Penetration Testing in the United States

The US threat landscape in 2026

The United States carries the largest and most heavily targeted enterprise attack surface in the world, and the incidents that defined the last three years share a pattern: one weak point in a widely shared system cascades across an entire sector. In February 2024 a ransomware affiliate entered Change Healthcare, the claims and payment clearinghouse owned by UnitedHealth Group, through a remote-access portal that the company's chief executive later told Congress was not protected by multi-factor authentication. Pharmacies, hospitals and physician practices across the country lost the ability to process claims for weeks, and the breach was ultimately reported to the HHS Office for Civil Rights as affecting about 192.7 million people, the largest healthcare breach on record. A year earlier, the mass exploitation of a zero-day in the MOVEit Transfer file-transfer product exposed data held by thousands of organisations, from federal agencies and state pension funds to banks, insurers and universities, almost none of which had been breached directly. Alongside these supply-chain events run the steady patterns every US security team recognises: social-engineering attacks on IT help desks used to reset credentials and bypass multi-factor authentication, business-email compromise against finance and treasury functions, which the FBI's Internet Crime Complaint Center consistently ranks among the costliest reported cybercrimes, ransomware against hospitals, municipalities and manufacturers, and state-aligned pre-positioning in energy, water and telecommunications networks documented in joint CISA advisories. Regulators have answered with disclosure and testing duties rather than guidance. Public companies must disclose material cybersecurity incidents on Form 8-K within four business days of determining materiality, and describe their risk management annually; the FTC Safeguards Rule expects non-bank financial institutions to run annual penetration tests unless they monitor continuously; NYDFS Part 500 requires an annual penetration test from every covered entity; and the CMMC program now writes third-party assessment into defence contracts. Engagements across the US routinely uncover the same root causes those incidents exposed: remote-access and file-transfer services reachable from the internet with single-factor authentication, help-desk processes that reset credentials on the strength of a phone call, cloud identities and service principals with standing administrative rights, acquired subsidiaries connected to the parent directory long before they were secured, and API endpoints that trust the client to enforce authorisation.

The US regulatory map we report against

There is no single US cybersecurity law; obligations stack by sector, by state and by customer contract, and most enterprises answer to several at once. Every HackersHub engagement delivers a penetration testing statement, an executive summary, CVSS-scored findings with evidence and an attack narrative, and a prioritised remediation plan, with each finding mapped to the frameworks below so that the same report serves the auditor, the examiner and the board. State hub pages for California, New York State, Texas, Florida and the other states listed below cover state privacy and breach-notification law in detail.

• SEC cybersecurity disclosure rules (in force since December 2023): Form 8-K Item 1.05 disclosure of material incidents within four business days of the materiality determination, and Regulation S-K Item 106 annual risk-management and governance disclosure
• HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation, and the HHS proposed Security Rule update of January 2025 that would make penetration testing at least every 12 months an explicit requirement
• GLBA and the FTC Safeguards Rule (16 CFR Part 314): annual penetration testing and vulnerability assessments at least every six months unless continuous monitoring is in place, and notification to the FTC within 30 days of a breach affecting 500 or more consumers
• FFIEC IT Examination Handbook and SEC Regulation S-P (amended 2024) for banks, broker-dealers and investment advisers
• NYDFS 23 NYCRR Part 500 (amended November 2023): annual penetration testing under 500.5 for every covered entity, wherever it is headquartered
• PCI DSS v4.0.1 Requirement 11.4 internal and external penetration testing at least annually and after significant change, with segmentation testing
• SOC 2 Trust Services Criteria CC4.1, CC7.1 and CC7.4
• CMMC 2.0 Level 2 (NIST SP 800-171), written into DoD contracts through the DFARS rule in force since 10 November 2025
• FedRAMP Rev. 5 CA-8 penetration testing and NIST SP 800-53 Rev. 5 for cloud services sold to federal agencies
• NERC CIP-005, CIP-007 and CIP-010 for bulk electric system entities, and the TSA pipeline security directives
• FDA section 524B of the Federal Food, Drug, and Cosmetic Act for cyber devices
• State consumer privacy laws, now enacted in roughly twenty states including California (CCPA/CPRA), Virginia, Colorado, Texas, Florida and New Jersey, and breach-notification laws in all 50 states
• NIST SP 800-115 technical security testing and the NIST Cybersecurity Framework 2.0

How HackersHub delivers in the United States

A national page deserves a straight answer to the obvious question: HackersHub runs its US work from Amsterdam and has no American office today. The model that stands in for one has three parts. First, the bulk of a typical US scope, internet-facing applications, APIs, mobile apps and AWS, Azure or Google Cloud tenants, is attacked from the Netherlands by the firm's in-house offensive-security specialists; with six to nine hours between Amsterdam and the four mainland time zones, testing runs while American systems are quiet and findings reach the client by morning. Second, work that needs someone in the building, internal Active Directory, wireless, OT plants or physical intrusion, is done by testers who fly in on the direct Schiphol routes to East Coast, Midwest, Texas and West Coast hubs. Third, for longer programs or several sites at once, vetted US delivery partners extend the team under HackersHub's methodology and review. The people stay named: Michael van Mameren (OSCP) leads engagements, every tester holds at least OSCP, and OSWE and CREST specialists are part of the team. PTES, the OWASP WSTG and MASTG and NIST SP 800-115 shape the method; reports carry an executive summary, CVSS-scored evidence, an attack narrative and prioritised remediation, and a retest of medium and higher findings within 90 days comes with every engagement. Founded in 2015, rated 4.9/5 across 127 reviews and past 2,500 completed engagements, HackersHub moves to a full-scale US market entry in Q1 2027, with every scope quoted individually.