Clear answers before you test your radio links or hardware

A radio penetration test looks at the wireless side of your systems the way an attacker within range would. At Penthertz we treat the radio link itself as the attack surface: Wi-Fi, Bluetooth and BLE, RFID and NFC, sub-GHz and LoRa, 2G-to-5G mobile networks, satellite and drone links. Using software-defined radio and our own tooling, we capture, decode, replay and forge signals to reach the device or the network behind them. You get a clear picture of what someone within radio range could actually do, and the evidence to fix it.

A classic pentest starts from the network or the web application and assumes the attacker is already on the wire. It rarely touches the radio or the electronics inside a product. Penthertz starts one step earlier, over the air and on the board: a rogue base station, a cloned badge, a replayed remote, a firmware dump pulled straight from a chip. We still cover the classic layers once we are in, but the entry point is the wireless and hardware attack surface that standard tests leave untested. That is usually where a connected product is weakest.

The Radio Equipment Directive, through the harmonised standard EN 18031, and the Cyber Resilience Act set security obligations for connected and radio products sold in the EU. In practice they ask you to prevent unauthorised access, protect personal data and guard against network disruption, then show evidence that you did. Penthertz reads those requirements against your real product, tests the radio and firmware the way an assessor would, and produces the technical evidence your notified body or market surveillance will expect. We focus on the testing and the proof, alongside your compliance team.

Most Penthertz assessments run between one and four weeks of testing, depending on scope. A single protocol or one device is usually about a week; a full product, a private 5G network or an over-the-air red team is longer. We scope the work with you in a first call, then send a fixed-price proposal with a clear start date, duration and the engineer who will run it. Public training sessions last two to five days. If you have a hard deadline, such as a certification date, tell us early and we will plan the work around it.

Penthertz works on fixed-price proposals, not open-ended day rates, so you know the cost before the work starts. The price depends on scope: the number of protocols, devices or sites, the depth of analysis, and whether you need vulnerability research up to a CVE. A focused test on one radio protocol is far smaller than a multi-site red team or a private lab build. After a short scoping call we send a written proposal with the deliverables, the timeline and the price. There are no licence fees: you keep the right to use any tooling we build for you.

Yes. Penthertz is registered in France, with offices near Paris and a lab, but most of our work is international. We run assessments remotely and on site across Europe and beyond, and we have trained and spoken at conferences on several continents, including Black Hat, Hardwear.io, Troopers, Hack In The Box and DEF CON. Reports and trainings are delivered in English or French. For on-site work we agree travel and scheduling in the proposal. Wherever your product, network or team is, we can usually arrange to test it or train there.

Yes. Penthertz works under a mutual NDA before any technical detail is exchanged: we can put ours in place quickly, or review and align on yours, so both sides are protected. Findings, reports and any data we touch stay between us and your team; we never publish a client vulnerability without written permission, and when we do public research it is on our own targets or with explicit consent. Raw data is kept only for as long as the engagement needs it and then removed on request. A named engineer owns your file from the first call to the final report.

Yes. Penthertz is a registered French training organisation, and our courses are taught by the engineers who run the assessments, including the author of RF Swift. We cover RF and SDR, mobile and 5G, hardware and IoT, and red-team techniques, live on your site, at a conference, or on demand through our Hackademy platform. Every live course comes with a hardware kit your team keeps. We also build tailored programmes around your own products and protocols, so your engineers can carry on testing in-house after we leave.