San Leandro turned an old manufacturing town into a connected one - fiber to the factory, sensors on the line, and dashboards in the cloud - and the connectivity that makes the plant smart is also its new attack surface. CyberFortify runs manual OT/ICS, IIoT, API and cloud penetration tests here, aligned to NIST CSF, IEC 62443, NIST 800-82 and SOC 2. Delivered remotely from our Gulf base on a daily overlap window, with on-site work where it genuinely helps. Fixed price, audit-ready reporting, free retest.
// 01 Why San Leandro businesses need penetration testing
Industry 4.0 rests on a single promise: connect the plant floor to the cloud and you can measure, predict and improve everything on the line. San Leandro made that promise infrastructure. A sensor reading leaves a machine, passes an IIoT gateway, lands in a process historian, and surfaces in a dashboard a manager reads from anywhere. The same fiber that carries it up can carry an instruction back down.
That bridge is the risk. The historian is the system of record for production - write false readings into it, or quietly alter what it holds, and you corrupt the numbers quality, billing and compliance all trust. Reach the floor through the analytics layer and you cross from a cloud dashboard toward the controllers that move real machinery. Both directions matter, and both live in the seam between OT and IT that neither team fully owns.
Scanning does not find that class of flaw. A scanner flags unpatched gateway firmware; it cannot tell you that an over-scoped ingest API accepts telemetry from any device with a token, that a historian tag is writable by an account that should only read it, or that a digital-twin dashboard exposes a path back into the OT VLAN. Those are authorisation and integrity decisions across a data pipeline, and confirming them takes a tester who understands the protocols and the plant behind them.
// 02 Compliance and regulatory drivers in San Leandro
Connected manufacturers answer to an industrial-security standard for the OT and IIoT layer, a vendor-assurance regime for the cloud platforms above it, and California's privacy statute for the corporate data alongside. These are the requirements we most often map evidence against.
IEC 62443 - system & data integrity
The industrial-security standard's system requirements and zone-and-conduit model govern the IIoT data layer. We test data-integrity and authorisation controls and the conduits between the floor, the IIoT platform and corporate IT.
NIST SP 800-82
NIST's guide to OT security frames how the plant-floor and IIoT layer should be segmented, monitored and tested. It underpins the way we scope historian, gateway and pipeline work without touching live production.
SOC 2 for the data platforms
Industrial-software firms and cloud analytics vendors selling into manufacturers face security review before contract. SOC 2 reports rest on independent testing of the multi-tenant platform and its APIs.
NIST CSF
Many San Leandro manufacturers anchor the wider security programme to NIST CSF, using independent testing to evidence the Identify and Protect functions across converged OT and IT.
CCPA / CPRA
California's consumer-privacy regime adds rights, risk-assessment expectations and cybersecurity-audit duties across corporate and workforce data - the ERP, HR and customer systems sitting beside the plant.
CMMC
Manufacturers supplying the defense and aerospace base carry CMMC obligations over controlled unclassified information, and penetration testing supports the assessment evidence.
// 03 Penetration testing services for San Leandro
San Leandro engagements weight the data layer over the perimeter, because that is where the plant meets the cloud. OT/ICS and IIoT testing lead for connected manufacturers; API and cloud follow, since historians and analytics platforms live there; network testing proves the segmentation that keeps the floor and the data layer apart.
OT/ICS pen testing
Historian integrity and authorisation, IIoT gateway exposure, OPC UA and MQTT protocol testing, and segmentation between the floor and the data layer.
IIoT & device pen testing
Industrial sensors, edge collectors and gateways - firmware, credentials, transport security and whether a device can be impersonated on the pipeline.
API pen testing
Cloud-ingest, historian and analytics APIs - broken object-level authorisation, device-identity validation, scope enforcement and token handling.
Cloud pen testing
Tenant isolation, identity, storage exposure and service-account scope across the platforms hosting IIoT data, digital twins and dashboards.
Network pen testing
External, internal and Active Directory testing, plus segmentation checks between OT, the IIoT/data layer and corporate IT.
Red teaming
Goal-based adversary simulation aimed at the OT-to-cloud bridge, testing whether an intrusion into the data layer is detected before it reaches the floor.
// 04 How we deliver to San Leandro
We will not pretend otherwise: CyberFortify is a Gulf-based firm on UTC+3, and San Leandro sits ten to eleven hours behind us. We have no California office and no local staff. What we have is a pattern built around that gap: our late afternoon and evening is your morning, and we hold that window open daily for stand-ups, live triage and read-outs. Testing continues while San Leandro is offline, so results are waiting when your shift starts.
What runs remotely
IIoT platform, historian, API, cloud and external testing from our secure environment - the large majority of data-layer scope. Read-heavy and message-injection work runs against staging or a mirrored feed, and confirmed findings land in a shared channel with criticals escalated at once.
What we do on-site
Internal network, gateway, wireless and segmentation testing where a tester genuinely needs to be on the OT wire, plus in-person workshops for OT security committees. We travel when it adds value and say so when it does not.
Every engagement opens with a free 30-minute scoping call and a fixed-price quote within the hour. For live plant segments we agree test windows around production load, and a free retest proves the fixes.
// 05 Industries we secure in San Leandro
San Leandro's risk profile is shaped by a dense cluster of advanced manufacturers, the industrial-software firms that serve them, and the connectivity that ties both to the cloud.
// 06 Our methodology
San Leandro engagements follow the same audit-defensible process we run everywhere, tuned to the data pipeline at the centre of this market. Testing is grounded in the PTES and NIST SP 800-115, with OT work referenced to NIST 800-82 and IEC 62443, exploitation mapped to MITRE ATT&CK tactics - including ATT&CK for ICS - and application work driven by OWASP, including the API Security Top 10. As a CREST Accreditation Pathway firm we lead with manual testing - automation supports the tester, never replaces one.
Scoping & rules of engagement
Targets, IIoT and historian surfaces, OT/IT zone boundaries, test accounts, safe-state limits and escalation paths agreed in writing first.
Fixed quote in 1hReconnaissance & threat modelling
Attack surface mapped around the pipeline itself - which device writes what, through which gateway, into which historian tag, and who can read or alter it.
ATT&CK for ICSManual exploitation
Weaknesses are exploited and chained under controlled conditions, integrity and cross-zone access proven with seeded test tags and staging feeds - never live production data or unsafe writes to running controllers.
Controlled exploitReporting & free retest
Executive summary, CVSS-scored detail and mapping to IEC 62443, NIST 800-82, SOC 2, NIST CSF or CCPA/CPRA - plus a free retest once fixes ship.
Audit-ready// 07 Why CyberFortify for San Leandro
A scan-and-report vendor
Automated output rebadged as a penetration test, blind to historian integrity and pipeline authorisation, unable to reason about who wrote a tag or which zone a token should reach.
CyberFortify
A Gulf-based, CREST-pathway team candid about the time difference and structured around it. Manual exploitation aimed at the OT-to-cloud seam - historian integrity, IIoT gateway exposure and pipeline authorisation - findings mapped to your assessors' frameworks, fixed pricing and a free retest.
San Leandro engagements most often pair an OT/ICS assessment with a cloud penetration test, since the data layer's risk splits between the integrity controls on the floor side and the tenant and identity configuration in the cloud. Where a corrupted production record or a downed line is a safety or continuity event, we add red teaming to test detection across the bridge.
// 08 Frequently asked questions
Do you test process historians and IIoT data platforms for San Leandro manufacturers?
Yes - it is the work we are asked for most in San Leandro. The historian is the system of record for production, so we test whether its integrity and authorisation actually hold: can a low-privilege account or a compromised gateway write false readings into the record, can historical data be altered or deleted without trace, and are read scopes enforced per tag rather than granted wholesale. On the IIoT platform we test tenant isolation, API authorisation and whether analytics accounts can be pivoted back toward the plant floor.
How do you test the OT-to-cloud data pipeline without disrupting production?
We treat the pipeline as its own target - the gateway, the broker or edge collector, the transport, and the cloud ingest API - rather than assuming it inherits the floor's or the cloud's security. We test authentication at each hop, whether MQTT or OPC UA topics enforce authorisation, whether ingest APIs validate device identity or trust anything that presents a token, and whether the bridge can be crossed downward toward controllers. Read-heavy and message-injection tests run against staging or a mirrored feed, and any active work on live segments is scheduled around production windows agreed in writing first.
Which regulations and standards drive penetration testing for San Leandro's smart manufacturers?
IEC 62443 anchors most programmes here, and we map findings to its system and data-integrity requirements and its zone-and-conduit model; NIST SP 800-82 guides the OT and IIoT layer. Industrial-software vendors and the cloud data platforms carry SOC 2, and many manufacturers align the wider programme to NIST CSF. CCPA/CPRA applies to corporate and workforce data, and firms selling into federal supply chains add CMMC. We map every finding to whichever of these your assessors and customers rely on.
With your team in the Gulf, how does the time gap work for a San Leandro engagement?
We should be plain: CyberFortify is a Gulf-based firm on UTC+3, ten to eleven hours ahead of San Leandro, with no California office or local staff. We hold a deliberate daily overlap window - our late afternoon and evening is your morning - for stand-ups, live triage and read-outs on any test touching plant systems. Testing continues while your team is offline, so findings are usually waiting when your shift starts, and active work on production segments is scheduled inside windows you approve.
How fast can we get a quote for a San Leandro engagement?
Book a free 30-minute scoping call and we return a fixed-price quote, usually within the hour and always within one business day. The report is written to hand straight to an auditor or an OT security committee, and a remediation retest is included once your fixes ship.