We're working on the design of an IoT product for one of our clients. We've come up with a general security scheme (no code has been written yet) and our client would like us to have it audited by an external auditor, in order to get complete guarantees before applying for a patent.

Who do you think we could consult?

Thank you in advance,


  • A lot depends on what the IoT device will be doing. If it only tweets, then there is little concern and almost any audit service would be fine (that is if you really want the audit). But if the device will process card transaction for example you will likely need to go through a PCI audit (depending on your jurisdiction). – grochmal Sep 24 '16 at 23:52
  • No PCI audit needed legally, but the device will hold some data which will give access to some user credentials. The device will communicate wirelessly with a computer or a smartphone, which itself will exchange data with a cloud infrastructure. We're looking for an audit service who will cover the different types of attacks (MITM, eavesdropping, intrusion in the infrastructure, cloning, etc). – Vincz777 Sep 25 '16 at 7:05
  • Hi Vincz777 - there are various companies that do this, from small to global, but we aren't in a position to recommend any. – Rory Alsop Sep 25 '16 at 12:44

Browse other questions tagged or ask your own question.