ONEKEY

ONEKEY (formerly IoT Inspector, founded in 2018 and rebranded in 2022) analyzes compiled firmware binaries — without needing source code — to find known and unknown vulnerabilities, hardcoded credentials, outdated third-party components, and insecure configurations in connected devices. This is effectively software composition analysis and binary security testing applied to embedded firmware, a category that traditional application security tools generally don’t reach because firmware images are compiled blobs rather than source repositories a SAST/SCA tool can scan directly.

The platform’s second major function is compliance automation: as regulations like the EU Cyber Resilience Act, UNR155 (automotive cybersecurity), IEC 62443 (industrial control systems), and the U.S. Cyber Trust Mark for IoT devices come into force, device manufacturers need a repeatable way to demonstrate their products meet baseline security requirements. ONEKEY maps its scan findings against these frameworks and continuously re-checks deployed firmware against newly disclosed CVEs, filtering out vulnerabilities that are not actually exploitable or relevant in the specific firmware context — a meaningful practical improvement over simple CVE-database matching, which tends to flood teams with irrelevant alerts.

ONEKEY has real institutional backing: it is part of PwC Germany’s investment portfolio and has raised roughly $11.9M from investors including eCAPITAL and Momenta Ventures, and industry analyst firm Omdia profiled it in an “On the Radar” report covering firmware security and compliance vendors. With around 54 employees and a Düsseldorf, Germany base, the company describes itself as the leading European specialist in this niche, a claim that is plausible given its regulatory-framework coverage and PwC relationship but is not independently ranked against competitors like Finite State or VDOO/Palo Alto’s IoT security line.