Skip to content

Web, mobile, and network testing covers most of today's attack surface. But organisations across the region are increasingly running technology that mainstream penetration testing barely touches: ATMs and payment terminals, IoT and connected devices, biometric authentication, blockchain protocols, LLM-powered applications, and configuration-heavy enterprise COTS platforms.

Each of these technologies has its own attack model, its own evidence requirements, and its own way of failing. Generic methodologies do not catch what really matters. Vantage Point invests directly in the research, tooling, and hands-on capability required to test these systems credibly, and Velocity carries that work into engagements as mapped, repeatable test cases.

What's at stake.

These systems carry asymmetric impact

When an ATM, payment terminal, biometric system, or production LLM fails, the consequence is often customer-facing and immediate, not just a backend incident.

Methodologies are still maturing

Industry guidance for AI/LLM, IoT, and blockchain is genuinely new. Testing depth varies wildly between providers. Choosing a tester with hands-on research in the space matters more here than in commodity engagements.

Regulators are catching up, fast

The EU CRA, MAS/CSA Singapore AI guidance, and central bank requirements for ATM and payment-terminal security are all tightening. Evidence-led testing today avoids retrofit cost tomorrow.

What we test.

Physical & embedded

Hands-on testing of devices that touch customers and money directly. Combined hardware, firmware, and network coverage.

  • ATMs and Cash Deposit Machines
  • Payment terminals (POS, mPOS, unattended)
  • IoT and connected devices (EU CRA-aligned)
  • Kiosks and self-service terminals
  • Industrial / OT devices where in scope

Emerging & high-risk

Specialist coverage where mainstream pentesting has limited capability, anchored by internal R&D and CTF practice.

  • Biometrics, fingerprint, face, behavioural; liveness detection
  • Blockchain, smart contracts, wallets, protocol layer
  • LLM / AI, prompt injection, model evasion, agent abuse
  • COTS platforms, Salesforce, SAP, Microsoft Dynamics

The flaws engagements like this consistently surface.

Drawn from common categories our consultants surface across engagements of this type. Severity and prevalence vary by environment and maturity.

Hardware tampering and skimming exposure

ATM enclosures defeatable by commodity tools, exposed debug ports on payment terminals, skim-friendly card-reader designs.

IoT firmware weaknesses

Hardcoded credentials in firmware, unsigned firmware updates, debug services exposed on production builds, weak crypto on device-to-cloud channels.

Biometric bypass surfaces

Liveness detection defeatable by 2D / video replay, fallback flows reverting to weaker authentication, template-storage weaknesses.

Smart contract logic flaws

Re-entrancy, access-control errors in admin functions, oracle manipulation paths, upgradeable-proxy mistakes.

LLM application risk

Indirect prompt injection via retrieved documents, agent tool-calling abuse, model-output data exfiltration, jailbreaks reaching back-end functions.

COTS misconfiguration

Salesforce sharing rules exposing PII, SAP authorisation objects granting excessive paths, Dynamics security roles ignored in custom flows.

A structured, intelligence-led path through every engagement.

Every engagement follows the same disciplined path through the Velocity platform, so quality, traceability, and reporting are consistent across teams.

Scoping

Define assets, environments, Rules of Engagement, and acceptance criteria with the technical and security stakeholders.

Execution

Manual and tool-assisted testing by CREST-accredited consultants, with evidence captured at each step.

Validation

Every finding is reproduced, risk-rated under CVSS, and confirmed by a second consultant before reporting.

Reporting

Cryptographically signed reports with test-case traceability, severity ratings, reproduction steps, and remediation guidance.

Debrief & Retest

Stakeholder walk-through of findings, prioritisation support, and a retest cycle on remediated issues.

Mapped to recognised baselines.

EU Cyber Resilience Act
PCI PIN / PTS / P2PE
OWASP LLM Top 10
Vendor baselines (Salesforce, SAP, Dynamics)

Test the systems mainstream pentesting overlooks.

Talk to a consultant about scoping specialist testing for ATMs, IoT, biometrics, blockchain, LLM applications, or enterprise COTS platforms.