What does securing a connected product actually involve?

The whole chain, not one layer: secure boot and a hardware root of trust so only your signed firmware runs, a per-device identity from your own PKI, encrypted transport over TLS or mutual TLS, signed and verified OTA updates, and penetration testing plus compliance mapping so you can prove it, not just claim it.

Which standards and regulations do you build to?

We build to the consumer IoT baseline ETSI EN 303 645 and the NIST IoT guidance, and we map the product to the EU Cyber Resilience Act so it is ready for the audit rather than scrambling after a finding.

Can you secure a device we have already shipped?

Often, yes. We threat-model what is in the field, add per-device identity and signed OTA where the hardware allows, tighten transport and key storage, and tell you plainly where a hardware limit means the next revision has to carry the fix.

Do you do penetration testing as well as building the defences?

Yes. We threat-model the design, build the defences, then attack the result hands-on before it ships — secure boot, key storage, transport and the update path — so the weaknesses surface in our lab, not in the wild.

Alle Leistungen

IoT security

Ship devices that can’t be cloned, hijacked or recalled.

Security for connected products — from secure boot to the audit.

A connected product is only as safe as its weakest device in the field. We secure the whole chain — secure boot and a hardware root of trust, per-device identity, encrypted transport and signed updates — so your devices and their data can’t be cloned, hijacked or quietly recalled, and so the product passes the audit instead of becoming the headline.

Legen wir los Kanban öffnen

An abstract render of a secured connected hardware device

01 / What it gives you

From the silicon up to the audit.

Firmware that only runs if it’s yours

Secure boot and a hardware root of trust so a device starts your signed firmware and nothing else — tampered code never gets to run.

An identity no one can clone

Every device carries its own certificate from your PKI, so a leaked key compromises one unit, not the whole fleet.

Data that stays private in transit

TLS and mutual TLS on every link, so traffic between device and cloud can’t be read, spoofed or replayed.

Updates that can’t be tampered with

Signed, verified over-the-air updates so a hijacked update channel can never push someone else’s code to your devices.

02 / Stack

Die Technologie, mit der wir bauen.

Branchenstandard, langweilig im besten Sinne: Werkzeuge mit Zukunft, die auch der nächste Entwickler kennt.

Device trust

Secure boot
Firmware signed and verified at boot
TPM / secure element
Keys held in a TPM or secure element
PKI
Per-device certificates from your own PKI
mTLS
Mutual TLS so both ends prove identity

Communication

TLS
Encrypted transport for every link
Signed OTA
Firmware updates signed end to end
Certificate rotation
Certificates rotated before they expire
VPN
Private tunnels for fleet backhaul

Assurance

Penetration testing
Hands-on attacks before you ship
Threat modelling
Risks mapped while it’s still a design
ETSI EN 303 645
Built to the consumer IoT baseline
CRA compliance
Ready for the EU Cyber Resilience Act

03 / Vorgehen

Wie wir Dinge bauen, die bleiben.

Trust rooted in hardware

Secure boot and a hardware root of trust mean a device only runs firmware you signed — tampered or swapped code never starts.

An identity per device

Each unit gets its own certificate from your PKI, so a stolen key costs you one device, not the fleet.

Updates you can trust

Signed, verified OTA so a compromised update path can’t turn your devices into someone else’s botnet.

Proven, not assumed

Penetration testing, threat modelling and compliance mapping, so security is something you can show an auditor rather than just claim.

04 / Standards

Best Practices, die wir nicht auslassen.

Wir halten uns bei jedem Projekt an Branchenstandards und bewährte Methoden – sie sorgen dafür, dass der Kostenvoranschlag hält.

Verify firmware at boot from a hardware root of trust
Store device keys in a TPM or secure element, never in flash
Give every device its own certificate and revoke it cleanly
Encrypt every link with TLS — mutual TLS where both ends matter
Sign OTA updates and verify them before they install
Rotate certificates automatically, before they expire
Threat-model the product while it’s still on the whiteboard
Map the build to ETSI EN 303 645, NIST IoT and the EU CRA

05 / Infrastruktur

Wo es läuft und wie es am Laufen bleibt.

Secure boot and key storage in a TPM or secure element
Per-device PKI with clean issuance and revocation
TLS / mTLS transport and signed, verified OTA
Penetration testing and ETSI, NIST and CRA compliance mapping

Start

Ready to secure your devices before someone else does?

Tell us about your product and where you’re worried. A senior security engineer — not a sales rep — writes back.

Let’s manage IoT platform & cloud

Ship devices that can’t be cloned, hijacked or recalled.

Security for connected products — from secure boot to the audit.