Orange runs on the academic medical centre - a place where patient care, medical research and teaching share one network and one directory, and where much of the protected health information belongs to children. CyberFortify runs manual identity & network, web, API and cloud penetration tests here, aligned to the HIPAA Security Rule, the California CMIA, FERPA and NIST CSF. Delivered remotely from our Gulf base on a daily overlap window, with on-site work where it genuinely helps. Fixed price, audit-ready reporting, free retest.
// 01 Why Orange businesses need penetration testing
An academic medical centre is one of the hardest environments in healthcare to secure, and Orange is built around several of them. Three missions collide on shared infrastructure: patient care, with its clinical systems and protected health information; research, with grant data, study subjects and sometimes controlled unclassified information; and education, with students, rotating residents and thousands of transient accounts. Each mission has its own rules, and all of them draw on one identity population that never stops moving.
That fluid population is the risk. A single person can be a treating clinician, a principal investigator and a course instructor on the same directory, and every new rotation adds accounts that someone must remember to remove. Over-broad and stale access accumulates quietly, and the boundary between a care network, a research network and a campus network is exactly where a compromised login does the most damage. Add paediatric care and the stakes rise further - a child's medical identity can be misused for years before anyone notices, which makes the authorisation logic behind a family portal something you want tested, not assumed.
Scanning does not find that class of flaw. A scanner reports an unpatched host; it cannot tell you that a research account can open a clinical chart, that a resident who finished a rotation still holds access to a service line, or that changing an identifier in a patient-portal request returns another child's record. Those are identity and authorisation decisions, and confirming them takes a tester who understands how the three missions were wired together.
// 02 Compliance and regulatory drivers in Orange
An academic medical centre answers to a federal privacy regime, a stricter state layer, an education-records law and a research-data standard at the same time. These are the requirements we most often map evidence against.
HIPAA Security Rule - risk analysis & evaluation
Covered entities and business associates must run an accurate risk analysis and periodically re-evaluate their technical safeguards. Independent testing is how most Orange medical centres evidence it.
California CMIA
The Confidentiality of Medical Information Act governs disclosure of medical information in California and is stricter than HIPAA in places, reaching entities and disclosures federal rules do not - including paediatric and adolescent records.
HITECH breach notification
HITECH sets the notification duties that follow an unauthorised disclosure. An unresolved authorisation flaw exposing paediatric PHI is a potential notification event, so we prioritise findings by exactly what they expose.
FERPA - medical-student records
Where the education records of medical students and residents live alongside clinical systems, FERPA governs their handling. We test the identity separation that is meant to keep learning records and patient records apart.
NIST 800-171 & NIST CSF
Federally funded research that touches controlled unclassified information carries NIST 800-171 obligations, and many campuses run the whole security programme to NIST CSF. Independent testing evidences both.
CCPA / CPRA
California's consumer-privacy regime adds rights, risk-assessment expectations and cybersecurity-audit duties across non-clinical data - alumni, donor and patient-portal identity systems. Our privacy-regulation guidance compares them.
// 03 Penetration testing services for Orange
Orange engagements weight identity and internal boundaries over the perimeter, because that is where the three missions meet. Identity and network testing leads for academic medical centres; web and API cover the patient, family and research portals; cloud follows, since research computing and integration platforms live there.
Network pen testing
Active Directory, privileged-access paths and Kerberoasting, plus segmentation checks between care, research and campus networks.
Web application pen testing
Patient, family and research portals tested against the OWASP Top 10 - IDOR, BOLA and business-logic abuse that reaches another patient's or subject's record.
API pen testing
Patient-access and research APIs - broken object-level authorisation, scope enforcement, guardian and proxy-access checks, and token handling.
Cloud pen testing
Identity, tenant isolation and storage exposure across research-computing tenants and the platforms hosting clinical and study data.
Mobile app pen testing
iOS and Android patient, family and clinician apps - local data storage, certificate handling and the API traffic behind the screen.
Red teaming
Goal-based adversary simulation, including phishing a large clinical population and ransomware scenarios, testing whether intrusions are detected before care is disrupted.
// 04 How we deliver to Orange
We will not pretend otherwise: CyberFortify is a Gulf-based firm on UTC+3, and Orange sits ten to eleven hours behind us. We have no California office and no local staff. What we have is a working pattern built around that gap: our late afternoon and evening is your morning, and we hold that window open daily for stand-ups, live triage and read-outs with your security committee. Testing continues while the campus is offline, so results are waiting when your day starts.
What runs remotely
Web, API, cloud, mobile and external testing from our secure environment - the large majority of academic-medical, research-portal and health-tech scope. Findings land in a shared channel as confirmed, and anything exposing paediatric PHI is escalated immediately.
What we do on-site
Internal network, Active Directory, wireless and segmentation testing where a tester genuinely needs to be on the wire between care and research networks, plus in-person workshops for security committees. We travel when it adds value and say so when it does not.
Every engagement opens with a free 30-minute scoping call and a fixed-price quote within the hour. For clinical and research environments we agree test windows around operational and study load, and a free retest proves the fixes.
// 05 Industries we secure in Orange
Orange's risk profile is shaped by a dense academic-medical and paediatric-care core, a teaching-and-research campus, and the retail and technology sectors that surround Old Towne.
// 06 Our methodology
Orange engagements follow the same audit-defensible process we run everywhere, tuned to the identity problem at the centre of an academic medical centre. Testing is grounded in the PTES and NIST SP 800-115, with exploitation mapped to MITRE ATT&CK tactics and application work driven by OWASP, including the API Security Top 10. As a CREST Accreditation Pathway firm we lead with manual testing - automation supports the tester, never replaces one.
Scoping & rules of engagement
Targets, identity boundaries, clinical/research/teaching scope, seeded test accounts and escalation paths agreed in writing first.
Fixed quote in 1hReconnaissance & threat modelling
Attack surface mapped around the shared identity population - who holds what role, where accounts persist after a rotation, and which boundary each login can cross.
ATT&CK alignedManual exploitation
Weaknesses are exploited and chained under controlled conditions, with cross-account access proven using seeded test patients and study subjects - never live paediatric or clinical data.
Controlled exploitReporting & free retest
Executive summary, CVSS-scored detail and mapping to HIPAA, CMIA, FERPA, NIST 800-171 or NIST CSF - plus a free retest once fixes ship.
Audit-ready// 07 Why CyberFortify for Orange
A scan-and-report vendor
Automated output rebadged as a penetration test, blind to authorisation logic, unable to reason about who an account belongs to or which mission's boundary a login just crossed.
CyberFortify
A Gulf-based, CREST-pathway team candid about the time difference and structured around it. Manual exploitation aimed at the identity seam between care, research and teaching, careful handling of paediatric PHI, findings mapped to your assessors' frameworks, fixed pricing and a free retest.
Orange engagements most often pair a network and Active Directory assessment with web and API testing of patient and research portals, since the campus risk splits between the identity configuration underneath and the authorisation logic in front. Where care disruption is a patient-safety event, we add red teaming to test detection under phishing and ransomware scenarios.
// 08 Frequently asked questions
How do you test identity and access across an academic medical centre's clinical, research and teaching systems?
We treat the shared identity population as the primary target, because at an academic medical centre one person may be a clinician, a researcher and a teacher on the same directory. We test whether a research account can reach clinical records it has no business seeing, whether rotating residents and students accumulate access nobody removes, and whether stale or over-broad accounts survive long after a rotation ends. We test role separation, joiner-mover-leaver handling, privileged-access paths and the trust between clinical, research and campus identity systems - the places where a single compromised login crosses a boundary it should never cross.
How do you handle the sensitivity of paediatric PHI when testing children's hospital systems?
A child's medical identity is valuable precisely because misuse can go undetected for years, so we test the authorisation logic that is meant to keep one young patient's record away from another. On patient and family portals we prove or disprove IDOR and BOLA - whether changing an identifier in a request returns another child's chart, whether guardian and proxy-access relationships are enforced per request, and whether adolescent-confidentiality rules hold. We never test against live paediatric records: cross-account access is demonstrated with seeded test patients and study subjects in a controlled scope agreed in writing first.
Which regulations drive penetration testing for an Orange academic medical centre?
The HIPAA Security Rule requires a risk analysis and periodic technical evaluation, and independent testing is the usual way that evaluation is evidenced. HITECH governs breach notification, and California's Confidentiality of Medical Information Act applies on top and is stricter than HIPAA in several respects. FERPA reaches the education records of medical students and residents, NIST 800-171 governs federally funded research that touches controlled unclassified information, and CCPA/CPRA adds consumer rights and risk-assessment duties across non-clinical data. Many campuses anchor the whole programme to NIST CSF.
With your team in the Gulf, how does the time gap actually work for an Orange engagement?
We should be plain: CyberFortify is a Gulf-based firm on UTC+3, ten to eleven hours ahead of Orange, with no California office or local staff. We work a deliberate daily overlap window - our late afternoon and evening is your morning - reserved for stand-ups, live triage and read-outs with your security committee. Testing continues while your team is offline, so findings are usually waiting when the campus day starts.
How fast can we get a quote for an Orange engagement?
Book a free 30-minute scoping call and we return a fixed-price quote, usually within the hour and always within one business day. The report is written to hand straight to an auditor or a research sponsor, and a remediation retest is included once your fixes ship.