IoT security certification: a three-step path, validated through practice

By Lionel

November 13, 2026

4 min read

DVID IoT and embedded security certification path

How can you tell whether someone really knows how to assess the security of a connected device? A résumé that mentions “IoT” says nothing. A general-purpose penetration testing certification does not say much more: it validates web and network skills, rarely the ability to extract a firmware, sniff a bus or analyze a radio link.

This is the question DVID’s new certification path sets out to answer. It is built like our trainings: real hardware, field scenarios, and a validation based on what candidates can do, not just on what they can recite.

Why a certification dedicated to IoT

Three observations keep coming up with our customers.

IoT skills span several professions. Electronics, firmware, radio, mobile, cloud. Few profiles cover the whole chain, and no common framework makes it possible to check which ones do.

Security decisions are not made by experts alone. A buyer selecting a sensor, a project manager integrating a gateway, an integrator installing remotely maintained equipment: every day they make decisions that affect the security of the system. The attack on supermarket refrigeration controllers in October 2026 was a reminder: the causes lay in purchasing, installation and maintenance.

Regulation requires proof of competence. The Cyber Resilience Act and IEC 62443 require regular security testing of products. You still have to be able to show that the people who design and test them have the required level.

The path at a glance

Step	Certification	For whom	Validation
1	DVID IoT Security Foundations	Technical buyers, project managers, integrators	40-question multiple-choice exam (70% pass mark) and a graded security acceptance test
2	Expert common core	Technical profiles aiming for an Expert certification	Prerequisite for both specializations
3	DVID Embedded Pentest Expert or DVID IoT Pentest Expert	Pentesters, auditors, product security engineers	24-hour hands-on exam, followed by a graded report

The path is progressive. Foundations lays the groundwork. The Expert common core prepares for the two specializations, between which candidates choose according to their job.

DVID IoT Security Foundations

Understand how a device is attacked in order to choose it, integrate it and accept it.

Foundations does not train pentesters. It is aimed at people who buy, manage or deploy connected devices and who need to understand their suppliers’ answers.

Audience: technical buyers, project managers, integrators.
Effort: a 29-hour core, about 4 days.
Validation: a 40-question multiple-choice exam with a 70% pass mark, complemented by a graded security acceptance test.
Framework: partial coverage of the Cybersecurity Implementer profile of the European ECSF framework.

The security acceptance test is what sets Foundations apart from simple awareness training. Candidates do not just answer questions. They run an acceptance test on a piece of equipment and give a reasoned opinion, as they would when receiving a product.

For a concrete illustration of the target level, see our article on the 5 security questions to ask before buying a connected device.

Hands-on penetration testing exam on an embedded device

The Expert certifications

After the common core, two specializations are available.

DVID Embedded Pentest Expert focuses on the device itself: hardware, debug interfaces, communication buses, firmware extraction and analysis.

DVID IoT Pentest Expert extends the scope to the device’s whole ecosystem: radio links, update mechanisms, cloud services, LoRaWAN networks (coming soon).

Both rely on the same exam principle:

24 hours of hands-on work on a target to audit, with no questionnaire.
A graded report, because a vulnerability that is found but poorly described, poorly qualified or without actionable remediation is of no value to the customer.
Framework: the ECSF Penetration Tester profile.

If you are hesitating between the two, our article IoT pentest or embedded pentest: what are the differences? details the scopes.

Why rely on the ECSF

The ECSF (European Cybersecurity Skills Framework) is the framework published by ENISA, the European Union Agency for Cybersecurity. It describes twelve job profiles with their missions, skills and knowledge.

Linking each certification to an ECSF profile has two benefits. For an employer or HR department, the certification reads within a well-known European framework rather than in DVID-specific vocabulary. For a client, it becomes possible to write a verifiable requirement on the level of the people involved into a specification.

Validation through practice

Labs take place on the DVID board (ESP32 and STM32, Wi-Fi, BLE, UART, I2C, SPI, JTAG) and in virtualized environments. Sessions and scores are recorded automatically, making it possible to track each candidate’s progress.

The topics covered extend those we already address in our trainings: secrets in the firmware, exposed UART and misconfigured MQTT, Bluetooth Low Energy weaknesses.

Which certification for which need?

You buy or deploy connected equipment (buildings, fleets, industry): Foundations for your teams, and an Expert certification to require from your audit providers.
You design connected products: Foundations for project managers and product owners, Embedded Pentest Expert for the product security team.
You are an audit firm: both Expert certifications, depending on whether your engagements cover the device alone or the full ecosystem.
You are a school: Foundations as a common foundation, the Expert common core for specializing students.

Frequently asked questions

Do I need Foundations to take an Expert certification?

No. Depending on your level, you can go straight to an Expert certification. We still recommend starting with Foundations, which is a good way to review the basics.

Can I prepare for the certifications remotely?

Yes. The content is available online on the DVID Experience platform, with the DVID board or in a virtualized environment.