Skip to content
HACKTECH

Industries

The attacks your sector draws, the rules it answers to, and the checks we run.

10 sector briefs, with checks that run from refunds sent as parallel requests in fintech to the firewall rules between office and control networks in energy. Start from your sector, or from the framework your auditor or customer named.

  • Fintech and payments

    For payment service providers, neobanks, lenders, wallets, card issuers and the platforms that embed them

    For payment providers, lenders, wallets and card programmes we test the flows that move or release funds: onboarding and identity checks, payment initiation, refunds and payouts, ledger consistency under concurrent requests, and the back-office tools that can override all of them.

    • PCI DSS 4.0.1
    • DORA
    • NYDFS Part 500
    • GDPR
    • SOC 2
    • Israel Privacy Protection Law (Amendment 13)
    • EU AI Act
    • Bank of Israel Directive 364
    Read the threats and the checklist for Fintech and payments

  • Healthcare and medtech

    For hospitals and clinics, digital health products, medical device makers and the suppliers who connect them

    Healthcare runs on systems that cannot simply be switched off to patch: imaging archives, infusion pumps, nurse-call and building systems, electronic health records, and the remote access vendors use to support them. We test what an attacker reaches from a phished clinician, an exposed device or a supplier's connection, and we plan every test around patient safety.

    • HIPAA Security Rule
    • GDPR
    • NIS2
    • Israel Privacy Protection Regulations (Data Security) 5777-2017
    • Israel Privacy Protection Law (Amendment 13)
    • ISO/IEC 27001:2022
    • EU AI Act
    Read the threats and the checklist for Healthcare and medtech

  • SaaS and cloud platforms

    For B2B and B2C software companies, developer and data platforms, and managed service providers

    In a multi-tenant product one missing check can expose every customer at once, and the customer who finds it may be the one running your security review. We test the boundaries that keep tenants apart: authorisation on every object, single sign-on and SCIM provisioning, API keys and integrations, the cloud account underneath, and the pipeline that deploys to it.

    • SOC 2
    • ISO/IEC 27001:2022
    • GDPR
    • NIS2
    • EU Cyber Resilience Act
    • SEC cybersecurity disclosure rules
    • Israel Privacy Protection Law (Amendment 13)
    Read the threats and the checklist for SaaS and cloud platforms

  • Logistics and mobility

    For freight forwarders, carriers, 3PLs, ports and terminals, fleet and telematics providers, and mobility apps

    Logistics is a chain of systems run by different companies that trust each other's messages: booking portals, warehouse and transport management, EDI links, telematics, driver apps and customs filings. We test where that trust can be abused to redirect payments, release or reroute cargo, track vehicles or stop operations.

    • NIS2
    • GDPR
    • ISO/IEC 27001:2022
    • SOC 2
    • Israel Privacy Protection Law (Amendment 13)
    Read the threats and the checklist for Logistics and mobility

  • E-commerce and retail

    For online retailers, marketplaces, direct-to-consumer brands, and retailers running stores, loyalty schemes and click-and-collect

    Online shops are attacked through skimming scripts on checkout pages, account takeover for loyalty points and saved cards, bots that hoard stock and abuse promotions, and the plugins and third-party scripts every shop runs. We test the storefront, the checkout and the systems behind them as an attacker who wants to cash out would.

    • PCI DSS 4.0.1
    • GDPR
    • NIS2
    • Israel Privacy Protection Law (Amendment 13)
    • Israel Privacy Protection Regulations (Data Security) 5777-2017
    Read the threats and the checklist for E-commerce and retail

  • Defence and government suppliers

    For defence manufacturers and subcontractors, government IT and services suppliers, and dual-use technology companies

    Suppliers to defence and government are targeted for what they hold and for who they can reach: drawings, specifications and source code, and trusted connections into their customers. We test the edge devices state-backed groups exploit, the identity systems they abuse once inside, and how controlled information is kept apart from the rest of the business.

    • CMMC 2.0
    • NIST CSF 2.0
    • ISO/IEC 27001:2022
    • NIS2
    Read the threats and the checklist for Defence and government suppliers

  • Education and research

    For universities, colleges, schools and school groups, research institutes and education technology providers

    Universities run open networks for unmanaged devices, hold years of student and staff records, and host research that other states and competitors want. We test the identity systems everyone shares, the student and research systems behind them, and the edtech platforms that collect children's data, taking the openness of the institution as given.

    • GDPR
    • NIS2
    • EU AI Act
    • Israel Privacy Protection Law (Amendment 13)
    • Israel Privacy Protection Regulations (Data Security) 5777-2017
    • CMMC 2.0
    Read the threats and the checklist for Education and research

  • Energy and industrial

    For utilities, renewable and grid operators, oil and gas, water, manufacturers and makers of industrial equipment

    In energy and manufacturing a breach can move physical equipment, so the test plan starts from safety. We assess the path from the office network or a supplier's remote access into operational technology, the exposure of controllers and HMIs, and the separation between IT and OT, using passive methods wherever live process equipment is involved.

    • NIS2
    • EU Cyber Resilience Act
    • NIST CSF 2.0
    • ISO/IEC 27001:2022
    Read the threats and the checklist for Energy and industrial

  • Media and gaming

    For game studios and publishers, streaming and broadcast platforms, news publishers and creator platforms

    Attackers go after media and gaming companies for player accounts with valuable items, unreleased builds and source code, paywalled content, and the reach of a hijacked channel. We test the account systems, game and content APIs, developer infrastructure and anti-abuse controls that decide whether an attacker can take any of them.

    • GDPR
    • PCI DSS 4.0.1
    • NIS2
    • Israel Privacy Protection Law (Amendment 13)
    • Israel Privacy Protection Regulations (Data Security) 5777-2017
    Read the threats and the checklist for Media and gaming

Find your brief from the framework you were asked about

A framework's name opens its entry on the compliance page, with what it asks of testing and incident reporting; the sectors under it are the briefs that cite it.

Bring your sector to a scoping call

We map your systems and the frameworks you answer to, whether or not your sector is listed here. A 45-minute scoping call ends with a fixed quote and a proposed start date; the written scope follows by email.

Book a scoping callAsk a question first