IoT & OT Security Assessment in India & UAE — ICS, SCADA, smart products.
OT-aware penetration testing for industrial control systems, smart meters, BMS, medical devices and connected products. We test live without tripping safeties, map IT→OT pivot paths, and report in language your plant manager and your auditor both accept.
What is IoT and OT security?
IoT/OT security protects the connected devices and industrial control systems (ICS/SCADA) that run manufacturing, energy, and utilities — where a safety-first approach matters more than IT patching. Macksofy assesses OT networks against IEC 62443 and NCIIPC guidance, segmenting the Purdue model without tripping production.
Wrong tooling on a process network trips real things.
A misfired Nmap run can drop a turbine. We treat OT engagements with the same safety mindset your reliability engineers do — written envelope, passive-first, ICS-validated tooling, stop signals.
IT optimises for confidentiality. OT optimises for safety and availability — in that order.
- A 30-second outage on Modbus is a process incident, not a ticket
- Engineering changes follow MoC, not Jira tickets
- Devices are rated for 20-year service · patching is rare
Modbus, S7, DNP3 and IEC-104 were designed for serial buses inside a fence. Now they ride Ethernet.
- Most field protocols have no authentication at all
- Generic scanners crash banner-less ICS stacks
- Even read-only probing can change asset state
An OT finding maps to a process consequence — pressure relief, valve drift, generator trip.
- Findings must read in physics + safety language
- Risk is measured against PHA / HAZOP — not CVSS alone
- Mitigations have to clear MoC + commissioning windows
Five layers, one pivot path.
The Purdue reference model is how every OT auditor thinks about your plant. We assess every layer — corporate IT, the industrial DMZ, operations, supervisory control and the process — and demonstrate how an attacker walks from a phishing email to a setpoint change.
- Tiered admin model + jump-host audit
- OT zone & conduit diagram per IEC 62443-3-2
- Engineering workstation hardening review
- IT→OT pivot demonstration (read-only by default)
- Safety-instrumented-system isolation validation
Twelve protocols we see on every plant floor.
Each one carries a different blast radius. We carry the ICS-specific tooling and the operator-side know-how to validate which ones are exposed — without bricking the device under test.
Unauthenticated function-code writes
Plaintext stop/start CPU + program upload
Secure Auth often disabled · replay
No authentication · spoofable ASDU
Multicast L2 · trip-command spoofing
DCP discovery + unauthenticated writes
Broadcast write-property · setpoint manip
Cert pinning skipped · self-signed trust
Wildcards + missing ACLs · anon publish
AppKey reuse · downlink injection
Touchlink commissioning + key leakage
Instrument config + calibration spoof
Hardware. Firmware. Radio. Cloud.
Product-side IoT testing is its own discipline. We extract firmware, walk JTAG / UART / SPI, replay BLE pairing, fuzz LoRa downlinks and test the cloud back-end and OTA pipeline — because a fielded device gets attacked at every layer the vendor forgot.
- ▸Debug interfaces: UART, JTAG, SWD, SPI flash dump
- ▸Glitching / fault-injection on secure boot
- ▸Voltage rail probing + clock-edge analysis
- ▸Tamper-evidence + sticker / seal review
- ▸Binwalk extraction + Ghidra reverse engineering
- ▸Hard-coded creds, private keys, debug back-doors
- ▸Insecure update / OTA signature bypass
- ▸Cryptographic primitive misuse (ECB, static IV)
- ▸BLE pairing replay + GATT enumeration
- ▸Zigbee touchlink + key extraction
- ▸LoRaWAN AppKey reuse · downlink injection
- ▸Sub-GHz / 802.15.4 / NB-IoT SDR capture
- ▸MQTT / CoAP broker ACL bypass
- ▸Cross-account device-claim takeover
- ▸Companion-app pinning + provisioning flow
- ▸OTA bucket exposure + update-server abuse
The OT/IoT bill is coming due.
Power, water, oil & gas, manufacturing and connected-product makers are now inside the regulatory frame in both India and the GCC. The question is no longer if OT will be audited — it’s whether the report passes.
- Avoid the headline-grade incidents (Colonial, Oldsmar, Stuxnet-class) before regulators force the question
- Satisfy IEC 62443, NIS2, NCA-ECC OT controls and India's CEA cyber security guidelines for power utilities
- Quantify IT→OT pivot risk concretely — not as 'air-gap assumed'
- Build the OT asset inventory + network baseline that compliance keeps asking for
How a Macksofy OT engagement actually runs.
Six stages, three-to-five weeks for a typical site assessment. Built around your reliability and safety engineers — not around our toolkit.
- 01Safety envelope & scoping
Site walk-down with reliability + safety. PHA review. Zone & conduit map. Stop-test signals.
3–5 days - 02Passive discovery
SPAN / TAP capture for Modbus, DNP3, S7, Profinet, OPC UA, BACnet, IEC-104. Asset inventory build.
5–7 days - 03IT / OT boundary
DMZ + jump-host audit. EWS hardening. Vendor / remote-support exposure mapping.
3–4 days - 04Targeted active testing
ICS-aware validation. HMI + historian auth. Firmware reverse-engineering. Wireless audit.
5–8 days - 05Pivot simulation
Read-only IT→OT lateral path demonstration. EWS → PLC capability. SIS isolation validation.
2–3 days - 06Report & retest
IEC 62443 + MITRE ATT&CK ICS mapping. Plant-manager + CISO summary. 60-day retest.
4–5 days
We don’t just bolt OT onto a pentest service line.
OT requires operator-grade discipline plus offensive-security tradecraft. Here’s what makes a Macksofy industrial engagement different.
CERT-In empanelled auditor with operators carrying IEC 62443 cybersecurity practitioner credentials alongside OSCP.
Passive-first, written safety envelope, ICS-validated tooling. No Nessus storms on a Modbus segment.
Findings are mapped to process consequence, PHA / HAZOP categories and MoC realities — not just CVSS.
Fix it, ship it, ping us. We re-test every High / Critical free of charge and issue a closure letter your auditor will accept.
What we found inside real OT estates.
220 kV substation SCADA + RTU fleet
Finding · Engineering workstation reachable from corporate AD with cached domain creds → PLC logic-modification capability across three substations
Critical — IT→OT pivot path closed via jump-host + tiered admin model before the next CEA audit cycle
DCS + safety instrumented system review
Finding · Vendor remote-support VPN terminated inside Level 2 with no MFA + shared service account
High — replaced with broker-mediated session + per-engineer credential within the engagement window
BMS + CCTV + access-control fabric
Finding · BACnet broadcast write-property exposed on guest VLAN → HVAC setpoint manipulation possible from break-room jack
High — segmentation + BACnet/SC migration roadmap delivered
Built for the process network.
The same tooling used by national lab OT teams and ICS vendors’ own pre-release hardening squads — never a generic IT scanner pointed at a PLC.
One engagement, every OT framework.
Findings are mapped so a single Macksofy OT assessment satisfies IEC 62443, NIST SP 800-82, MITRE ATT&CK for ICS, CEA cyber guidelines (India), NIS2 (EU), NCA-ECC OT controls (KSA) and CERT-In advisories.
Information security audit empanelled by Indian CERT
RBI Cyber Security Framework + System Audit Reports
Cybersecurity & Cyber Resilience Framework for capital markets
ISMS implementation, internal audit and certification support
Payment card industry — ASV scans, internal audit, pentest
Article 32 controls, DPIA, data flow mapping
Healthcare data protection (relevant for India + UAE health-tech)
UAE National Electronic Security Authority compliance
Rated 4.9 ★ from 612 client reviews.
“We've worked with three Big 4 firms before Macksofy. None found what their team did in our payments stack. The most actionable report we've received in a decade.”
“The CHFI training Macksofy delivered for our cyber cell raised investigation quality measurably. Practical, India-context-aware, and respectful of our operational realities.”
“Came in with zero security background. 5 weeks later I was running Burp Suite and Metasploit confidently. Cleared CEH on the first attempt.”
Things people ask before signing.
Where Macksofy delivers IoT / OT.
On-site engagements across India's BFSI, fintech, government and SaaS metros plus the UAE. Senior consultants fly from Mumbai BKC for kickoff, key reviews and exit briefings; remote weeks run through the rest of the engagement.
Macksofy delivers this work to the following standards and regulator requirements. Definitions and controls are sourced from the issuing bodies below.
Get a fixed-price proposal in 48 hours.
Tell us about your security need — pentest, audit, training or a wider engagement. A senior consultant will reply within a few business hours.
- CERT-In Empanelled
- EC-Council ATC · CompTIA Authorized
- 20,000+ professionals trained
- India + UAE engagements