NEWFree EU CRA product check · Nov 30Apply →
Security by industryPhysical AI product security roadmap

Home appliance & smart home
security roadmap

Before it enters the home, we break into it first

Hands-on hacks of real robot vacuums and wall pads · KISA IoT Security Certification follow-up audits

We attack in-home devices such as wall pads, robot vacuums and IP cameras — from hardware to firmware, apps and cloud — to see whether they can be taken over remotely.

For · Appliance & smart home device manufacturersRegulations · EU CRA · EU RED 3.3 · KISA IoT Security Certification
Opening the device to gain admin access via the UART port

EU CRA compliance,
together with ZIEN

For home appliances exported to Europe, EU CRA compliance is a must.

ROADMAP

Building home appliance security, from design to post-market

This is the home appliance and smart home security architecture ZIEN proposes. Protecting every layer of the device takes specific tasks at each stage.

01

Design

  • Threat modeling
  • Security requirements definition (RED 3.3 · CRA)
02

Development

  • Secure product development framework (SPDF)
  • SBOM creation & management
03

Verification

  • Security risk assessment
  • Penetration & fuzz testing
04

Certification & conformity

  • RED 3.3 conformity assessment (EN 18031)
  • CRA technical documentation & EU declaration of conformity
Launch
05

Post-market

  • Coordinated vulnerability disclosure (CVD) · PSIRT
  • Security updates & retesting
  • CRA vulnerability & incident reporting Mandatory from Sep 2026
What we protect
Every device layer
  • Hardware · debug ports
  • Firmware · bootloader
  • Wireless (Wi-Fi · BLE · Zigbee)
  • App · cloud integration
WHAT WE SOLVE

The tasks on your roadmap, solved by ZIEN

EU RED 3.3EU CRAKISA IoT Security CertificationWe prepare the cybersecurity documentation needed for certification and conformity assessment with three solutions
Roadmap · Design · Verification · Certification

Z-PEN

Offensive security experts break into your deviceWe attack the actual device and firmware, and turn the vulnerabilities we find into evidence for conformity assessment.
  • Threat model
  • Security risk assessment
  • Security test report (penetration testing & fuzzing)
Secure SDLC

Z-Series

Automated protection from the development stageAutomated firmware analysis, SBOM management and vulnerability remediation alongside your developers — all in one flow.
  • Automated firmware analysis & continuous assessment (Z-IoT)
  • SBOM generation & management (Z-BOM)
  • Vulnerability remediation & management with your developers (Z-ONE)
  • Support for running your SPDF
Post-market

PSIRT

With you to the end, even after launchWe take in vulnerabilities reported after launch and run disclosure, patching and retesting for you.
  • Vulnerability handling process (CRA)
  • CVD policy operations
  • Security update & retest response
PARTNER

We work with Bureau Veritas, a global certification body

In January 2026, we signed a product cybersecurity cooperation MOU with Bureau Veritas.

Read the MOU news (Korean) →
ZIENBureau Veritas
FAQ

Frequently asked questions

QWhich devices are covered?View details ▾

Connected devices used in the home, such as wall pads, robot vacuums, IP cameras and smart TVs.

01Wall pads02Robot vacuums03IP cameras · smart TVs
QDo you also cover EU RED 3.3 and the CRA?View details ▾

Along with testing, we check the requirements for EU RED 3.3 (EN 18031), the EU CRA and KISA IoT Security Certification, and prepare the documentation.

01EU RED 3.302EU CRA03KISA IoT Security Certification
QWhen do the regulations take effect?View details ▾

EU RED 3.3 has applied since August 1, 2025 to radio equipment placed on the EU market. Under the EU CRA, vulnerability and incident reporting obligations apply from September 11, 2026, and the full requirements from December 11, 2027.

01RED 3.3 · Aug 202502CRA reporting · Sep 202603CRA in full · Dec 2027
QDo products already on sale need testing too?View details ▾

Yes. Products on sale become risky when new vulnerabilities emerge, and CRA reporting obligations also apply to products already on the market. It's best to retest in step with your firmware update cycle.

01Testing products on sale02Retesting after updates03Reporting readiness
QHow do we prepare for KISA IoT Security Certification?View details ▾

We test against the certification criteria in advance to find gaps, then prepare the application documents with you once they're fixed.

01Pre-assessment02Gap remediation03Application documents
QWhat do we receive?View details ▾

Per-device vulnerabilities with reproduction steps, certification documentation, a remediation guide and retest results.

01Vulnerability report02Certification documentation03Retest results
QDo you test the app and cloud as well?View details ▾

Yes. Beyond the device itself, we test the mobile app that controls it, the cloud servers, and the communication between device and server. Real attacks come in through these links.

01Device · firmware02Mobile app03Cloud · communications
QWhat happens if a new vulnerability emerges after launch?View details ▾

Using the product's SBOM, we immediately identify which products and versions a new CVE affects, and manage it with Z-Series so you can carry it through to remediation and reporting.

01CVE monitoring02Affected product identification03Remediation · reporting
CONTACT

Tell us about your devices and models

Just tell us what to test — we'll reply within 5 business days with a proposed scope and timeline.

support@zi-en.io · +82-70-4571-9854