Service • IoT Infrastructure Audit

IoT Infrastructure Audit – Secure, Reliable & Observable Edge-to-Cloud Systems

Modern IoT systems fail not because of one big issue, but because of dozens of small, hidden weaknesses. At Combotto.io, I help companies uncover those weaknesses before they cause outages, data loss, or security incidents.

The IoT Infrastructure Audit is a deep technical assessment of your device → edge → gateway → cloud architecture — designed to identify reliability risks, security gaps, and observability blind spots across your entire telemetry pipeline.

20-minute intro call — clear next steps, no obligation.

From devices to dashboards

End-to-end view across devices, MQTT, gateways, and cloud ingestion.

Reliability you can measure

WAL buffering, retries, and SLOs that survive real-world outages.

Security built-in

mTLS, ACLs, and hardened gateways instead of best-effort security.

Who is this for?

Teams that depend on IoT data — and can’t afford to guess

This service is tailored for engineering-driven organisations that rely on connected devices and telemetry:

  • • Companies running IoT products in production.
  • • Teams struggling with data gaps or missing telemetry.
  • • Startups preparing to scale from prototypes to deployments.
  • • Organisations needing a security review (MQTT, TLS/mTLS, device identity, ACLs).
  • • Teams who want a second opinion on their architecture.
  • • Businesses with sensor fleets, industrial IoT, energy/solar systems, or remote gateways.

If you have devices sending telemetry to the cloud, this audit helps you strengthen the entire path.

Scope

What I audit

Your IoT architecture is evaluated across reliability, security, and observability using a structured methodology and real-world best practices.

Device Layer
  • Telemetry sampling and batching.
  • MQTT implementation quality.
  • TLS configuration.
  • Identity, certificates, and rotation.
  • Power, connectivity, and failure-handling constraints.
  • Payload schemas and validation.
  • Retry/backoff strategies.

I do not reverse engineer firmware; the analysis is architectural.

Edge MQTT Broker
  • TLS/mTLS configuration.
  • Anonymous access checks.
  • Topic ACL correctness.
  • Retain/QoS usage.
  • Duplicate message handling.
  • Session management.
  • Logging & monitoring setup.
Gateway Layer

Whether your gateway is written in Rust, Python, Java, C/C++, or something else, I review:

  • Ingest reliability and backpressure.
  • WAL/durable buffering and retry models.
  • Message ordering and enrichment.
  • Control-plane safety and error handling.
  • Firmware update risks.
Cloud Ingestion & Dataflow
  • API ingest reliability and backpressure.
  • Idempotency and duplicate handling.
  • Schema evolution strategy.
  • Data lake / analytics ingestion.
  • Failure isolation and event ordering.
  • Load-balancer and storage behaviour.
Observability & Monitoring
  • Prometheus instrumentation.
  • Grafana dashboards.
  • OpenTelemetry traces.
  • Metrics coverage and alerting gaps.
  • Logs and log retention.
  • On-call readiness.
  • Blackbox/edge monitoring.
Security
  • TLS/mTLS posture.
  • Certificate lifecycle.
  • MQTT ACL correctness.
  • Device identity model.
  • Secrets management.
  • Gateway hardening.
  • Cloud boundary protection.
  • Man-in-the-middle risks.
  • Replay and forgery prevention.

Deliverables

What you receive

Every IoT audit delivers a structured, actionable view of your system and its risks.

1. Executive Summary (non-technical)
Clear overview of risks, priorities, and recommended actions.

2. Technical Architecture Review
End-to-end mapping of your current IoT system.

3. Security Assessment
MQTT posture, TLS/mTLS, ACLs, device authentication, gateway hardening.

4. Reliability Assessment
WAL durability, retry logic, edge-to-cloud resilience, connectivity gaps.

5. Observability Assessment
Metrics, traces, logs, alerting, readiness for on-call.

6. Risk Heatmap
Categorised by reliability, security, observability, performance, and operational risk.

7. 30-Day / 60-Day / 90-Day Roadmap
Actionable steps your team can immediately execute.

8. Optional: Hardening Sprint
2–3 week implementation sprint to address the most important findings with hands-on help.

References / Client Case Studies

IoT audit in practice

A selection of case studies where the IoT Infrastructure Audit has been applied to real gateways and telemetry pipelines.

View all references →

Process

The audit process

1
Initial Discovery Call

We align on scope, architecture, constraints, and business goals.

2
Access & Documentation

You provide diagrams, broker config, gateway repo (optional), ingestion endpoints, observability setup, and relevant logs/traces.

3
Deep Technical Review

I analyse the system across Device, MQTT, Gateway, Cloud, Observability, and Security.

4
Findings Report

You receive the full report with severity levels, recommended actions, architecture diagrams, and roadmap.

5
Follow-Up Session

We walk through findings together and decide on next steps.

Patterns

Common issues found in audits

Here are the problems most teams don't know they have:

  • • MQTT broker allowing anonymous clients.
  • • TLS certs close to expiration or not validated correctly.
  • • QoS mismatches creating silent data loss.
  • • Devices misconfigured with Retain = true.
  • • Gateway missing WAL durability → data gaps during outages.
  • • Missing idempotency → duplicate events in analytics.
  • • Lack of traces → impossible to debug.
  • • Prometheus not scraping critical components.
  • • Hidden slow paths in ingestion.
  • • Missing ACL separation between device classes.
  • • High-risk firmware update flow.

These are the issues that cost companies lost data, broken dashboards, and long on-call nights.

Optional add-on

Hardening Sprint

After the audit, many clients continue with a 2–3 week Hardening Sprint, where I help your team implement the most important improvements.

Common sprint outcomes:

  • • WAL durability added.
  • • mTLS rolled out.
  • • MQTT ACLs corrected.
  • • Metrics/traces instrumented.
  • • Cloud ingest made idempotent.
  • • Edge-to-cloud reliability fixed.
  • • On-call dashboards created.

This transforms your architecture from fragile → production-ready.

Why Combotto.io?

Full-stack IoT expertise — from electrons to cloud

You're not hiring a general consultant — you're hiring a specialist.

  • • Rust + embedded + cloud background.
  • • Kafka and data engineering experience.
  • • Hands-on IoT gateway development.
  • • Deep understanding of constrained devices (STM32, bandwidth, battery, connectivity).
  • • Knowledge of MQTT, mTLS, WALs, telemetry pipelines, reliability patterns.
  • • Experience with both startup and enterprise IoT systems.
  • • Creator of a production-grade Rust IoT Gateway reference architecture.

I understand IoT from electrons → firmware → gateway → cloud → analytics → observability → operations. That full-stack domain expertise is extremely rare.

Ready to strengthen your IoT infrastructure?

If you want fewer outages, fewer data gaps, stronger security, better visibility, and a reliable edge-to-cloud architecture, an IoT Infrastructure Audit is the fastest way to get there.

Prefer to start with a quick message instead of a call? Use the form below.


Have a question about the IoT Infrastructure Audit?

Send a quick message about your devices, data rates, and current challenges. You’ll receive a same-day reply with clear next steps.

Typical response: same business day.
Combotto.io
© 2025 Combotto.io — IoT | Data Infrastructure | Security Consulting