Pentest & Red Team
We test your system the way an attacker would: from outside, over the air or directly on the hardware, without credentials you haven't given us. Then we walk your engineers through each step we took.
- Your system is built, deployed or about to ship
- It has a radio interface nobody has tested yet
- You want to see how an attacker would get in, not a checklist
- You need test evidence for NIS2 or the CRA
- The target includes a building, a vehicle or a drone
How it runs
We keep you informed during the work. Serious findings are reported the same day, not held back for the report.
Scoping
A short call about the system, what it transmits and what you are worried about. We then send a scope, a number of days and a price you can put on a purchase order.
Reconnaissance
Passive first: what transmits, what identifies itself and what answers without being asked. Many findings start here.
Attack
Active testing of the agreed targets: replay, forgery, protocol abuse, physical access, and hardware attacks such as side-channel analysis and fault injection, depending on the target. High-impact findings are reported the same day.
Reporting
Findings ranked by what an attacker could actually do with them, with reproduction steps, captures and a recommended fix.
Retest
When your team has deployed the fixes, we come back to check them. The retest is included in the price.
Deliverables
A report your engineers can act on, a summary your management can read, and everything needed to reproduce each finding.
- Technical report
- Findings, impact, reproduction steps and remediation for each issue
- Executive summary
- Two pages a non-technical reader can act on
- Captures and scripts
- The raw material behind each finding, so you can reproduce it
- Debrief session
- A walkthrough with your engineers, with time for questions
- Retest report
- What was fixed, what was not, and what changed
| Target | What that involves |
|---|---|
| Wireless products | Consumer or industrial devices with any radio interface |
| Mobile and private networks | Devices, radio access and core, 2G through 5G SA |
| OT and industrial radio | Telemetry, remote command, LoRa and proprietary links |
| Exotic communications | Satellite links, exotic receivers, proprietary, custom or undocumented links, whatever the medium |
| Vehicles | Key systems, V2X, GPS, telematics, V2G charging links, bus access over radio |
| Drones | Reconnaissance and hijack of control and video links, aerial RF assessment |
| Buildings | Access control, gates, badge systems, physical intrusion over the air |
| Embedded hardware | Debug interfaces, firmware, secrets at rest, side-channel analysis and fault injection |
| Full red team | An objective rather than a target list, radio as the entry path |
Frequently asked questions
Do you need our source code?
No. By default Penthertz works from the outside, exactly as a real attacker would, with no prior access to your code or internal documentation. That black-box approach shows what someone within radio range or on your site could actually reach. If you do share firmware, source code or design documents, we switch to a grey- or white-box engagement and go considerably deeper in the same number of days, because the time goes into testing rather than reverse-engineering. You choose the level of access up front and we scope the work accordingly.
Will you break the device?
It can happen, particularly with hardware attacks such as fault injection or glitching, where pushing a chip past its limits is part of the test. Penthertz never puts your equipment at risk by surprise: before we start we agree in writing which units may be sacrificed, which must come back intact, and how many spares you can provide. For anything irreversible we confirm with you first. That way you get the depth of a real hardware assessment without losing a device you still need in production.
Can you test a live deployment?
Often, yes, under conditions agreed in writing beforehand. Where transmitting on real frequencies could disrupt a service, break the law or affect third parties, Penthertz reproduces your setup in our shielded lab instead, so the risky part never touches your live environment. For radio work we hold the right equipment and follow the local rules on emissions. We plan the test window with your team, define clear stop conditions, and stay reachable throughout, so a production system is never left unattended during the assessment.
Who writes the report?
The engineer who did the testing. At Penthertz the person who found an issue writes it up, so the report explains exactly what was done, how to reproduce it and why it matters, with nothing lost through a second-hand summary. You get a clear technical account for your engineers and a readable synthesis for management, each finding rated and paired with a concrete fix. We walk you through it in a debrief call and stay available for questions while you remediate.
Talk to us about your project
We scope the work in a first call, then send a fixed-price proposal. We can put a mutual NDA in place before discussing details.