Penetration Testing in California

The California threat landscape

California's adversaries want three things: source code and model weights, the personal data of nearly 40 million residents, and the operational pressure that comes from disrupting hospitals, ports and public services. Technology and AI companies in the Bay Area face sustained intellectual-property collection, from state-aligned intrusion sets targeting semiconductor designs and model research to insider recruitment and the compromise of build pipelines, package registries and developer laptops. SaaS platforms carry the multiplier risk of their customers' data, where a single tenant-isolation flaw or leaked support credential exposes thousands of downstream organisations. Public bodies have absorbed some of the most visible attacks: in February 2023 a ransomware attack took down City of Oakland networks for weeks and led the city to declare a local state of emergency, and in September 2022 the Los Angeles Unified School District, the second-largest district in the country, was hit by a ransomware group that later published stolen student and staff data. Hospital systems across the state remain prime extortion targets because every hour of downtime threatens patient care, while the Ports of Los Angeles and Long Beach, the busiest container gateway in the Western Hemisphere, and the aerospace and defence supplier base of Southern California add operational-technology and CMMC-driven requirements. California now regulates the result more tightly than any other state. The CCPA, as amended by the CPRA, gives consumers a private right of action with statutory damages when a breach results from a failure to maintain reasonable security under Cal. Civ. Code 1798.81.5; the California Privacy Protection Agency's cybersecurity audit regulations, in force since 1 January 2026, require qualifying businesses to complete an independent annual cybersecurity audit and submit a certification, with first certifications due from April 2028 for the largest businesses; and since 1 January 2026, SB 446 requires breach notices to affected residents within 30 calendar days of discovery, with a sample notice to the Attorney General within 15 days of that when more than 500 Californians are affected. Common findings in California work include CI/CD runners and artefact stores with production secrets, identity providers federated across acquisitions with inconsistent conditional-access policies, support and admin tooling that bypasses tenant boundaries, cloud storage holding training data or customer exports without access logging, and clinical or studio networks reachable from contractor VPNs.

California and US frameworks we report against

California layers the strictest state privacy regime in the country on top of the federal and sector frameworks every US enterprise already answers to. HackersHub deliverables, a penetration testing statement, executive summary, CVSS-scored findings with evidence and attack narrative, and a prioritised remediation plan, map each finding to the requirements below, so that the same report supports the CPPA audit, the SOC 2 examination and the customer security review.

• California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code 1798.100 et seq.), including the private right of action in 1798.150 for breaches caused by a failure to maintain reasonable security
• California Privacy Protection Agency cybersecurity audit regulations (in force since 1 January 2026): independent annual audits with certifications due from 1 April 2028, 2029 or 2030 depending on business revenue
• Cal. Civ. Code 1798.81.5 reasonable security procedures and practices
• Cal. Civ. Code 1798.82 breach notification as amended by SB 446: affected residents within 30 calendar days of discovery, and a sample notice to the Attorney General within 15 days of that when more than 500 residents are affected
• California Confidentiality of Medical Information Act (CMIA) for providers, health plans and digital-health companies
• State Administrative Manual chapter 5300 and the California Department of Technology security standards for state agencies and their vendors
• HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation
• FDA section 524B of the Federal Food, Drug, and Cosmetic Act for cyber devices
• SEC cybersecurity disclosure rules (Form 8-K Item 1.05, Regulation S-K Item 106)
• SOC 2 Trust Services Criteria CC4.1, CC7.1 and CC7.4
• PCI DSS v4.0.1 Requirement 11.4 penetration testing
• CMMC 2.0 Level 2 (NIST SP 800-171) and FedRAMP Rev. 5 CA-8
• OWASP LLM Top 10 2025 and NIST SP 800-115 technical security testing

Why California organisations work with HackersHub

California engagements are run from Amsterdam, where HackersHub is headquartered; the firm has no California office and no US office of any kind. That turns out to suit the state's workload. Most Californian attack surface is cloud, SaaS, API and AI infrastructure, which HackersHub's internal specialists test remotely from the Netherlands while California sleeps, so production peaks are left alone and results are waiting at the start of the Pacific day. When an engagement needs someone in the building, for a laboratory network, a studio, an internal Active Directory assessment or a physical test, testers travel to the Bay Area, Los Angeles, San Diego or Sacramento, and vetted US delivery partners add capacity on larger scopes. Scoping and readout calls are booked on Pacific time. Michael van Mameren (OSCP) leads engagements; every tester holds at least OSCP, with OSWE and CREST specialists for application and infrastructure depth. Methodology follows PTES, the OWASP WSTG and NIST SP 800-115, and medium and higher findings are retested within 90 days. More than 2,500 engagements since 2015 stand behind HackersHub's full-scale US market entry in Q1 2027.