Threat Modelling and Vulnerability Assessment for IoT Solutions: A Case Study

Security in Internet of Things (IoT) systems is increasingly critical due to their growing adoption and complexity. This study investigates how threat modelling and vulnerability assessment are applied in industrial IoT development. We conducted a single-case study with an IoT consultancy company, combining semi-structured interviews with practitioners and analysis of development artefacts from a real-world IoT project. Our findings show that while threat identification is practiced, formal methodologies like STRIDE are only used selectively, and integration into the development process is informal and ad hoc. Vulnerability assessment also lacks systematic approaches for discovery, classification, and testing, often relying on expert judgment and external tools. We identify key attack surfaces and common security weaknesses, and highlight gaps in documentation and testing integration. The study contributes practical recommendations for improving security practices and provides a curated list of open-source penetration testing tools. These insights support more structured and proactive security strategies in IoT development.