Penetration Testing in Michigan
Michigan is where the American car is designed, engineered and increasingly connected: General Motors in Detroit, Ford in Dearborn, Stellantis North America in Auburn Hills, tier-one suppliers such as Lear in Southfield and BorgWarner in Auburn Hills, and the mobility test grounds of Ypsilanti and Detroit's Corktown. Around the auto industry sit Corewell Health, Henry Ford Health, Michigan Medicine, Trinity Health and McLaren Health Care, the lenders and insurers of downtown Detroit, the Army's Detroit Arsenal and the combat-vehicle contractors of Sterling Heights, the manufacturers of West Michigan and the Great Lakes Bay, Stryker in Kalamazoo, and the University of Michigan, Michigan State University and Wayne State. HackersHub runs manual penetration tests, red team operations and phishing simulations for these organisations, delivered by OSCP-, OSWE- and CREST-certified testers.
The Michigan threat landscape
Michigan's attack surface has moved from the factory floor into the vehicle itself. Automakers and suppliers now ship cars with telematics units, over-the-air update services, mobile apps and charging integrations, and they must show regulators in Europe, Japan and Korea that they run a certified cybersecurity management system under the UN Economic Commission for Europe's vehicle cybersecurity regulation, which applies to all new vehicles sold in those markets since July 2024, with ISO/SAE 21434 as the engineering standard behind it. Suppliers to German manufacturers must also pass a TISAX information-security assessment, and the US Department of Commerce's January 2025 rule on connected-vehicle technology from countries of concern is reshaping the software and hardware supply chain. Behind the vehicle sit some of the largest and oldest manufacturing networks in the country, where flat plant networks, legacy controllers and supplier remote access remain the most common route from a phishing email to a stopped line. Healthcare carries the state's largest documented incident: between late July and late August 2023 attackers had access to McLaren Health Care's network, and the Grand Blanc-based system later notified about 2.2 million people that their personal and medical data had been exposed. In the same month, the University of Michigan took its campus network offline for days after detecting unauthorised access. Detroit's mortgage lenders, auto lenders and health insurers hold financial and medical data at national scale, and the defence contractors around the Detroit Arsenal are subject to CMMC 2.0 requirements phased into Department of Defense contracts from November 2025. Michigan's Identity Theft Protection Act, MCL 445.72, requires notice to affected residents without unreasonable delay, and licensed insurers operate under the state's insurance data-security law. Engagements across the state routinely uncover plant networks reachable from corporate Wi-Fi, engineering file shares holding vehicle firmware and signing material, dealer and supplier portals with weak authorisation, and telematics and mobile-app APIs that trust the client too much.
Need a penetration test in Michigan?
Written scope, named OSCP-certified testers, report within a week of the last testing day.
Sectors we engage across Michigan
The car industry dominates Michigan's testing demand, but health, finance, defence, universities and public bodies make up a large share.
Automotive OEMs, connected vehicles & mobility (Detroit, Dearborn, Auburn Hills)
Automakers, EV and battery programmes, telematics and over-the-air platforms, mobile-app and charging services, and mobility start-ups. Vehicle-adjacent API, mobile-app and cloud back-end testing, telematics and update-service assessments, and evidence that supports a cybersecurity management system under the UNECE vehicle cybersecurity regulation and ISO/SAE 21434.
Tier-one and tier-two suppliers & manufacturing
Seating, electronics, powertrain, chassis and materials suppliers, plus the furniture, chemicals and medical-device manufacturers of West Michigan and the Great Lakes Bay. Plant-network and IT/OT segmentation testing, supplier and vendor remote-access reviews, Active Directory assessments, and testing that supports TISAX assessments, IEC 62443 and NIST SP 800-82 Rev. 3.
Healthcare systems & health insurers
Statewide hospital systems formed by successive mergers, academic medicine in Ann Arbor and Detroit, physician networks and Blue-plan and regional health insurers. Merged systems often run several identity directories and electronic-record instances side by side, so testing traces the trust between them, alongside patient-portal testing and the technical evaluation the HIPAA Security Rule expects at 45 CFR 164.308(a)(8).
Mortgage, auto finance & insurance (Detroit, Troy)
Mortgage lenders, auto lenders, banks and insurers with national customer bases. Web-application, mobile and API penetration tests, identity and privileged-access assessments, and phishing simulation against payment and loan-servicing workflows. Evidence mapped to the GLBA Safeguards Rule, the FFIEC IT Examination Handbook, SOC 2, PCI DSS v4.0.1 Requirement 11.4 and Michigan's insurance data-security requirements.
Defence & ground-vehicle contractors (Warren, Sterling Heights)
Combat and tactical vehicle programmes, the Detroit Arsenal supplier base and the engineering firms supporting Army ground-vehicle research. Much of the work happens in companies that also build civilian parts, so testing focuses on where defence CAD data and civilian production share networks, accounts and file servers, with findings written against NIST SP 800-171 and evidence handled in line with ITAR.
Universities, research & state and local government
Research universities in Ann Arbor, East Lansing and Detroit, state agencies in Lansing, and Michigan's counties, cities and school districts. After the 2023 campus outage, universities ask us mainly how an intruder would move from a compromised student or researcher account to central systems; public bodies ask how quickly ransomware would reach backups, payroll and tax records.
Michigan and US frameworks we report against
Michigan reports often have to satisfy two continents: a US auditor or insurer on one side and a European OEM, type-approval authority or TISAX assessor on the other. We tag each finding to the frameworks below that apply, describe it in terms both audiences understand and include the evidence needed to reproduce it. Every report has an executive summary, CVSS scores, an attack narrative and a fix order, and medium and higher findings are retested within 90 days.
- Michigan Identity Theft Protection Act, MCL 445.72: breach notice to affected residents without unreasonable delay
- Michigan insurance data-security law (Chapter 5A of the Insurance Code) for licensed insurers
- UNECE vehicle cybersecurity regulation (UN R155) cybersecurity management system and ISO/SAE 21434 road-vehicle cybersecurity engineering
- TISAX information-security assessments for suppliers to German automakers
- US Department of Commerce connected-vehicle supply-chain rule (January 2025)
- IEC 62443 and NIST SP 800-82 Rev. 3 for manufacturing and OT
- CMMC 2.0 Level 2 (NIST SP 800-171) and DFARS 252.204-7012 for defence suppliers
- HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation
- GLBA Safeguards Rule (16 CFR Part 314) and FFIEC IT Examination Handbook for lenders and banks
- PCI DSS v4.0.1 Requirement 11.4 penetration testing
- SOC 2 Trust Services Criteria CC7.1 / CC7.4
- NIST SP 800-115 technical security testing and PTES methodology
Services delivered across Michigan
Application, API and cloud testing for connected products, plus plant-network, identity and red team work for the organisations behind them.
See also:Penetration Testing in OhioPenetration Testing in ChicagoPenetration Testing in United States
Why Michigan organisations choose HackersHub
Michigan's automotive industry already works across the Atlantic every day, so a European testing partner is less unusual here than almost anywhere else in the US. HackersHub is an Amsterdam firm, founded in 2015, with more than 2,500 completed engagements and a 4.9/5 rating across 127 reviews. It has no office in Michigan or elsewhere in the US; Michigan engagements are run by the Amsterdam team with vetted US delivery partners, and the firm's full-scale US market entry is set for Q1 2027. Working daily under EU rules means the UNECE vehicle cybersecurity regulation, TISAX and the NIS2 Directive are familiar ground rather than export paperwork. Connected-vehicle back-ends, apps, APIs and cloud tenants are tested remotely; plants, engineering centres, hospitals and offices in Detroit, Dearborn, Auburn Hills, Troy, Ann Arbor, Lansing or Grand Rapids receive travelling testers. Testers hold at least the OSCP, OSWE and CREST specialists cover deeper application and infrastructure work, and Michael van Mameren (OSCP) leads engagements against PTES, OWASP WSTG and MASTG and NIST SP 800-115. Each engagement is quoted individually; we keep no price list.
Frequently asked questions: Michigan
Ready to Secure Your Systems?
Request a quote for your penetration testing needs.