Penetration Testing in Washington State

The Washington State threat landscape

The defining risk in Washington State is identity in the cloud. When most of an organisation's crown jewels sit in Microsoft 365, Entra ID, AWS and a dozen SaaS tenants, the attacker's first objective is a token, a federated trust or an over-privileged service principal rather than a server, and the Cyber Safety Review Board's 2024 report on the 2023 intrusion into cloud email accounts showed how far a single stolen signing key can reach. Puget Sound's SaaS companies inherit that exposure and pass it on to every customer whose data they process, which is why enterprise buyers now ask them for an independent penetration test before signing. Boeing's Puget Sound production and the hundreds of machine shops, composites suppliers and engineering firms around it carry export-controlled technical data and controlled unclassified information, and from November 2025 the Department of Defense began phasing CMMC 2.0 requirements into the contracts those suppliers depend on. The state's ports and airport are a documented ransomware target: in August 2024 the Rhysida group attacked the Port of Seattle, disrupting systems at Seattle-Tacoma International Airport for weeks; the Port declined to pay and later notified roughly 90,000 people, most of them Washington residents, that their personal data had been taken. Health systems face clinical ransomware and, since March 2024, the Washington My Health My Data Act, which extends privacy duties and a private right of action to consumer health data that HIPAA never covered, including data held by apps, retailers and wellness platforms. East of the Cascades, hydropower utilities, the data-centre campuses of Quincy and Wenatchee, agriculture and food processors, and the Hanford site and its laboratory partners add operational technology to the picture. Washington's breach statute, RCW 19.255.010, requires notice to affected residents within 30 days of discovery and to the Attorney General when more than 500 Washington residents are affected. Engagements across the state routinely uncover cloud roles granted to long-departed contractors, SaaS integrations with tenant-wide consent, flat networks between corporate IT and production or port operations, and supplier VPN accounts that never expire.

Washington State and US frameworks we report against

Washington organisations rarely answer to a single regime. A Bellevue SaaS vendor can owe SOC 2 evidence to customers, FedRAMP evidence to an agency and My Health My Data Act diligence to its own counsel in the same quarter. We write each finding once and tag it to every framework below that it touches, so one report serves the auditor, the customer questionnaire and the privacy team. The report pairs an executive summary with CVSS-scored findings, evidence, an attack narrative and a remediation order, and the 90-day verification retest of medium and higher findings is part of the engagement.

• RCW 19.255.010 breach notification: affected Washington residents within 30 days of discovery, and the Attorney General when more than 500 residents are affected
• Washington My Health My Data Act (RCW 19.373), in force since 31 March 2024 (30 June 2024 for small businesses), covering consumer health data outside HIPAA, with a private right of action
• Security policies and standards of the Washington Office of the Chief Information Officer (WaTech) for state agencies and their vendors
• HIPAA Security Rule 45 CFR 164.308(a)(8) technical evaluation
• PCI DSS v4.0.1 Requirement 11.4 penetration testing
• SOC 2 Trust Services Criteria CC7.1 / CC7.4 and ISO 27001:2022 Annex A 8.8
• FedRAMP Rev. 5 CA-8 penetration testing for cloud providers serving federal agencies
• CMMC 2.0 Level 2 (NIST SP 800-171) and DFARS 252.204-7012 for defence suppliers, with ITAR-aware evidence handling
• NERC CIP-005 / CIP-007 / CIP-010 for bulk electric system entities
• US Coast Guard cybersecurity requirements for the Marine Transportation System (final rule 2025) for port and terminal operators
• NIST SP 800-115 technical security testing and PTES methodology

Why Washington State organisations choose HackersHub

The honest answer starts with what we are not: HackersHub has no office in Washington State or anywhere else in the US. We are a Netherlands firm, founded in 2015, with more than 2,500 completed security engagements and a 4.9/5 rating across 127 reviews, serving US clients today together with vetted US delivery partners while we prepare a full-scale US market entry for Q1 2027. In a cloud-heavy state that model fits well, because the systems most Washington organisations need tested (tenants, APIs, SaaS back-ends and identity providers) are reachable from anywhere and lose nothing when tested remotely. Plant floors, port terminals, hospital wards and offices that need internal or wireless work get travelling testers for the engagement window. The Pacific coast sits nine hours behind Amsterdam, so a finding written up at the end of our day is waiting for your morning stand-up. Every tester holds at least the OSCP, OSWE and CREST specialists add web and infrastructure depth, and Michael van Mameren (OSCP) leads engagements against PTES, OWASP WSTG and MASTG and NIST SP 800-115. Each scope is quoted on its own merits; we do not publish a price list.