iotpentest
Map a device

About iotpentest.net

Updated

iotpentest.net covers penetration testing of IoT and embedded products: what a tester does to a connected device, and which EU obligation each test area answers to. Readers here sign declarations of conformity and answer to market surveillance authorities, so the provenance of the guidance is set out below.

Publisher

The site is published by SEQ SIA (reg. No. 40203410806), Lastādijas iela 12 k-3, Riga, LV-1050, Latvia, trading as OffSeq, a provider of penetration testing and security assessment services. Contact: support@offseq.com.

iotpentest.net is not affiliated with the European Commission, ENISA, CEN, CENELEC, ETSI, the IEC or any notified body, and nothing here is an official interpretation of any instrument it describes.

Authorship

SEQ SIA (OffSeq) is responsible for publishing, maintaining and updating this site. Articles use team attribution. Every regulatory statement carries a source so a reader can check the basis for it against the instrument itself.

How the guidance is sourced

  • Legal statements cite the instrument: Directive 2014/53/EU, Commission Delegated Regulation (EU) 2022/30 and its amending and repealing acts, Commission Implementing Decision (EU) 2025/138, Regulation (EU) 2024/2847 and Commission Implementing Regulation (EU) 2025/2392. Where a text is quoted, it is quoted from the published version on EUR-Lex.
  • Standards are cited from the publisher: ETSI for EN 303 645 and the IEC for the 62443 series. Paywalled definitions we have not read are not paraphrased; where that limits what we can say, we say so instead of guessing.
  • Incident figures come from named government advisories and agency reports. We do not publish vendor telemetry percentages about how many connected devices are insecure.
  • Bench descriptions are generalised from real engagements and never identify a client, a product or an unremediated finding.
  • The “Updated” date only moves when the text changes; an automated content-hash ledger reverts unearned bumps.

Commercial interest

We sell the testing this site describes. That is a direct interest in you concluding that you need it, and it should colour how you read every recommendation here.

  • Links to OffSeq are our own service links, not a market comparison. We do not rank or score competing providers or test houses.
  • No vendor, tool maker, notified body or certification scheme pays for a mention. There is no advertising and no affiliate revenue.
  • Where a product is outside a regime, we say so, including when that means a smaller engagement or none at all.

Scope limits

This site does not cover medical devices. Products in scope of Regulation (EU) 2017/745 or Regulation (EU) 2017/746 are excluded from the Cyber Resilience Act by its Article 2(2), and from the RED cybersecurity delegated regulation by its Article 2. They follow a different route and are out of scope here.

It is also not legal advice on whether a given instrument applies to your product, and it is not a substitute for your own conformity assessment or for advice from a notified body.

Corrections

Send corrections to support@offseq.com, ideally with the instrument and article you think we have misread. Substantive changes are made and re-dated in the open.