Amsterdam Technologies — Solution Whitepaper Product Category: Cybersecurity — Bluetooth Low Energy Analysis Platform: macOS (native application) Status: Beta Version: 1.x

The Problem

Bluetooth Low Energy (BLE) has become the dominant short-range wireless protocol, embedded in billions of devices — from medical wearables and smart locks to enterprise badge systems and industrial sensors. By 2026, the installed base of BLE-enabled devices exceeds 7 billion globally. Every modern smartphone, laptop, and tablet ships with BLE active by default. Yet the security posture of this ubiquitous wireless layer remains largely opaque to the organizations and individuals who depend on it.

The core issue is visibility. Most people do not realize what their Bluetooth devices reveal about them. Passive scanning with commodity hardware — a standard laptop Bluetooth radio — can expose behavioral patterns, identity clusters, occupancy data, device fingerprints, and tracking vectors that constitute material privacy and security risks. A BLE device broadcasting a static name, a fixed MAC address, and manufacturer-specific advertisement data is effectively announcing its owner's presence, habits, and movements to anyone within radio range.

The security implications compound at the enterprise level. Organizations deploying BLE-enabled access control, asset tracking, medical devices, or IoT infrastructure face several structural challenges:

Uncontrolled device proliferation. IT security teams have limited visibility into the BLE devices operating within their physical perimeter. Personal devices, rogue beacons, and unauthorized trackers coexist with authorized infrastructure, creating an unmanaged attack surface.
Insufficient protocol-level security auditing. Standard network security tools do not cover BLE. Generic Bluetooth scanners show device names and signal strength but provide no assessment of GATT service exposure, characteristic permissions, firmware vulnerability status, or compliance posture.
Known BLE vulnerabilities remain unpatched. Published CVEs including KNOB (Key Negotiation of Bluetooth), BIAS (Bluetooth Impersonation Attacks), BLURtooth, SweynTooth, BLESA, InjectaBLE, and WhisperPair affect millions of deployed devices. Without tooling that matches device signatures against these vulnerabilities, organizations cannot prioritize remediation.
Regulatory and compliance gaps. Standards such as NIST SP 800-121 Rev. 2 (Guide to Bluetooth Security) and the OWASP IoT Security Verification Standard provide clear guidance for BLE deployments. Yet most organizations lack the tooling to evaluate their BLE infrastructure against these frameworks.
Tracking and surveillance threats. The proliferation of consumer tracking devices — Apple AirTags, Tile trackers, Samsung SmartTags — has created a new vector for unwanted surveillance. Detecting these devices in real-time requires specialized protocol analysis that generic Bluetooth utilities cannot provide.

Existing tools in this space fall into two categories, each with significant limitations. Professional BLE security platforms like Ubertooth One require specialized hardware, Linux-based toolchains, and deep protocol expertise — placing them out of reach for most security teams. Consumer-grade Bluetooth scanners (nRF Connect, LightBlue) provide device listing and basic GATT browsing but lack security analysis, compliance checking, temporal analysis, or any form of threat scoring. Neither category offers the combination of passive reconnaissance, active security testing, behavioral analysis, and compliance reporting that modern BLE security auditing demands.

The status quo forces security professionals to assemble fragmented toolchains, interpret raw packet data manually, and generate compliance reports by hand — an approach that does not scale and leaves critical gaps in coverage.

Solution Overview

Bluetooth Analyzer is a native macOS application that provides comprehensive BLE device discovery, multi-layered security analysis, active penetration testing, temporal behavioral analysis, and GPU-accelerated 3D visualization — all within a single tool that requires no external hardware, no external software dependencies, and no cloud connectivity.

The product is built on a fundamental architectural insight: the same commodity Bluetooth hardware present in every Mac can serve as a professional-grade BLE security analysis platform when paired with sufficiently sophisticated software. By leveraging Apple's CoreBluetooth framework for radio access, Metal for GPU-accelerated rendering, SwiftData for local persistence, and SwiftUI for the interface layer, Bluetooth Analyzer achieves professional-grade capability without requiring users to purchase dedicated hardware, configure Linux environments, or rely on external processing.

The design philosophy centers on three principles:

Depth over breadth. Rather than scanning for Bluetooth Classic and BLE simultaneously with shallow coverage, Bluetooth Analyzer focuses exclusively on BLE and explores it exhaustively — from advertisement byte decoding through GATT service auditing to compliance evaluation.

Automated intelligence over raw data. Every discovered device automatically passes through eight specialized security analyzers that produce quantified threat scores (0-100), privacy scores (0-100), and GATT risk scores (0-100). The output is actionable findings categorized by severity, not hex dumps requiring expert interpretation.

Local-only operation. All scanning, analysis, and data storage occurs entirely on the local Mac. No device data, scan results, or security findings leave the machine. This design is essential for security auditing tools — the data they collect is inherently sensitive.

Bluetooth Analyzer is currently in beta, available for macOS 14.0 (Sonoma) and later. All major capability areas — device discovery, the eight-analyzer security pipeline, active testing tools, 3D visualizations, temporal analysis, signal survey, and compliance reporting — are functional and available in the current release.

Key Capabilities

BLE Device Discovery and Monitoring

Bluetooth Analyzer performs continuous BLE scanning with real-time RSSI (Received Signal Strength Indicator) updates for every discovered device. Scanning is driven by CoreBluetooth's central manager, with configurable scan intervals, auto-scan on launch, and device timeout/pruning settings to manage environments with high device density.

Each discovered device is automatically classified into one of ten categories — Audio, Wearable, Health, Beacon, Peripheral, Phone, Computer, Sensor, Appliance, or Unknown — using a multi-signal classification engine that considers advertised service UUIDs, manufacturer-specific data bytes, and device name heuristics. Signal quality is categorized into four tiers (Excellent, Good, Fair, Weak), and physical distance is estimated using an RSSI path-loss propagation model.

Beyond active BLE scanning, the application also discovers system-connected peripherals — BLE devices already connected to macOS outside the app's scanning context. This provides visibility into devices that might not be actively advertising but are maintaining persistent connections.

The device list view displays UUID, device name, RSSI, TX power, manufacturer identification, category, estimated distance, signal quality, and security scores for every device. The interface supports real-time filtering and sorting to manage environments with dozens or hundreds of concurrent BLE devices.

GATT Exploration and Connection

The GATT (Generic Attribute Profile) Explorer provides full hierarchical discovery of services, characteristics, and descriptors on any connectable BLE device. Upon connection, the application enumerates the complete GATT database and auto-reads all readable characteristics and descriptors.

Standard name resolution covers over 65 defined GATT services and more than 30 defined characteristics, translating raw UUIDs into human-readable names (e.g., 0x180A becomes "Device Information Service"). For the Device Information Service specifically, the application parses and displays manufacturer name, model number, serial number, firmware revision, hardware revision, software revision, and PnP ID fields.

The explorer supports write operations to writable characteristics, with full ATT (Attribute Protocol) error code capture and classification — enabling operators to test whether authentication and authorization controls are properly enforced. Notification and indication subscriptions can be toggled for real-time data monitoring. MTU (Maximum Transmission Unit) negotiation results are visible, and L2CAP (Logical Link Control and Adaptation Protocol) channel support is available for connection-oriented data exchange.

BLE Appearance values are decoded from their numeric codes into human-readable descriptions, providing immediate context about how a device identifies itself at the GATT level.

Security Analysis Pipeline

The security analysis pipeline is the core differentiator of Bluetooth Analyzer. Every discovered device is automatically evaluated by eight specialized analyzers, each targeting a distinct threat domain. The pipeline produces three composite scores per device: a privacy score (0-100), a threat score (0-100), and a GATT risk score (0-100). Individual findings are categorized by severity — Critical, High, Medium, Low — with specific remediation recommendations.

Privacy Analyzer

Evaluates device trackability by analyzing six dimensions: whether the device broadcasts a static (non-randomized) name, the uniqueness and persistence of manufacturer-specific data, the number and specificity of advertised service UUIDs, TX power broadcast presence, service data leakage through advertisement payloads, and the stability of advertisement payloads over time. Devices that broadcast rich, consistent, identifiable information receive lower privacy scores, reflecting higher trackability risk.

Spoof Detector

Identifies potential device impersonation attacks by detecting duplicate device names across different UUIDs, duplicate manufacturer data patterns, category mismatches (e.g., a device claiming to be audio equipment while advertising health service UUIDs), advertisement payload mutations that suggest dynamic spoofing, RSSI inconsistencies indicating multiple physical devices behind one identity, and temporal impossibility — a device appearing in two locations faster than physical movement allows.

Tracker Detector

Specifically identifies unwanted tracking devices by matching advertisement patterns against known tracker signatures: Apple FindMy / AirTag, Tile, Samsung SmartTag, and generic persistent beacon patterns. This addresses the growing concern of Bluetooth-based stalking and unauthorized surveillance, providing detection capabilities that complement Apple's built-in AirTag detection but extend to a broader range of tracking devices.

GATT Auditor

Analyzes the GATT service and characteristic structure of connected devices to identify security weaknesses: writable characteristics that lack authentication requirements, exposure of sensitive services (Device Information, Heart Rate, Blood Pressure), write-without-response vectors that bypass connection-level flow control, broadcast characteristics that could leak data, and the presence of OTA (Over-The-Air) firmware update and DFU (Device Firmware Update) services from major BLE chipset manufacturers — Nordic Semiconductor, Texas Instruments, Cypress/Infineon, Silicon Labs, and Espressif. Exposed OTA/DFU services represent critical risk because they potentially allow unauthorized firmware modification.

Environment Profiler

Creates baseline snapshots of the BLE environment — the set of devices normally present in a specific location and time window. Subsequent scans are compared against these baselines to detect rogue or unexpected devices. This capability is essential for secure facilities, server rooms, executive offices, and any environment where the introduction of unauthorized BLE devices represents a security concern.

Address Analyzer

Tracks the stability of device UUIDs over time to infer whether devices are using static or randomized MAC addresses. BLE address randomization is a privacy-preserving mechanism specified in the Bluetooth standard, but many devices implement it incorrectly or not at all. The Address Analyzer detects cross-randomization correlation — cases where a device rotates its MAC address but maintains other identifiable characteristics, defeating the privacy protection that address randomization is supposed to provide.

Vulnerability Database

Matches device information (manufacturer, model, firmware version, chipset identifiers) against a database of known BLE CVEs. Currently covers seven major vulnerability families: KNOB (CVE-2019-9506 — key negotiation downgrade), BIAS (CVE-2020-10135 — impersonation during secure connection establishment), BLURtooth (CVE-2020-15802 — cross-transport key derivation), SweynTooth (multiple CVEs — stack-level crashes affecting major chipsets), BLESA (BLE spoofing attacks during reconnection), InjectaBLE (advertisement injection), and WhisperPair (passive eavesdropping on pairing). Matched vulnerabilities are flagged with severity ratings and linked to remediation guidance.

Compliance Checker

Evaluates each device against three established security frameworks: Bluetooth SIG Security Mode 1 (defining security levels from no security through authenticated LE Secure Connections), NIST SP 800-121 Rev. 2 (the authoritative guide to Bluetooth security for federal and enterprise environments), and the OWASP IoT Security checklist. Results are presented as pass/fail per framework with specific non-compliance findings identified.

Active Security Testing

Beyond passive analysis, Bluetooth Analyzer provides four active testing capabilities designed for authorized penetration testing and security validation.

GATT Security Prober

Performs empirical permission probing by systematically attempting read and write operations on every discovered characteristic. This builds an actual permission map that can be compared against the declared characteristic properties — revealing cases where a device declares a characteristic as requiring authentication but actually allows unauthenticated access, or vice versa. This discrepancy between declared and actual permissions is a common implementation flaw in BLE devices.

GATT Fuzzer

A structured fuzzing engine that tests GATT characteristics for input handling vulnerabilities using four strategies: Random (arbitrary byte sequences), Boundary Values (minimum/maximum values, off-by-one, zero-length payloads), Format Strings (payloads that trigger format string vulnerabilities in C-based BLE stacks), and Smart/Combined (heuristic-driven combinations of the other strategies). The fuzzer includes crash detection, configurable rate limiting to avoid denial-of-service conditions, emergency stop capability, and automatic exclusion of sensitive characteristics (such as firmware update control points) to prevent bricking test devices.

L2CAP Channel Prober

Systematically probes L2CAP Protocol/Service Multiplexer (PSM) values across configurable ranges to discover undocumented services. Many BLE devices expose L2CAP channels for proprietary data exchange that are not advertised through standard GATT service discovery. Identifying these channels is critical for complete attack surface enumeration.

BLE Honeypot

Operates the Mac's Bluetooth radio in peripheral mode, advertising as a configurable BLE device to attract and log connection attempts from nearby devices. Preset profiles include "Generic IoT Sensor" and "High-Value Target SmartLock" — device profiles designed to attract different types of connection attempts. All incoming connection events, GATT read/write requests, and subscription attempts are logged for analysis. This capability is particularly valuable for detecting rogue devices that actively scan for and connect to BLE peripherals in a monitored environment.

Advertisement Protocol Decoding

Bluetooth Analyzer performs deep packet inspection of BLE advertisement payloads, decoding proprietary and standard protocols that most tools display only as raw hex data.

Apple Continuity protocol decoding covers six subtypes: iBeacon (0x02), AirDrop (0x05), Proximity Pairing (0x07), Nearby Info (0x10), FindMy (0x12) and Nearby Interaction (0x19). Alongside these, the decoder handles Eddystone UID, URL and TLM frames, Microsoft Swift Pair, Samsung BLE payloads, and generic manufacturer and service data. This decoding reveals what nearby devices are broadcasting about their state, capabilities, and identity — information that is opaque to standard BLE scanners.

iBeacon decoding extracts UUID, major, and minor identifiers along with measured power for distance calibration. Eddystone decoding covers UID (namespace and instance), URL (compressed web addresses), and TLM (telemetry: battery voltage, temperature, uptime, advertisement count). Microsoft Swift Pair and Samsung BLE protocols are also decoded.

The advertisement data view provides an annotated hex dump with color-coded byte ranges and inline security notes explaining the privacy implications of each decoded field.

Temporal and Behavioral Analysis

Bluetooth Analyzer persists device sighting data over time, enabling analysis that transcends single scanning sessions.

Presence Timelines display per-device sighting windows across days and weeks, showing when each device was within radio range. Occupancy Heatmaps aggregate presence data into hourly-by-day-of-week grids, revealing patterns such as which devices are present during business hours versus nights and weekends. Dwell Time Statistics compute average, shortest, longest, and total time in range per device.

Device Correlation uses Jaccard similarity coefficients to detect co-occurrence patterns — devices that consistently appear and disappear together. This enables identity clustering: recognizing that a specific phone, watch, and earbuds always co-occur and therefore likely belong to the same person. Identity Clusters can be labeled and persisted for ongoing monitoring.

These temporal capabilities transform Bluetooth Analyzer from a point-in-time scanner into a persistent monitoring platform capable of building behavioral profiles of the BLE environment over weeks and months.

3D Metal Visualizations

Three GPU-accelerated visualization modes provide spatial and temporal insight into the BLE environment, rendered using Apple's Metal framework with interactive arcball camera controls supporting orbit, zoom, and pan.

Constellation View renders a 3D point cloud where each BLE device is positioned by signal strength and colored by device category. Devices naturally cluster by proximity, providing an intuitive spatial map of the radio environment.

Spectrum Waterfall displays a 3D RSSI spectrogram showing signal strength over time per device — a time-domain view that reveals intermittent devices, signal fading patterns, and devices moving through the environment.

Topology / Proximity Map generates a 3D terrain-like surface map derived from device proximity data, providing an alternative spatial representation that highlights areas of high device density.

All three visualizations share a reusable rendering architecture with procedurally generated Metal shaders, delivering consistent frame rates without external GPU libraries or dependencies.

Signal Survey

The signal survey module supports structured walk-around BLE coverage assessments. Users record measurements at grid points while moving through a physical space, with optional floor plan image upload for spatial reference. Measurements are interpolated using inverse distance weighting (IDW) to generate continuous heatmap overlays, rendered on a canvas-based display.

This capability enables physical security assessments — mapping BLE coverage to identify blind spots, signal leakage beyond perimeter boundaries, and optimal placement for BLE infrastructure such as beacons and access points.

Data Export and Reporting

Bluetooth Analyzer supports four export formats:

CSV — full device details including UUID, name, RSSI, TX power, category, manufacturer, advertised services, estimated distance, and signal quality.
JSON — pretty-printed with ISO 8601 date formatting, suitable for ingestion by SIEM platforms and analysis scripts.
PNG — image export of any view, including 3D visualizations and heatmaps.
HTML Security Report — a comprehensive report containing an executive summary, findings organized by severity, compliance status per framework, and specific remediation recommendations per finding. Designed for distribution to stakeholders who need actionable intelligence without using the application directly.

All device data conforms to the Transferable protocol, enabling drag-and-drop export from the application to Finder or other applications.

macOS System Integration

The application integrates with macOS conventions: a menu bar extra displays scan status, full keyboard shortcut coverage provides rapid navigation (Cmd+1 through Cmd+9 for sections, Cmd+R for scan toggle, Cmd+E for export), and a notification system alerts on new device appearances, departures, and device state changes. Settings are organized into General, Notifications, Data, and About tabs.

Architecture and Technical Design

Technology Choices and Rationale

Bluetooth Analyzer is built entirely in Swift using SwiftUI for the interface, CoreBluetooth for BLE radio access, Metal and MetalKit for GPU rendering, SwiftData for persistence, CoreLocation for survey geolocation, and AppKit for macOS-specific integration. The application has zero external dependencies — no third-party packages, no CocoaPods, no Carthage, no Swift Package Manager dependencies beyond Apple's own frameworks.

This zero-dependency architecture is a deliberate security and reliability decision. A BLE security auditing tool must itself maintain impeccable software supply chain hygiene. External dependencies introduce transitive risk, version conflicts, and build complexity. By building exclusively on Apple system frameworks, the application eliminates supply chain attack surface entirely and guarantees compatibility with every supported macOS release.

Application Architecture

The application follows an Observable service injection pattern. Over 30 service classes use Swift's @Observable macro and are injected from the root application scene through SwiftUI's Environment system. Views access services through @Environment properties, establishing a clean unidirectional data flow.

The scanning pipeline operates as a cascading update chain: the BLE scanner discovers peripherals and produces scan results via CoreBluetooth delegate callbacks. Each scan result triggers a cascade of downstream processing — known device tracking, sighting persistence, change detection, and the full eight-analyzer security pipeline. All state changes propagate through the Observable system, and SwiftUI views react automatically.

Data Persistence and Privacy

Persistence uses SwiftData with eight model classes covering known devices, scan sessions, survey data, environment baselines, sighting logs, and identity clusters. All data is stored locally in a SwiftData container on the user's Mac. There is no cloud synchronization, no telemetry, no data exfiltration of any kind. This is architecturally enforced — the application's sandbox entitlements permit Bluetooth access, file save/open dialogs, location services, and outgoing network connections (for system URL scheme opening and notarization), but the application contains no code that transmits scan data to external servers.

For organizations subject to data handling regulations, this local-only architecture eliminates an entire class of compliance concerns. BLE scan data — which may contain device identifiers, location correlations, and behavioral patterns — never leaves the auditor's machine.

GPU Rendering Architecture

The three 3D visualizations share a common Metal rendering foundation: a reusable interactive view base class that implements arcball camera control (orbit, zoom, pan via trackpad and mouse). Metal shaders are generated procedurally in Swift rather than loaded from precompiled shader files, enabling runtime customization of visualization parameters.

Metal was chosen over higher-level rendering frameworks (SceneKit, RealityKit) for two reasons: performance predictability (Metal provides direct GPU access without abstraction overhead) and minimal dependency surface (Metal is a system framework with no transitive dependencies). The result is smooth, interactive rendering of 3D point clouds, spectrograms, and topology maps even with hundreds of tracked devices.

Security Posture of the Application

As a security auditing tool, Bluetooth Analyzer must itself be secure. The application is designed for App Sandbox with hardened runtime, uses Developer ID signing with Apple notarization for distribution, and requests only the minimum entitlements required for its functionality: Bluetooth access, user-selected file read/write, location services, and outgoing network connections. No entitlements for camera, microphone, contacts, calendar, or arbitrary file system access are requested.

Use Cases and Scenarios

Corporate Security Team: BLE Attack Surface Assessment

A security operations team at a financial services firm needs to assess the BLE attack surface within their headquarters — a 15-floor office building with approximately 3,000 employees and an unknown number of BLE devices. They deploy Bluetooth Analyzer on several MacBooks positioned throughout the building.

Using continuous scanning with environment baselining, they establish known-good device profiles for each floor over one week. The Environment Profiler then detects rogue devices — unauthorized beacons, personal BLE-enabled devices in restricted areas, and a previously unknown BLE-enabled HVAC controller with exposed writable GATT characteristics lacking authentication. The GATT Auditor flags these writable characteristics as critical findings. The Compliance Checker evaluates all discovered devices against NIST SP 800-121 Rev. 2, generating HTML security reports that the CISO presents to the board. The team identifies 47 devices requiring remediation, prioritized by the composite threat score.

IoT Product Development: Pre-Release Security Validation

An IoT hardware company is preparing to ship a BLE-enabled smart lock. Before release, the product security team uses Bluetooth Analyzer's active testing capabilities to validate the device's BLE implementation. The GATT Security Prober reveals that two characteristics intended to require authentication actually accept unauthenticated writes — a discrepancy between the declared permission properties and the actual firmware implementation. The GATT Fuzzer, running boundary value and format string strategies, triggers a crash in the lock's BLE stack when receiving a zero-length write to the lock control characteristic — a denial-of-service vulnerability. The Vulnerability Database matches the lock's Nordic Semiconductor chipset against SweynTooth CVEs, confirming that the firmware version requires a patch. These findings are documented in an HTML security report that the development team uses for remediation before production release.

Physical Security Consultant: Executive Protection Sweep

A physical security consultant is conducting a counter-surveillance sweep of a CEO's residence prior to a board meeting. Using Bluetooth Analyzer, they scan the property and identify 23 BLE devices. The Tracker Detector flags two Apple AirTags that are not associated with any of the CEO's known devices — potential surveillance trackers planted by an unknown party. The Privacy Analyzer identifies a smart home hub broadcasting detailed service data that reveals the home's automation patterns (occupancy, lighting, HVAC schedules). The consultant uses the signal survey module with a floor plan overlay to map BLE signal leakage beyond the property boundary, identifying areas where devices are detectable from the public sidewalk. Findings are exported as a comprehensive HTML report with remediation recommendations: remove the unauthorized AirTags, reconfigure the smart home hub to reduce advertisement data, and install RF shielding in areas with boundary signal leakage.

Healthcare IT: Medical Device BLE Compliance Audit

A hospital's biomedical engineering department is auditing BLE-enabled medical devices — infusion pumps, patient monitors, and glucose meters — for compliance with their internal security policy (derived from NIST SP 800-121). Bluetooth Analyzer discovers 156 BLE-enabled medical devices across two patient floors. The Compliance Checker evaluates each device against NIST and OWASP IoT standards, revealing that 34 devices use Security Mode 1, Level 1 (no security — unauthenticated, unencrypted connections). The GATT Auditor identifies 12 devices exposing Device Information Service with firmware version data that matches known SweynTooth-vulnerable chipsets. The Device Correlation module reveals that certain devices consistently co-occur with specific patient room locations, raising patient privacy concerns. The exported CSV data integrates with the hospital's asset management system, and the HTML compliance report supports the quarterly regulatory filing.

Penetration Testing Firm: Client BLE Assessment

A penetration testing firm is conducting an authorized assessment of a retail client's BLE beacon infrastructure — 200+ beacons used for in-store navigation and promotion delivery. The team deploys Bluetooth Analyzer's BLE Honeypot in "High-Value Target SmartLock" mode near the beacon infrastructure to test whether any beacons or devices in the environment attempt unauthorized connections to attractive targets. The L2CAP Prober discovers undocumented PSM channels on the beacon management interface that accept unauthenticated connections — a backdoor left from the development phase. The Apple Continuity decoder reveals that employee iPhones are broadcasting Nearby Action data that discloses device model, iOS version, and activity state. The full assessment, exported as an HTML security report with severity-ranked findings and remediation steps, becomes a deliverable to the retail client.

Facility Manager: Occupancy Intelligence

A corporate real estate team uses Bluetooth Analyzer's temporal analysis to understand actual office utilization without installing dedicated sensors. By running continuous scans from a Mac mini positioned centrally on each floor, they collect BLE device presence data over four weeks. The Occupancy Heatmap reveals that the third floor is at 85% utilization on Tuesdays and Wednesdays but under 20% on Fridays. The Device Correlation module identifies identity clusters (phone + watch + earbuds = one person), providing more accurate headcounts than raw device counts. The Presence Timeline shows that certain meeting rooms have consistent 2-hour occupancy blocks that never appear on the calendar system — indicating shadow bookings. This data informs a space consolidation decision that reduces the company's leased footprint by one floor.

Pricing and Plans

Bluetooth Analyzer is distributed as a downloadable macOS application with subscription and lifetime license options. All plans include a 14-day free trial. Prices are in EUR.

Plan	Price	Billing	Included Features
Monthly	€10/month	Monthly, cancel anytime	8 security analyzers, 3D Metal visualizations, Apple Continuity decoding, all future updates
Yearly (Best Value)	€8/month	Billed as €96/year (save 20%)	Everything in Monthly, 2 months free, priority support, all future updates
Lifetime v1	€149 one-time	Single purchase	All v1.x updates included, no recurring fees, all security analyzers, 3D visualizations and survey tools
Enterprise	Custom	Custom	Unlimited seats, volume licensing, SSO/SAML integration, SLA guarantee, dedicated account manager, custom deployment options, priority feature requests

The pricing philosophy reflects a straightforward model: all plans provide the complete application with full functionality. There are no feature gates between tiers — the Monthly plan provides identical capabilities to the Lifetime plan. The differentiation is purely in billing structure and support level. The Yearly plan offers a 20% discount over monthly billing. The Lifetime v1 license covers all updates within the 1.x major version, with no recurring costs. Enterprise customers with volume deployment needs or specific support requirements should contact Amsterdam Technologies directly.

Frequently Asked Questions

What hardware is required to run Bluetooth Analyzer? Bluetooth Analyzer requires a Mac running macOS 14.0 (Sonoma) or later with Bluetooth hardware — either the built-in Bluetooth radio present in all modern Macs or a compatible external Bluetooth adapter. No specialized BLE sniffing hardware (such as Ubertooth One or nRF52 dongles) is required. The application uses Apple's CoreBluetooth framework, which operates with standard Bluetooth 4.0+ hardware.

Does the application send any data to external servers? No. Bluetooth Analyzer operates entirely locally. All scan data, security analysis results, environment baselines, temporal records, and identity clusters are stored in a local SwiftData database on the user's Mac. The application contains no telemetry, analytics, or cloud synchronization functionality. Export files (CSV, JSON, HTML, PNG) are saved to user-selected local paths via standard macOS file dialogs. This local-only architecture is intentional — BLE scan data is inherently sensitive and should remain under the operator's exclusive control.

Is active security testing (fuzzing, probing, honeypot) safe to use? Active testing features — the GATT Fuzzer, GATT Security Prober, L2CAP Prober, and BLE Honeypot — are designed for authorized penetration testing and should only be used on devices the operator owns or has explicit written authorization to test. The GATT Fuzzer includes safeguards: configurable rate limiting, emergency stop, and automatic exclusion of sensitive characteristics (such as firmware update control points) to minimize the risk of unintended device disruption. Operators should exercise standard penetration testing caution and ensure appropriate authorization before activating these features.

What compliance frameworks does the application evaluate against? The Compliance Checker evaluates devices against three frameworks: Bluetooth SIG Security Mode 1 (covering security levels 1 through 4), NIST SP 800-121 Rev. 2 (the U.S. National Institute of Standards and Technology guide to Bluetooth security), and the OWASP IoT Security Verification Standard. Results are presented as pass/fail with specific non-compliance findings. The HTML Security Report export includes compliance status per framework with remediation recommendations suitable for inclusion in formal audit documentation.

Can I try the application before purchasing? Yes. All plans include a 14-day free trial with full functionality. No feature restrictions apply during the trial period.

How does Bluetooth Analyzer compare to hardware-based BLE analyzers? Hardware-based platforms (Ubertooth One, Ellisys, Frontline) capture raw BLE packets at the link layer, providing capabilities such as promiscuous sniffing and encrypted packet capture that software-only tools cannot replicate. Bluetooth Analyzer operates at the Host Controller Interface (HCI) level through CoreBluetooth, which means it sees what the operating system's Bluetooth stack exposes. Within that scope, it provides substantially deeper analysis than hardware tools — automated security scoring, compliance checking, behavioral analysis, and GPU-accelerated visualization that hardware analyzers lack. For most security auditing, compliance, and monitoring use cases, the CoreBluetooth approach provides sufficient visibility with dramatically lower cost and complexity.

Why Amsterdam Technologies

Bluetooth Analyzer reflects Amsterdam Technologies' engineering-first approach to security tooling: deep technical capability delivered through polished, accessible software. The zero-dependency architecture — building exclusively on Apple system frameworks — exemplifies a philosophy that prioritizes supply chain security, long-term maintainability, and performance over rapid feature accretion through third-party packages.

The product is developed and maintained at Amsterdam Technologies' headquarters in Amsterdam, Netherlands. It joins a broader portfolio of cybersecurity and productivity tools that share common design principles: native platform integration, local-first data handling, and professional-grade capability without enterprise-grade complexity.

Bluetooth Analyzer is currently in beta, with an active development roadmap covering expanded vulnerability database coverage, additional advertisement protocol decoders, enhanced environment profiling with multi-location support, and deeper integration with enterprise security workflows. The beta period represents an opportunity for early adopters to shape the product's direction while accessing the full current feature set at launch pricing.

The BLE security landscape is evolving rapidly as Bluetooth adoption grows and new vulnerability classes emerge. Amsterdam Technologies is committed to maintaining Bluetooth Analyzer as a living tool that keeps pace with this evolution — updating vulnerability databases, adding support for new device protocols, and expanding compliance framework coverage as standards evolve.

Website: https://bluetoothanalyzer.amsterdam-technologies.com
Contact: support@amsterdam-technologies.com
Company: amsterdam-technologies.com