Penetration Testing in Houston, TX
Houston is the energy capital of the world and the most operational-technology-dense metro in the United States: the headquarters campuses of ExxonMobil in Spring, Chevron (relocating from California), ConocoPhillips, Phillips 66, Halliburton, Baker Hughes, SLB, Kinder Morgan and Enterprise Products along the Energy Corridor and the Galleria; the refineries, chemical plants and LNG terminals of the Houston Ship Channel and Baytown, including LyondellBasell's Dutch-rooted operations; the Texas Medical Center, the largest medical complex in the world, with MD Anderson, Houston Methodist, Memorial Hermann, Texas Children's and Baylor College of Medicine; Port Houston, the busiest US port by foreign tonnage; NASA's Johnson Space Center and the contractor base of Clear Lake, including KBR, Jacobs, Axiom Space and Intuitive Machines; and the enterprise headquarters of Hewlett Packard Enterprise, Sysco, Waste Management, CenterPoint Energy and NRG. HackersHub runs offensive security engagements scoped to the threat model these organisations actually face: state-aligned pre-positioning against pipeline and plant control systems, ransomware against hospital systems and ports, business-email compromise against trading and treasury desks, and the TSA pipeline security directive, IEC 62443, NERC CIP, HIPAA, NIST SP 800-171 and Texas privacy evidence that regulators, operators and auditors now expect.
The Houston threat landscape
Houston's defining incidents are about the IT/OT boundary. The May 2021 Colonial Pipeline ransomware attack hit the operator of a pipeline system that originates in the Houston area, and it halted fuel supply to the US East Coast for six days not because control systems were encrypted but because the operator could not trust the billing and scheduling systems that feed them; within two months the Transportation Security Administration had issued its first mandatory pipeline security directives, and the SD Pipeline-2021-01 and -02 series has been renewed and tightened every year since, requiring owners of critical pipelines to segment IT from OT, control remote access, patch critical cyber systems, test their incident response plans and submit to a cybersecurity assessment programme. In August 2021 Port Houston detected and stopped an intrusion that exploited a then-unpatched vulnerability in a self-service password-reset product (CVE-2021-40539); the port followed its Maritime Transportation Security Act facility security plan, reported through the Coast Guard, and the case became the basis of a joint CISA, FBI and Coast Guard Cyber Command advisory in which CISA's director described the attacker as a suspected nation-state actor. The petrochemical corridor sits in a regulatory gap: the Chemical Facility Anti-Terrorism Standards lapsed in July 2023 when Congress let the authority expire, so plant operators lean on IEC 62443, API Standard 1164 for pipeline control systems and NIST SP 800-82 Rev. 3 as the standards their insurers and customers accept. Power generators and transmission owners on the ERCOT grid remain under NERC CIP, and the 2021 winter storm made grid resilience a political issue in Texas. The Texas Medical Center carries the clinical-ransomware exposure that has defined US healthcare since 2020, compounded by thousands of research, clinical-trial and medical-device systems that span a dozen institutions on one campus. Space contractors in Clear Lake hold controlled unclassified information under NASA and, where DoD work applies, DFARS clauses, and are now inside the CMMC 2.0 flow-down. Texas regulates the result through the Texas Data Privacy and Security Act (in force since 1 July 2024), the breach-notification clock of Tex. Bus. & Com. Code 521.053 and the safe harbour for recognised security frameworks enacted in 2025; the state's own cloud-vendor regime, TX-RAMP, is explained on our Texas page at /texas/. Engagements in Houston routinely uncover engineering workstations dual-homed between the plant and the corporate domain, historian and remote-access servers reachable from vendor VPNs, flat networks between a hospital's clinical, research and administrative segments, trading and treasury workflows that rely on email alone to confirm payment-instruction changes, and identity tenants where contractors who left years ago still hold standing access.
Need a penetration test in Houston?
Written scope, named OSCP-certified testers, report within a week of the last testing day.
Industries we routinely engage in Houston
Repeatable threat patterns by sector, drawn from engagement data rather than vendor marketing.
Oil & gas, pipelines & LNG
Upstream, midstream and LNG operators headquartered along the Energy Corridor and operating along the Ship Channel and the Gulf Coast. IT/OT boundary and segmentation testing, remote-access and vendor-connection review, assessment of SCADA, historian and engineering-workstation environments under passive-first rules, and reporting mapped to the TSA Pipeline Security Directive series, API Standard 1164, IEC 62443-3-3 and NIST SP 800-82 Rev. 3. Our OT and ICS penetration testing guide at /insights/ot-ics-penetration-testing/ explains the safe method.
Petrochemicals & refining
Refineries, chemical plants and terminals in Baytown, Deer Park, Pasadena and Texas City. Plant-network and DCS perimeter testing on staging or digital-twin environments where production cannot be touched, safety-instrumented-system isolation review, and findings mapped to IEC 62443, the Responsible Care Security Code and the standards insurers now ask for after the lapse of CFATS.
Power generation & utilities
Generators, retail electric providers, transmission and distribution owners and water utilities on and around the ERCOT grid. NERC CIP evidence (CIP-005 electronic security perimeters, CIP-007 systems security management, CIP-010 configuration change management and vulnerability assessments), corporate-to-control-centre segmentation testing, and identity assessments of the Microsoft 365 and Active Directory estates that sit in front of the OT.
Hospital systems, cancer research & medical devices
The Texas Medical Center institutions, multi-hospital systems across Harris County, cancer and paediatric research centres and the medical-device and health-tech vendors serving them. HIPAA Security Rule evaluation evidence (45 CFR 164.308(a)(8)), clinical-network and medical-device segmentation review, research and clinical-trial system testing under 21 CFR Part 11 change control, and breach readiness mapped to 521.053. Our HIPAA penetration testing guide at /insights/hipaa-penetration-testing/ covers scope and cadence.
Ports, logistics & maritime
Port Houston terminals, shipping lines, terminal operators, freight forwarders and the logistics headquarters of the region. Terminal operating system and OT segmentation testing, port community and customs integration assessments, and evidence for the Coast Guard's Cybersecurity in the Marine Transportation System rule (33 CFR Part 101 Subpart F, in force 16 July 2025) and the MTSA facility security plan.
Space, aerospace & federal contractors
Johnson Space Center contractors and commercial space companies in Clear Lake and Webster, and defence subcontractors across the metro. NIST SP 800-171 and CMMC 2.0 Level 2 readiness testing of controlled-unclassified-information enclaves, DFARS 252.204-7012 evidence, ground-segment and mission-system segmentation review, embedded and firmware testing in our Amsterdam lab, and export-control-aware handling where ITAR or EAR applies.
Compliance frameworks we report against
Engagements for Houston organisations regularly feed into federal, Texas and customer-driven regulatory reporting. Deliverables include a penetration testing statement, executive summary, technical report with proof-of-concept, and a remediation tracker, formatted to satisfy the evidence requirements of each framework below without additional documentation.
- TSA Security Directive Pipeline-2021-01 and Pipeline-2021-02 series (renewed annually since 2021): IT/OT segmentation, access control, continuous monitoring, patching of critical cyber systems, incident response plan testing and cybersecurity assessment programme
- IEC 62443-3-3 and 62443-2-1, API Standard 1164 (3rd edition) for pipeline control systems and NIST SP 800-82 Rev. 3 for operational technology
- NERC CIP (CIP-005, CIP-007, CIP-010 and CIP-013 supply chain) for bulk electric system entities on the ERCOT grid
- Texas Data Privacy and Security Act (Tex. Bus. & Com. Code chapter 541, in force 1 July 2024) and the breach-notification duties of Tex. Bus. & Com. Code 521.053, including notice to the Attorney General for breaches affecting 250 or more Texans
- Texas safe harbour for organisations that implement a recognised cybersecurity framework (enacted 2025)
- HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation and 21 CFR Part 11 for regulated research systems
- US Coast Guard Cybersecurity in the Marine Transportation System rule, 33 CFR Part 101 Subpart F (in force 16 July 2025; cybersecurity plan due 16 July 2027) and the Maritime Transportation Security Act
- NIST SP 800-171, DFARS 252.204-7012 and CMMC 2.0 (32 CFR Part 170) for space and defence contractors and their subcontractors
- SEC cybersecurity disclosure rules (Regulation S-K Item 106 and Form 8-K Item 1.05) for the listed energy, logistics and services headquarters of the metro
- SOC 2 Trust Services Criteria CC7.1 / CC7.4 and PCI DSS v4.0.1 Requirement 11.4 where payments are in scope
- OWASP WSTG, OWASP MASVS v2 and OWASP LLM Top 10 2025 for web, mobile and AI testing; NIST SP 800-115 technical security testing
Services delivered for Houston engagements
Same global service catalogue, scoped to the Texas regulatory and operational-technology context.
See also:Penetration Testing in TexasPenetration Testing in DallasPenetration Testing in Austin
Why Houston organisations choose HackersHub
HackersHub is an Amsterdam-headquartered practitioner firm with no US office, and we model Houston engagements honestly around that. External, web-application, API, cloud and firmware testing is delivered remotely from the Netherlands, with devices and embedded controllers shipped to our Amsterdam lab where the scope calls for it; internal network, Active Directory, wireless, OT and physical assessments are delivered on site in the Energy Corridor, the Ship Channel, the Texas Medical Center and Clear Lake by travelling testers. Scoping calls, status updates and report walkthroughs are scheduled on US Central business hours. Every engagement is led by named OSCP-, OSWE- or CREST-certified offensive security professionals, with Michael van Mameren (OSCP) acting as engagement lead, and reports are written directly against TSA directive, IEC 62443, NERC CIP, HIPAA, NIST SP 800-171 and SOC 2 evidence categories. Our home market gives us a particular affinity with Houston: the Netherlands runs the Port of Rotterdam and Europe's largest refining and chemical cluster under the same IEC 62443 and NIS2 pressures, and several Houston operators share Dutch parents, partners or plants. Operational-technology testing follows the client's change windows and go/no-go with operations. Senior-level scoping calls happen within one business day.
Frequently asked questions: Houston
Ready to Secure Your Systems?
Request a quote for your penetration testing needs.