IoT & OT Security Assessment in India & UAE — ICS, SCADA, smart products.
OT-aware penetration testing for industrial control systems, smart meters, BMS, medical devices and connected products. We test live without tripping safeties, map IT→OT pivot paths, and report in language your plant manager and your auditor both accept.
Wrong tooling on a process network trips real things.
A misfired Nmap run can drop a turbine. We treat OT engagements with the same safety mindset your reliability engineers do — written envelope, passive-first, ICS-validated tooling, stop signals.
IT optimises for confidentiality. OT optimises for safety and availability — in that order.
- A 30-second outage on Modbus is a process incident, not a ticket
- Engineering changes follow MoC, not Jira tickets
- Devices are rated for 20-year service · patching is rare
Modbus, S7, DNP3 and IEC-104 were designed for serial buses inside a fence. Now they ride Ethernet.
- Most field protocols have no authentication at all
- Generic scanners crash banner-less ICS stacks
- Even read-only probing can change asset state
An OT finding maps to a process consequence — pressure relief, valve drift, generator trip.
- Findings must read in physics + safety language
- Risk is measured against PHA / HAZOP — not CVSS alone
- Mitigations have to clear MoC + commissioning windows
Five layers, one pivot path.
The Purdue reference model is how every OT auditor thinks about your plant. We assess every layer — corporate IT, the industrial DMZ, operations, supervisory control and the process — and demonstrate how an attacker walks from a phishing email to a setpoint change.
- Tiered admin model + jump-host audit
- OT zone & conduit diagram per IEC 62443-3-2
- Engineering workstation hardening review
- IT→OT pivot demonstration (read-only by default)
- Safety-instrumented-system isolation validation
Twelve protocols we see on every plant floor.
Each one carries a different blast radius. We carry the ICS-specific tooling and the operator-side know-how to validate which ones are exposed — without bricking the device under test.
Unauthenticated function-code writes
Plaintext stop/start CPU + program upload
Secure Auth often disabled · replay
No authentication · spoofable ASDU
Multicast L2 · trip-command spoofing
DCP discovery + unauthenticated writes
Broadcast write-property · setpoint manip
Cert pinning skipped · self-signed trust
Wildcards + missing ACLs · anon publish
AppKey reuse · downlink injection
Touchlink commissioning + key leakage
Instrument config + calibration spoof
Hardware. Firmware. Radio. Cloud.
Product-side IoT testing is its own discipline. We extract firmware, walk JTAG / UART / SPI, replay BLE pairing, fuzz LoRa downlinks and test the cloud back-end and OTA pipeline — because a fielded device gets attacked at every layer the vendor forgot.
- ▸Debug interfaces: UART, JTAG, SWD, SPI flash dump
- ▸Glitching / fault-injection on secure boot
- ▸Voltage rail probing + clock-edge analysis
- ▸Tamper-evidence + sticker / seal review
- ▸Binwalk extraction + Ghidra reverse engineering
- ▸Hard-coded creds, private keys, debug back-doors
- ▸Insecure update / OTA signature bypass
- ▸Cryptographic primitive misuse (ECB, static IV)
- ▸BLE pairing replay + GATT enumeration
- ▸Zigbee touchlink + key extraction
- ▸LoRaWAN AppKey reuse · downlink injection
- ▸Sub-GHz / 802.15.4 / NB-IoT SDR capture
- ▸MQTT / CoAP broker ACL bypass
- ▸Cross-account device-claim takeover
- ▸Companion-app pinning + provisioning flow
- ▸OTA bucket exposure + update-server abuse
The OT/IoT bill is coming due.
Power, water, oil & gas, manufacturing and connected-product makers are now inside the regulatory frame in both India and the GCC. The question is no longer if OT will be audited — it’s whether the report passes.
- Avoid the headline-grade incidents (Colonial, Oldsmar, Stuxnet-class) before regulators force the question
- Satisfy IEC 62443, NIS2, NCA-ECC OT controls and India's CEA cyber security guidelines for power utilities
- Quantify IT→OT pivot risk concretely — not as 'air-gap assumed'
- Build the OT asset inventory + network baseline that compliance keeps asking for
How a Macksofy OT engagement actually runs.
Six stages, three-to-five weeks for a typical site assessment. Built around your reliability and safety engineers — not around our toolkit.
- 01Safety envelope & scoping
Site walk-down with reliability + safety. PHA review. Zone & conduit map. Stop-test signals.
3–5 days - 02Passive discovery
SPAN / TAP capture for Modbus, DNP3, S7, Profinet, OPC UA, BACnet, IEC-104. Asset inventory build.
5–7 days - 03IT / OT boundary
DMZ + jump-host audit. EWS hardening. Vendor / remote-support exposure mapping.
3–4 days - 04Targeted active testing
ICS-aware validation. HMI + historian auth. Firmware reverse-engineering. Wireless audit.
5–8 days - 05Pivot simulation
Read-only IT→OT lateral path demonstration. EWS → PLC capability. SIS isolation validation.
2–3 days - 06Report & retest
IEC 62443 + MITRE ATT&CK ICS mapping. Plant-manager + CISO summary. 60-day retest.
4–5 days
We don’t just bolt OT onto a pentest service line.
OT requires operator-grade discipline plus offensive-security tradecraft. Here’s what makes a Macksofy industrial engagement different.
CERT-In empanelled auditor with operators carrying IEC 62443 cybersecurity practitioner credentials alongside OSCP.
Passive-first, written safety envelope, ICS-validated tooling. No Nessus storms on a Modbus segment.
Findings are mapped to process consequence, PHA / HAZOP categories and MoC realities — not just CVSS.
Fix it, ship it, ping us. We re-test every High / Critical free of charge and issue a closure letter your auditor will accept.
What we found inside real OT estates.
220 kV substation SCADA + RTU fleet
Finding · Engineering workstation reachable from corporate AD with cached domain creds → PLC logic-modification capability across three substations
Critical — IT→OT pivot path closed via jump-host + tiered admin model before the next CEA audit cycle
DCS + safety instrumented system review
Finding · Vendor remote-support VPN terminated inside Level 2 with no MFA + shared service account
High — replaced with broker-mediated session + per-engineer credential within the engagement window
BMS + CCTV + access-control fabric
Finding · BACnet broadcast write-property exposed on guest VLAN → HVAC setpoint manipulation possible from break-room jack
High — segmentation + BACnet/SC migration roadmap delivered
Built for the process network.
The same tooling used by national lab OT teams and ICS vendors’ own pre-release hardening squads — never a generic IT scanner pointed at a PLC.
One engagement, every OT framework.
Findings are mapped so a single Macksofy OT assessment satisfies IEC 62443, NIST SP 800-82, MITRE ATT&CK for ICS, CEA cyber guidelines (India), NIS2 (EU), NCA-ECC OT controls (KSA) and CERT-In advisories.
Information security audit empanelled by Indian CERT
RBI Cyber Security Framework + System Audit Reports
Cybersecurity & Cyber Resilience Framework for capital markets
ISMS implementation, internal audit and certification support
Payment card industry — ASV scans, internal audit, pentest
Article 32 controls, DPIA, data flow mapping
Healthcare data protection (relevant for India + UAE health-tech)
UAE National Electronic Security Authority compliance
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things people ask before signing.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements