Do you sell a connected device in the EU? Since 1 August 2025 its radio equipment must meet the RED cybersecurity requirements. We test the device and its companion app and give you the evidence for your technical documentation.
For manufacturers of internet-connected radio equipment and the companion apps that control it.
The RED delegated act (EU) 2022/30 activates the cybersecurity essential requirements of the Radio Equipment Directive, Article 3(3), for internet-connected radio equipment, applicable from 1 August 2025. They cover network protection, protection of personal data and privacy and protection against fraud.
The harmonized standards EN 18031-1, -2 and -3 give presumption of conformity: a device assessed against them is taken to meet the requirements. Your technical documentation has to include the test evidence behind that assessment.
The device is usually controlled from a mobile app, so the app and its channels are part of the attack surface. Depending on your product, testing can cover:
States what we tested: the companion app, the device interfaces and the build in scope, and the result for each applicable EN 18031 requirement, whether or not we found vulnerabilities. Every finding includes evidence, reproduction steps, impact, a CVSS score and vector, CWE and, where they apply, OWASP MASWE references, and how to fix it.
Covers the scope and build tested, the results and the priorities, for management and non-technical readers.
If you include the retest, we send a new version of the report with the status of each finding on the new build, so your technical documentation reflects the fixed version.
We published how we analyzed the app of a Legrand/BTicino connected video intercom until we could open the door from Home Assistant. Pairing, the cloud API and the update path are our daily work, not the edge of it.
Our team comes from security certification laboratories, with experience in schemes such as Common Criteria and EMVCo SBMP. We contribute to OWASP MASVS and MASTG, and OWASP recognized this by naming vulnit an OWASP MAS Advocate.
Chameleon gives us deep visibility into what the app does inside the operating system, which makes the analysis faster and more thorough. The controls that usually slow testing down, such as root, pinning and anti-instrumentation checks, are handled at the OS level by default.
Meet the teamThe RED cybersecurity requirements of Article 3(3)(d), (e) and (f) apply from 1 August 2025 for internet-connected radio equipment. The harmonized standards EN 18031-1, -2 and -3 give presumption of conformity.
If you apply EN 18031 in full, you can self-assess (Module A) and our test report is supporting evidence for your technical documentation. A notified body (EU-type examination) is only needed where the harmonized standard is not applied or not fully met. We are not a notified body: we produce the test evidence. We can pre-evaluate your device before a notified body if that route applies.
The RED governs the radio equipment, but the companion app is part of how the device is used and attacked, so EN 18031 reaches the app and its channels. We test the app, the pairing, the cloud API and the update path as part of the device's security.
They overlap, and from December 2027 the Cyber Resilience Act takes over much of this ground for products with digital elements. We scope the tests so the same work serves both where they coincide.
No. By default, testing is black-box: we work with the same information an attacker would have, using the build you ship. If you prefer, we can also review the source code.
When needed. On Android we mainly work with Chameleon, our analysis environment: it gives us deep visibility into what the app does in the operating system, and handles root, pinning and anti-instrumentation checks at the OS level by default. For the device itself we work with a physical unit. On iOS we use physical devices.
It depends on the number of apps and platforms, the device interfaces in scope (for example Bluetooth, the cloud API and the update path) and the complexity of your product. We send you a proposal with a fixed price and the schedule. We can usually start the same week you accept the proposal; the start date depends on our team's workload and is stated in the proposal.
The app builds (APK or AAB for Android, IPA for iOS), one or more test devices, test accounts and access to the backend environments in scope. The proposal sets out the details.
English by default. If you need it in Spanish, just tell us.
We agree confidentiality terms before you share builds, documentation or devices. We have a standard NDA, but if you prefer to use yours, we are happy to review it.
Tell us about your device and its app. We reply within one business day to arrange a scoping call.
Talk to our team