Penetration Testing in St. Louis, MO
Greater St. Louis is a headquarters city for regulated industries: BJC HealthCare, SSM Health, Mercy and Ascension in healthcare, Centene in managed care, Edward Jones, Stifel and Wells Fargo Advisors in wealth management, the National Geospatial-Intelligence Agency's new western campus and Boeing's defence operations in national security, Bayer's crop-science research hub and the Danforth Plant Science Center in agri-bio, and World Wide Technology, Emerson and Enterprise Mobility across enterprise technology and operations. HackersHub runs offensive security engagements scoped to the threat model these organisations face: ransomware against health systems, account takeover and fraud against brokerage clients, state-aligned collection against geospatial, defence and agricultural research, and the evidence that HIPAA, SEC Regulation S-P, CMMC and Missouri and Illinois law now require.
The St. Louis and Missouri threat landscape
St. Louis is home to the headquarters of one of the health systems hit hardest by ransomware in recent US history. In May 2024 Ascension, the St. Louis-headquartered Catholic health system, detected a ransomware attack that took electronic health records, patient portals and phone systems offline across its hospitals for weeks, forcing clinicians back to paper and ambulance diversions in several markets; the system later reported that personal and health data of close to 5.6 million people had been affected. The attack reportedly began when an employee downloaded a malicious file, which is the pattern we test against across the metro: a single user foothold, credential theft, movement through Active Directory and a domain-wide impact that no single control was designed to stop. Health systems and managed-care organisations here hold claims, eligibility and clinical data for millions of members across many states, which makes them high-value extortion targets. The wealth-management and brokerage firms headquartered in the region face a different adversary: account-takeover fraud against client accounts, social engineering aimed at advisers and branch staff, and abuse of the APIs that connect advisers, custodians and aggregators. The geospatial and defence cluster, built around the National Geospatial-Intelligence Agency, Boeing and the contractors that serve them and the air-mobility commands at nearby Scott Air Force Base, attracts state-aligned collection and depends on suppliers meeting CMMC requirements. Agricultural biotech adds seed genetics, trait data and field-trial results that competitors and foreign intelligence services have both sought. The metro also spans the Mississippi: organisations with operations on the Illinois side fall under the Biometric Information Privacy Act, which has produced some of the largest privacy judgments in the country. Engagements in St. Louis routinely uncover help-desk processes that reset multi-factor authentication without strong verification, adviser and agent portals with broken object-level authorisation, research networks reachable from the corporate domain, and supplier accounts with standing access that no one reviews.
Need a penetration test in St. Louis?
Written scope, named OSCP-certified testers, report within a week of the last testing day.
Industries we routinely engage in St. Louis
Six sectors account for most of the St. Louis work we scope, each with its own adversary and its own evidence trail.
Health systems & hospitals
Faith-based systems that run hospitals in many states from a St. Louis headquarters, the academic medical centre tied to the city's research university, regional community hospitals and the digital-health vendors plugged into all of them. Since 2024, boards here ask a specific question: could one downloaded file still become a system-wide outage? We answer it by tracing that path through identity, endpoint controls, EHR access and backup isolation, and by testing whether recovery systems survive an attacker who already holds domain privileges. The HIPAA guide at /insights/hipaa-penetration-testing/ covers scoping.
Managed care & health plans
Medicaid, Medicare Advantage and marketplace health plans, pharmacy-benefit and specialty services, and the member, provider and claims platforms behind them. External and internal penetration tests, privileged-access and identity assessments around bulk claims and eligibility data, manual web-application and API testing of member and provider portals, and evidence mapped to HIPAA and state Medicaid contract security requirements.
Wealth management, brokerage & banking
Broker-dealers, registered investment advisers, regional banks and the adviser, custodian and aggregator platforms that connect them. Account-takeover and fraud-path testing, adviser and branch social-engineering assessments, manual testing of client portals and APIs, and evidence aligned to SEC Regulation S-P (amended 2024), Regulation S-ID, FINRA expectations, the GLBA Safeguards Rule and the FFIEC IT Examination Handbook.
Geospatial intelligence, aerospace & defence
Imagery and geospatial-analytics firms, aircraft and weapons-system manufacturers, and the integrators and start-ups that have formed around the NGA's western campus and the transportation and air-mobility commands at Scott Air Force Base. The adversary here is patient and state-backed. We run identity, segmentation and red team work that mirrors that tradecraft and produce evidence for CUI enclaves heading into a CMMC 2.0 Level 2 assessment under DFARS 252.204-7012.
Agricultural biotech & plant science
Crop-science and seed companies, plant-science research institutes and the agtech start-ups of the 39 North innovation district. Research-network and laboratory segmentation testing, cloud and identity assessments across genomic and field-trial data platforms, and red team operations that test whether IP-collection tradecraft could reach trait and breeding data.
Enterprise IT, industrial automation & mobility
A large privately held systems integrator, an automation and measurement manufacturer, a vehicle-rental and fleet operator, and a growing base of B2B software companies. Integrators and managed providers multiply supply-chain risk, so we test their remote-management tooling and customer-access paths as hard as their own estate. Automation products are tested with IEC 62443 as the frame of reference; SaaS platforms get manual application, API and cloud testing to back the SOC 2 report their buyers ask for (see /insights/soc-2-penetration-testing/).
Compliance frameworks we report against
St. Louis organisations often operate on both sides of the river and under several regulators at once, so a single report has to travel. Ours contains an executive summary for the board, CVSS-scored findings with reproduction evidence, an attack narrative that shows how findings chain together, and a remediation plan ranked by risk, with each finding tagged to the Missouri, Illinois, federal or contractual control it touches. Every medium or higher finding is retested within 90 days to confirm the fix.
- Missouri data breach notification law (RSMo 407.1500): notice to affected Missouri residents without unreasonable delay, and to the Attorney General and the consumer reporting agencies when more than 1,000 residents are notified
- Missouri Department of Commerce and Insurance oversight of insurers and health plans operating in the state
- Illinois Biometric Information Privacy Act (740 ILCS 14) and Personal Information Protection Act (815 ILCS 530) for operations in the Illinois part of the metro
- HIPAA Security Rule technical evaluation duty (45 CFR 164.308(a)(8)) for covered health systems, health plans and their business associates
- SEC Regulation S-P (amended 2024) and Regulation S-ID for broker-dealers and investment advisers, with FINRA supervision of member firms
- FFIEC IT Examination Handbook and GLBA Safeguards Rule (16 CFR Part 314) for the region's banks and trust companies
- Form 8-K Item 1.05 incident reporting and Regulation S-K Item 106 governance disclosure for St. Louis-listed issuers
- CMMC 2.0 Level 2 certification against the 110 NIST SP 800-171 requirements, flowed down through DFARS 252.204-7012 to geospatial and aerospace suppliers
- IEC 62443-3-3 and 62443-4-2 for automation products and the plants that run them
- SOC 2 Type II reports for SaaS and IT-services providers, where testing supports criteria CC4.1 and CC7.1
- PCI DSS v4.0.1 penetration testing (Requirement 11.4) for card acceptance in retail, hospitality and healthcare billing
- NIST SP 800-115 testing guidance underpinning scoping, rules of engagement and reporting
Services delivered for St. Louis engagements
Pick the scope that matches the risk: an adviser portal, a member API, a CUI enclave ahead of a CMMC assessment, or a full adversary simulation against a multi-state health system. Delivery and reporting are tailored to Missouri and Illinois obligations.
See also:Penetration Testing in ChicagoPenetration Testing in IllinoisPenetration Testing in United States
Why St. Louis organisations choose HackersHub
Transparency on delivery matters more than a postcode, so here is ours. HackersHub has worked in offensive security since its founding in the Netherlands in 2015 and has closed more than 2,500 engagements; its only headquarters is in Amsterdam and it has no St. Louis or other US premises. Internet-facing scopes, from external networks to web applications, APIs, cloud tenants and identity providers, are tested from the Netherlands. On-site scopes, including internal networks, Active Directory, wireless, laboratories and hospital or branch locations in Missouri or Illinois, are handled by travelling HackersHub testers, reinforced when needed by vetted US delivery partners. Our testers all hold OSCP at minimum, with OSWE and CREST holders on the team, and Michael van Mameren (OSCP) is engagement lead. We work to PTES, OWASP WSTG and MASTG and NIST SP 800-115, and schedule calls in Central time. US clients are already served from the Netherlands, a full US market entry is planned for Q1 2027, and in the run-up 20 complimentary penetration tests are open to qualifying US companies. Client reviews average 4.9/5 across 127 ratings.
Frequently asked questions: St. Louis
Ready to Secure Your Systems?
Request a quote for your penetration testing needs.