Alhambra sits on the trade route between the US and Asia, and the risk that follows international commerce is a risk of misdirected money and forged documents. CyberFortify runs manual API, web, cloud and network penetration tests here, plus business email compromise and payment-redirect simulation, aligned to the GLBA and FTC Safeguards Rule, CCPA/CPRA, PCI DSS 4.0 and SOC 2. Delivered remotely from our Gulf base on a daily overlap window, with on-site work where it genuinely helps. Fixed price, audit-ready reporting, free retest.
// 01 Why Alhambra businesses need penetration testing
Follow a single container from a factory in Asia to a warehouse in the San Gabriel Valley and count the messages it generates. A purchase order, a proforma invoice, a letter of credit, a bill of lading, a customs entry, a payment instruction - each one an email or a portal login, each one moving between a supplier, a bank, a broker and a buyer who may never meet. International trade runs on that correspondence, and it runs across borders and time zones at speed.
Alhambra concentrates this business: import-export firms, trade-finance and cross-border banking operations, customs brokers and the wholesalers who receive the goods. That makes the city a natural target for the fraud that shadows international trade. A criminal who inserts a single spoofed email into a payment thread - a "corrected" beneficiary account on a wire, a diverted letter-of-credit settlement - can move six figures before anyone reconciles it. Business email compromise does not break a firewall; it breaks a conversation.
Scanning does not find that class of risk. A scanner reports an outdated library; it cannot tell you that a finance mailbox has a forwarding rule quietly copying every invoice to an outside address, that your DMARC policy is set to monitor rather than reject, or that a shipping-portal identifier can be changed to read another importer's documents. Those are authorisation and process decisions, and confirming them takes a tester who understands how a trade transaction is actually paid.
// 02 Compliance and regulatory drivers in Alhambra
Firms that finance and settle international trade sit inside a financial-data regime, a payments and sanctions context, and a consumer-privacy statute over everything else they hold. These are the requirements we most often map evidence against.
GLBA & FTC Safeguards Rule
Where a firm handles trade-finance or cross-border banking data, the Gramm-Leach-Bliley Act and the FTC Safeguards Rule require a written information-security programme with periodic testing. Independent penetration testing is how most Alhambra firms evidence it.
BSA/AML & OFAC screening context
Cross-border payments sit inside anti-money-laundering and OFAC sanctions-screening obligations. We do not audit your AML programme, but the integrity and authorisation of the systems that run those checks is squarely a security concern.
Business email compromise exposure
Payment-redirect and letter-of-credit fraud is the dominant loss event in trade. An unmanaged spoofing gap or a compromised finance mailbox is a direct path to a diverted wire, so we prioritise findings by the money and documents they expose.
CCPA / CPRA
California's consumer-privacy regime adds rights, risk-assessment expectations and cybersecurity-audit duties across supplier and customer data - the records and portals behind your trade relationships. Our privacy-regulation guidance compares the regimes.
PCI DSS v4.0 - Req 11.4
Where card payments touch a customer or freight-payment portal, the cardholder environment must be penetration-tested and segmentation proven under Requirement 11.4.5.
// 03 Penetration testing services for Alhambra
Alhambra engagements weight the payment path and the documents that move with it. Email and BEC simulation lead, because that is where the money is diverted; API and web testing cover the trade-document and payment portals; cloud follows, since the platforms that host them live there.
BEC & social-engineering simulation
Business email compromise, invoice and letter-of-credit payment-redirect scenarios, and account takeover of finance and trade staff - testing whether a changed payment instruction is caught.
API pen testing
Trade-document, shipping and payment interfaces - broken object-level authorisation, identifier enumeration, scope enforcement and token handling on the data that binds a transaction.
Web application pen testing
Trade-finance, cross-border banking and shipping portals, tested against the OWASP Top 10 and the business-logic abuse that lets a document be approved or released out of sequence.
Cloud pen testing
Identity, tenant isolation, storage exposure and service-account scope across the platforms hosting your trade documents, supplier records and payment workflows.
Network pen testing
External, internal and Active Directory testing, plus segmentation checks between finance, operations and general corporate environments.
Mobile app pen testing
iOS and Android trade and approval apps - local data storage, certificate handling and the payment and document API traffic behind the screen.
// 04 How we deliver to Alhambra
We will not pretend otherwise: CyberFortify is a Gulf-based firm on UTC+3, and Alhambra sits ten to eleven hours behind us. We have no California office and no local staff. What we have is a working pattern built around that gap - and trade firms, already used to coordinating suppliers and banks across time zones, tend to find it natural: our late afternoon and evening is your morning, and we hold that window open daily for stand-ups, live triage and read-outs. Testing continues while Alhambra is offline, so results are waiting when your trading day starts.
What runs remotely
BEC and phishing simulation, API, web, cloud and external testing from our secure environment - the large majority of trade-finance, payment and import-export scope. Findings land in a shared channel as confirmed, and anything touching live payment flow is escalated immediately.
What we do on-site
Internal network, wireless and segmentation testing where a tester genuinely needs to be on the wire, plus in-person workshops for finance and operations teams. We travel when it adds value and say so when it does not.
Every engagement opens with a free 30-minute scoping call and a fixed-price quote within the hour. For live payment and settlement environments we agree test windows around your trading and cut-off times, and a free retest proves the fixes.
// 05 Industries we secure in Alhambra
Alhambra's risk profile is shaped by cross-border trade, the finance that funds it, and the logistics and technology firms that carry it.
// 06 Our methodology
Alhambra engagements follow the same audit-defensible process we run everywhere, tuned to the payment and document flow at the centre of this market. Testing is grounded in the PTES and NIST SP 800-115, with exploitation and adversary behaviour mapped to MITRE ATT&CK, and application work driven by OWASP, including the API Security Top 10. As a CREST Accreditation Pathway firm we lead with manual testing - automation supports the tester, never replaces one.
Scoping & rules of engagement
Targets, payment and document surfaces, counterparty boundaries, test accounts and escalation paths agreed in writing first.
Fixed quote in 1hReconnaissance & threat modelling
Attack surface mapped around the transaction - who sends which payment instruction, who approves it, which portals and mailboxes bind the trade, and where a document or wire can be diverted.
ATT&CK alignedManual exploitation
Weaknesses are exploited and chained under controlled conditions - a redirected payment or substituted document proven with seeded test records, never live counterparty funds or data.
Controlled exploitReporting & free retest
Executive summary, CVSS-scored detail and mapping to the FTC Safeguards Rule, CCPA/CPRA, PCI DSS, SOC 2 or NIST CSF - plus a free retest once fixes ship.
Audit-ready// 07 Why CyberFortify for Alhambra
A scan-and-report vendor
Automated output rebadged as a penetration test, blind to a payment thread or an authorisation model, unable to reason about who can move a wire or read a counterparty's letter of credit.
CyberFortify
A Gulf-based, CREST-pathway team candid about the time difference and structured around it. Manual exploitation and BEC simulation aimed at the payment and document seam of international trade, findings mapped to your auditors' and examiners' frameworks, fixed pricing and a free retest.
Alhambra engagements most often pair a BEC and social-engineering assessment with an API and web test of the trade-document and payment portals, since the loss path splits between the people who authorise a payment and the systems that record it. Where cross-border banking data is in scope, we add a cloud penetration test of the identity and storage layer beneath it.
// 08 Frequently asked questions
Can you simulate business email compromise and payment-redirect fraud on our international invoices and letters of credit?
Yes - it is the scenario Alhambra trade firms ask for most. We model the way a real attacker diverts a cross-border payment: spoofed and look-alike sender domains, replies threaded into a genuine invoice or letter-of-credit chain, and last-minute changes to beneficiary bank details on a wire. We test your email authentication - SPF, DKIM and DMARC alignment - along with the human and system controls meant to catch a changed payment instruction, and we check whether a compromised finance mailbox can be used to authorise a transfer or approve a shipping release.
How do you test our trade-documentation and shipping portals for fraud and data exposure?
We treat the trade-document and shipping platform as its own target. We test whether a bill of lading, commercial invoice, packing list or letter-of-credit record belonging to one party can be read, altered or substituted by another - broken object-level authorisation, identifier enumeration and weak workflow controls that let a document be approved or released out of sequence. We also test the cross-border banking and trade-finance portals your team logs into, checking that partner and account scopes are enforced per request rather than only at sign-in, and that supplier and customer records are not exposed to the wrong counterparty.
Which regulations drive penetration testing for Alhambra trade-finance and import-export businesses?
Where a firm handles trade-finance or cross-border banking data, the GLBA and the FTC Safeguards Rule require a written security programme with periodic testing, and independent penetration testing is the usual way that duty is evidenced. Cross-border payments also sit inside BSA/AML and OFAC sanctions-screening obligations, so the integrity of those systems matters to examiners. CCPA/CPRA adds consumer rights and risk-assessment duties over supplier and customer data, card-taking portals bring PCI DSS 4.0 Requirement 11.4, trade-tech and finance vendors add SOC 2, and many firms anchor the whole programme to NIST CSF.
Your team is in the Gulf - how does the time gap play out for an Alhambra trade engagement?
Trade firms already run on other people's clocks, so this tends to feel familiar. To be plain: CyberFortify is a Gulf-based firm on UTC+3, ten to eleven hours ahead of Alhambra, with no California office or local staff. We hold a deliberate daily overlap window - our late afternoon and evening is your morning - for stand-ups, live triage and read-outs. Testing continues while your team is offline, so confirmed findings are usually waiting when the trading day opens.
How fast can we get a quote for an Alhambra engagement?
Book a free 30-minute scoping call and we return a fixed-price quote, usually within the hour and always within one business day. The report is written to hand straight to an auditor or examiner, and a remediation retest is included once your fixes ship.