Security for US industries and the rules they face
US sectors face different attackers, regulators and customer demands. We adapt testing, monitoring and reporting to the FTC, NYDFS, HIPAA, PCI DSS, SOC 2 and CMMC requirements that apply to you.
Financial services, fintech & insurance
US financial firms face some of the most specific testing rules in the country. Non-bank financial institutions such as mortgage brokers, auto dealers that finance, tax preparers and fintech lenders fall under the FTC Safeguards Rule, which expects an annual penetration test and vulnerability assessments every six months unless you run effective continuous monitoring. Firms regulated by the New York Department of Financial Services must pentest at least annually under Part 500, and card payments bring PCI DSS.
- Lending, payments and account-opening workflow abuse testing
- Data-sharing and partner API authorization testing
- Mobile banking and wallet app testing against OWASP MASVS
- Penetration testing and vulnerability assessment schedules for the FTC Safeguards Rule and NYDFS Part 500
- 24/7 SOC monitoring with clear incident timelines for 72-hour NYDFS reporting and the FTC's 30-day breach notice
FTC Safeguards Rule testing guide
SaaS & technology
For US software companies, security is part of every sale. Enterprise buyers send long questionnaires and ask for a SOC 2 report, and SOC 2 auditors commonly expect an annual third-party penetration test as evidence. The biggest technical risk is usually tenant isolation: can one customer reach another's data through the app, the API or a shared cloud resource?
- Multi-tenant and role-based access control testing
- SOC 2 readiness with audit-ready penetration test reports and attestation letters
- AWS, Azure and Google Cloud configuration reviews
- AI feature, RAG and LLM integration testing
- Evidence for enterprise security questionnaires and vendor reviews
SOC 2 penetration testing guide
Healthcare & health tech
Ransomware attacks on US hospitals, clinics and their technology vendors have shown how quickly an incident can disrupt patient care. Covered entities and business associates must perform a HIPAA risk analysis and periodic technical evaluation today. HHS has also proposed a Security Rule update that would require penetration testing at least annually and regular vulnerability scanning. It is not final, but many organizations are preparing now.
- Patient portal, EHR integration, telehealth and medical app testing
- Evidence for HIPAA risk analysis and technical evaluation
- Ransomware resilience, network segmentation and backup testing
- Incident response that supports HIPAA and state breach notification decisions
Retail, e-commerce & hospitality
US retailers and restaurant groups are targeted through card-skimming scripts on checkout pages, account takeover, gift card and loyalty fraud, and social engineering of IT help desks. PCI DSS v4.0 requires internal and external penetration testing at least every 12 months and after significant change, plus quarterly vulnerability scans, with external scans run by an Approved Scanning Vendor.
- Checkout, pricing, promotion and loyalty logic testing
- PCI DSS scope reduction, Requirement 11.4 testing and segmentation checks
- Help-desk social engineering and identity attack resilience
- Bot and API abuse reviews ahead of peak shopping seasons
Web application penetration testing
Defense contractors & government suppliers
The CMMC program is now part of DoD contracting. Since November 10, 2025, Level 1 or Level 2 self-assessments can be a condition of award, and from November 10, 2026, Level 2 certification by a C3PAO becomes a condition of award for applicable contracts that involve Controlled Unclassified Information. Level 2 follows the 110 requirements of NIST SP 800-171. We can help you prepare and test, but we are not a C3PAO or RPO.
- NIST SP 800-171 gap reviews and remediation planning
- Internal and external penetration testing of the CUI environment
- Vulnerability scanning programs that support requirement 3.11.2
- Microsoft 365 GCC and enclave configuration reviews
CMMC and NIST SP 800-171 guide
Manufacturing & critical infrastructure
For US manufacturers, utilities and logistics firms, downtime is the main risk. Converged IT and OT networks, legacy plant systems and remote vendor access give attackers room to move once they are inside. Many of these organizations also supply the defense industrial base, so CMMC and NIST SP 800-171 can apply alongside customer and insurer requirements.
- IT/OT segmentation and remote-access testing
- Active Directory and internal network attack paths
- 24/7 NOC and SOC cover for plants, depots and offices across US time zones
- Patch management planned around production windows
Ready to find your risks before attackers do?
Tell us what you need tested or monitored. A senior consultant replies within one business day with a scoped, fixed-price proposal.
- Fixed-price proposal
- Reply within 1 business day
- NDA on request