and consumer electronics, yet they are notoriously prone to security flaws due to limited resources, legacy codebases, or poor development practices.
Firmware and Reverse Engineering
Firmware and reverse engineering play a central role in product security testing because firmware is often the heart of the device, containing its logic, trust anchors, communication protocols, and access control mechanisms. Analyzing firmware allows testers to understand the internal workings of a product, uncover hidden functions, and identify systemic vulnerabilities that are otherwise invisible from the outside.
The Full Stack Penetration Tester
Product Security Testing, sometimes referred to as Device or Hardware Security Testing, is a specialized area within penetration testing. It requires a skilled team to assess a broad range of technologies, attack surfaces, and potential threat scenarios, ensuring that products are evaluated against both known vulnerabilities and complex, real-world attack paths across hardware and software layers.
Instead of relying on a single individual to conduct penetration testing, River Security’s methodology is built around structured collaboration. Our approach enables fine-grained prioritization and efficient distribution of tasks across a skilled team, ensuring deeper coverage, faster execution, and a more thorough assessment of complex products.
Our goal is clear and focused: to ensure that our customers’ security posture aligns with the level users expect and assume. By identifying and addressing vulnerabilities early, we help prevent issues from being exploited in the wild- protecting both the product and the trust placed in it.
River Security Hardware Testing Lab
To uncover the kinds of vulnerabilities that matter at the hardware level, specialized tools and a controlled environment are essential. Our dedicated hardware lab enables deep technical analysis using techniques like fault injection, bus monitoring, and chip-level interrogation. This setup allows us to go far beyond surface checks, identifying weaknesses in components such as memory, storage, and internal communication pathways. This means greater assurance that your product has been rigorously tested under real-world attack conditions, before it ever reaches your customers.
At River Security, our dedicated lab is equipped to safely and thoroughly explore the full attack surface of the products we test. With specialized tools and controlled conditions, we can perform in-depth hardware and embedded security analysis while ensuring both the product and our equipment remain protected throughout the process.
Stories from our customers
“Partnering with River Security has given us real-time visibility and proactive protection for our expanding infrastructure. Their independent guidance and hands-on approach help us make informed decisions, ensuring our technology remains secure as we grow. It’s inspiring to work with a Norwegian tech company that truly understands our ambitions.”
ZaptecAs the uncertainty surrounding the situation in Europe continues, security in critical infrastructure is of higher importance than ever. Having an external party look at your company from an attackers’ point of view is crucial to identify weaknesses, but also to confirm good measures already in place.
Through a tendering process, we invited River Security to submit their proposal. They immediately understood the assignment, still they challenged us and brought life to new ideas and concepts.
Endgame was that they suggested a multi-phase delivery covering exactly what we (didn’t know we) needed. This made it easy to conclude what vendor to appoint amongst strong competitors.
They started with conducting an external digital footprint to give us an overview of all our digital assets and continued to perform inside penetration testing both remote and on-site.
At the end of the delivery, they held a thorough workshop to go through their findings and suggested measures to mitigate and reduce the risk of being successfully hacked by cyber criminals.
We receive complete reports from every phase, in addition to an executive summary describing what measures we need to focus on first.
Our experience from working with River Security is exclusively positive. Their competence, adaptability and knowledge sharing are without comparison.
We can safely recommend River Security.
Sogn og Fjordane Energi“Rostein is pleased with the work and results, and the delivery and the report contained everything we needed. River Security’s thorough approach and comprehensive analysis met our expectations and helped us understand our security landscape better.”
RosteinAs part of our ongoing security efforts, we’ve engaged external experts, River Security, to assess our security posture. They specialize in offensive security, or “Red Team” activities, and we affectionately refer to them as “kind bandits.”
The exercise aimed to uncover:
- Unknown attack surfaces and vulnerabilities
- Potential information leaks
- Opportunities to enhance security
Results:
- 10 domains, 89 subdomains, and 87 applications reviewed
- Some third-party apps needed upgrading
- Internal tools unnecessarily accessible online
- Vulnerabilities to “User Enumeration Attack” identified
- Incomplete security headers (CSP, HSTS, SPF, DKIM, DMARC) for some domains
No critical vulnerabilities or data leaks were found. One medium severity item that required a simple upgrade, while the rest where low-severity “hygiene points.”
Having an external perspective is invaluable. River Security’s professionalism, attention to detail, and well-executed process impressed us. Security is paramount, and partnering with experts like River Security reaffirms our commitment to safeguarding services and users.
External expertise is crucial in areas where we lack proficiency. River Security’s work provided assurance and a reminder of the perpetual need for improvement. Read full article here: https://stix.no/fokus-pa-sikkerhet/
StixRiver Security did a penetration test and assessment of the cyber security of our product. The team at River did a great job in understanding our systems in no time. They were highly efficient in analyzing every piece of our solution, both on our physical devices and on our cloud systems, and gave continuous feedback to us on things to improve. We got a thorough walkthrough of every vulnerability, their severity and guidance on how to fix them. This was very educational and insightful and gave our entire team a lot of motivation to increase and maintain a high level of cyber security. We would definitely recommend River Security.
Pascal Technologies