In Fresno, the control system is public infrastructure and the paperwork is food safety. Water treatment, distribution and groundwater pumping are run here by public agencies of modest size, while the region's processing plants depend on traceability records that law requires to be accurate. CyberFortify runs manual network, cloud and API testing plus non-intrusive control-boundary review, mapped to NIST CSF, SOC 2 and CCPA/CPRA duties. Fixed price, audit-ready reporting, free remediation retest.
// 01 Why Fresno organisations need penetration testing
Two things in this valley cannot be paused, and both are computer-controlled. Water has to keep moving - through treatment plants, distribution mains, canal gates and groundwater wells - and food has to keep moving through processing lines, cold stores and trucks. The organisations running the first are often small public agencies: a district or municipal utility with a lean operations team, a SCADA package installed years ago by an integrator, and remote access set up so someone can check a pump station from home at two in the morning. That remote access is the risk in one sentence. Water-sector control systems are among the most persistently probed targets in the country because they are numerous, exposed and thinly staffed - and because interference with treatment or distribution is not a data-loss incident. It is a public-health event.
The second fails more quietly. A processing plant that discovers a contamination problem has to identify the affected lot and withdraw it, and that ability rests on records - lot codes, supplier links, shipment manifests, labelling data - held across ERP, warehouse and quality systems built for throughput rather than integrity. If those records can be altered, deleted or quietly desynchronised, a recall cannot be executed accurately. Between the two sits an enterprise network touching both: the same directory, the same VPN, the same vendor accounts. A scanner will not tell you whether it reaches operations, and should never be pointed at anything controlling water. Manual testing, scoped with restraint, answers what actually connects to what.
// 02 Compliance and regulatory drivers in Fresno
Fresno organisations rarely face one regulator. A water agency, a processor and a logistics firm each answer to a different stack, and testing evidence has to serve all of them at once.
America's Water Infrastructure Act
Community water systems must maintain risk and resilience assessments and emergency response plans covering electronic and cyber systems. Independent testing supplies evidence instead of assumption.
FSMA traceability recordkeeping
Records must let you identify and withdraw a specific lot - a data-integrity requirement as much as a food-safety one, resting on systems nobody has security-tested.
CCPA/CPRA cybersecurity duties
Californian businesses meeting the thresholds face annual cybersecurity-audit and risk-assessment duties under CPPA rules, and independent testing is the technical substance auditors expect behind them.
NIST CSF for public agencies
Water and municipal bodies structure programmes around the CSF functions. Findings map to Identify, Protect and Detect so the report drops into your existing profile.
SOC 2, PCI DSS 4.0 & HIPAA
Requirement 11.4 mandates segmentation and application testing for card handlers, SOC 2 auditors expect it under CC4, and healthcare organisations add HIPAA safeguards.
// 03 Penetration testing services for Fresno
The lead service depends on what you operate. Water agencies and processors start with network and remote-access testing; software and logistics firms lead with cloud, API and application work.
Network pen testing
External perimeter, internal Active Directory and segmentation testing between business networks and the operational boundary, including every remote-access route into it.
API pen testing
Authorisation testing of integrations carrying lot codes, shipment records and telemetry between plant, warehouse and customer systems.
Cloud pen testing
Configuration-aware review of the AWS and Azure estates where reporting platforms and traceability data increasingly live.
Web application pen testing
Manual OWASP Top 10 testing of customer portals, grower and supplier systems and public-agency web services.
Mobile app pen testing
iOS and Android testing for field, dispatch and monitoring apps holding credentials into back-office platforms.
Red teaming
Goal-based simulation asking whether an ordinary office foothold could reach the operational boundary, stopping at it rather than crossing it.
// 04 How we deliver to Fresno
We should be plain about geography. CyberFortify is a Gulf-based team working at UTC+3, roughly ten to eleven hours ahead of California, with no office in Fresno or anywhere in the United States. We treat that gap as a schedule: a fixed daily overlap window where our late afternoon and evening meets your morning - used for kick-off, escalations and live findings - with testing continuing overnight your time so progress is waiting when you start the day.
What runs remotely
External perimeter, remote-access, web, cloud, API and internal network testing over secure connectivity, plus documentary review of control-system architecture - the large majority of any Fresno engagement.
What justifies travel
Wireless assessment across a plant or treatment site, physical and social-engineering elements, and hands-on boundary review where architecture cannot be verified any other way. We travel when there is a reason, not by default.
Every engagement opens with a free 30-minute scoping call in your morning and a fixed-price quote within the hour. Operational restrictions are agreed in writing before anything starts, and a free retest follows once fixes ship.
// 05 Industries we secure in Fresno
Fresno is the commercial hub of a region defined by water, processing and distribution. We test across the sectors carrying its risk:
// 06 Our methodology
Fresno engagements run the same audit-defensible process CyberFortify uses everywhere, with one hard rule added: the control-system side is assessed, never exercised. IT testing follows the Penetration Testing Execution Standard (PTES) and NIST SP 800-115, with exploitation mapped to MITRE ATT&CK. On the operational side we work passively - architecture, segmentation, firewall rulesets and remote-access design reviewed against the IEC 62443 zone-and-conduit model - with active testing confined to enterprise IT and non-production equipment. Nothing we run can affect live water treatment, distribution or a production line. As a CREST Accreditation Pathway firm, we lead with manual testing.
Scoping & operational agreement
Targets, exclusion zones, the operational boundary, permitted techniques and escalation paths agreed in writing before any packet is sent.
Fixed quote in 1hDiscovery & threat modelling
Enterprise attack surface enumerated and the control boundary mapped on paper, prioritised around continuity and record integrity.
Boundary mappingControlled exploitation
Real exploitation on IT, cloud and application layers; the operational boundary validated by review and configuration analysis only.
Never live OTReporting & free retest
Executive summary, CVSS-scored findings, NIST CSF mapping and remediation your engineers can act on - plus a free retest.
Audit-ready// 07 Why CyberFortify for Fresno
A generic scan and a PDF
A vendor who runs automated tooling at your public IP range, never asks where operations begin, and calls a utility secure whose remote-access path was never examined.
CyberFortify's approach
A CREST-pathway team that scopes around operations first: manual exploitation on IT, disciplined passive assessment at the control boundary, traceability data treated as a security asset, findings mapped to NIST CSF and SOC 2, and a free remediation retest.
Most Fresno engagements pair network and segmentation testing with an API assessment of the systems carrying lot and shipment records.
// 08 Frequently asked questions
Will you test our SCADA or water treatment systems directly?
No, and you should be wary of anyone who offers to. On the control-system side we work passively - architecture and configuration review, firewall rule analysis, remote-access design review, and traffic observation where a span port already exists. Active exploitation happens only on the enterprise network, internet-facing services and non-production equipment. Nothing we do can alter a setpoint, a pump state or a dosing instruction on a live water treatment or distribution system.
Why does a small public water agency need a penetration test?
Because attackers select on exposure, not on headcount. Groundwater pumping, treatment and distribution controls are among the most routinely probed systems in the United States, and a district running them with a handful of staff still faces internet-reachable remote access, vendor support tunnels and a business network one flat subnet away from operations. Testing tells you which of those paths actually connects - the question an America's Water Infrastructure Act risk and resilience assessment needs answered with evidence rather than assumption.
What does traceability testing mean for a Fresno food processor?
FSMA recordkeeping requires you to identify and withdraw a specific lot quickly, so the lot codes, supplier links and shipment records in your ERP, warehouse and labelling systems must be trustworthy. We test those systems and their APIs for flaws that would let records be altered, deleted or exposed across accounts - broken object-level authorisation, weak audit logging, unprotected integration endpoints - so a recall can be executed accurately.
Which compliance frameworks do Fresno engagements map to?
Most commonly NIST CSF for utilities and public agencies, SOC 2 for software and logistics firms, PCI DSS 4.0 Requirement 11.4 for card handlers, ISO 27001 control A.8.29 for organisations with an ISMS, and the CCPA/CPRA regime, whose annual cybersecurity-audit and risk-assessment duties expect independent technical testing as supporting evidence. We map every finding to the frameworks you report against.
You are based in the Gulf - how does that work for a Fresno client?
Honestly and deliberately. Our team works at UTC+3, roughly ten to eleven hours ahead of California, so we hold a fixed daily overlap window: our late afternoon and evening is your morning, when calls, escalations and live findings are handled. Work continues overnight your time, so progress is usually waiting before your first meeting. We are not local to Fresno and do not claim to be - most testing is remote, and we travel on-site only where a genuine physical or control-network reason requires it.