Penetration testing for US industries
Six US sectors, each with its own rules and attacker incentives. Here is where we focus testing and which requirement it usually supports.
Our testing method doesn't change between clients. What changes in the US is the rulebook each sector answers to, the data criminals want from it, and how much disruption the business can absorb while we work. These six sections explain where we aim the testing hours for each, and which requirement the report usually supports.
SaaS & technology (SOC 2)
For a US software company, a recent pentest report is part of the sales cycle. Enterprise security teams ask for it in vendor questionnaires, and SOC 2 auditors commonly expect to see one even though the criteria don't name penetration testing. Nothing loses a deal faster than a report showing one tenant can read another's records, so cross-tenant access is where we start and where we spend the longest.
- Tenant boundaries across screens, APIs, exports, webhooks and background jobs
- Support impersonation, admin consoles and feature flags
- Single sign-on over SAML or OIDC, SCIM user sync and team invites
- Cloud accounts and container clusters that host the product
- A retest letter prospects can review under NDA
Web application testing for SaaS products
Financial services & fintech (FTC Safeguards, NYDFS)
US lenders, brokers, payment firms and fintech platforms carry explicit testing duties. Under the FTC Safeguards Rule, covered non-bank financial institutions that don't monitor continuously must run a penetration test each year and assess vulnerabilities at least every six months, although institutions holding customer information on under 5,000 consumers fall outside that duty. NYDFS Part 500.5 calls for annual penetration testing by a qualified independent party. Card handling adds PCI DSS.
- Transfers, limits, refunds and approvals under parallel requests
- Account opening, identity checks and recovery flows
- Banking and wallet apps against OWASP MASVS
- Aggregator and partner APIs for object-level authorization
- Reports that state which rule each part of the test supports
API testing for financial platforms
Healthcare (HIPAA)
US providers, health plans and health tech vendors already owe a HIPAA risk analysis and periodic evaluation of their safeguards, and a penetration test is a practical way to check that those safeguards hold. HHS has also proposed making annual penetration testing an explicit requirement; that proposal is not yet final. Patient portals, EHR integrations and older clinical systems are where we usually focus.
- Patient portals, telehealth and scheduling apps
- FHIR and HL7 interfaces to the EHR
- Separation between clinical, guest and business networks
- Networked medical and building equipment, handled under safety rules set before testing
- Testing windows set with clinical and IT leads
Internal network testing for health organizations
Retail & e-commerce (PCI DSS)
Stores lose money through business logic as often as through servers: stacked promotions, gift card abuse, loyalty fraud and price tampering. Any merchant handling card data also answers to PCI DSS v4.0.1, which expects inside and outside penetration testing once a year at minimum and again whenever the environment changes significantly, with segmentation proven wherever it shrinks scope.
- Cart, pricing, coupons, gift cards and loyalty points
- Account takeover and misuse of saved payment methods
- Third-party JavaScript running where shoppers type card details
- APIs for orders, refunds and third-party sellers
- Proof that store and office networks can't reach card systems
PCI DSS penetration testing requirements
Defense industrial base & government contractors (CMMC)
Contractors handling controlled unclassified information work to NIST SP 800-171 Rev 2, whose 110 requirements form CMMC Level 2. CMMC Phase 1 took effect on November 10, 2025. Phase 2 follows on November 10, 2026, after which applicable contracts call for a Level 2 assessment by a C3PAO before award. Level 3 draws on NIST SP 800-172, where enhanced requirement 3.12.1e calls for annual penetration testing. We are not a C3PAO or RPO; our testing gives you evidence that controls work.
- The enclave or network that stores and processes CUI
- Boundary controls between CUI and general business systems
- Remote access, MFA and privileged account paths
- Active Directory and cloud identity reaching CUI
- Findings mapped to the relevant 800-171 control families
Active Directory testing for contractors
Manufacturing & critical infrastructure
For plants, utilities and logistics operators, the outcome to avoid is downtime. Ransomware groups look for the route from an office workstation to the systems that run production. Shared accounts, flat networks, vendor remote access and engineering laptops that are hard to patch often make that route shorter than leaders expect.
- Boundaries between business IT and operational technology
- Vendor and integrator remote access
- Identity paths from the corporate domain toward plant systems
- Exposure of remote access and management services to the internet
- Passive or tightly limited work near live control systems
Ready to find your risks before attackers do?
Tell us what you need tested or monitored. A senior consultant replies within one business day with a scoped, fixed-price proposal.
- Fixed-price proposal
- Reply within 1 business day
- NDA on request