Offensive Security, Incident Response and Industrial Cybersecurity
Penetration Testing, Incident Response and OT Security Experts
A scanner lists weaknesses; it cannot tell you whether an attacker can chain them into your identity systems, your production data or the controllers that run your plant. Global Digital Forensics answers that question with senior operators who validate every attack path by hand across networks, applications, industrial control systems, aircraft and AI deployments, then rank findings by business consequence and retest your fixes. When an incident is already underway, the 24/7 hotline puts responders on it to contain the intrusion and preserve the evidence your insurer will ask for.
Start here
Precision Scoping Around Your Critical Systems and Uptime
A planned penetration test, an active incident and an industrial assessment start from different places, and the first conversation sorts out which one you are facing. Describe your systems, the business concern behind the request and the constraints you operate under, and a senior practitioner will recommend the service, the testing depth and the lead whose experience fits, along with what the report will give your leadership.
Find the attack paths before someone else does
We define targets, authorized access, exclusions and stop conditions, then test the way an intruder would and rank what we find by business consequence, so your team fixes the right things first and can prove it on retest.
Get answers fast when an incident is underway
Call the hotline. It is answered 24/7, and we help you contain the intrusion and preserve the logs and records in the same motion, because an attacker who still has access can destroy the evidence that explains what happened.
Assess industrial systems without disrupting the process
We agree facility boundaries, methods and timing with the engineers who run the process, so a SCADA or OT assessment respects safety and uptime and still gives you a clear picture of access, segmentation and recovery.
The full directory
Choose the Security Engagement by the Decision You Face
Every testing, response, industrial and advisory service we offer, grouped by the decision it supports. If you are unsure where to begin, call (800) 868-8189 and a practitioner will point you to the right page.
Industrial, AI and readiness services
Security Work Shaped by Incident Response and Court
Global Digital Forensics has operated since 1992, and its security work is shaped by what we see in incident response and in court. We know how intrusions actually unfold because we reconstruct them after the fact, and we document every finding the way we document evidence, so it holds its meaning in front of a board, an insurer or a regulator. The same rigor runs through our specialist work: GDF performs a great deal of FAA and EASA airworthiness penetration testing for aircraft manufacturers, avionics suppliers, airlines and MROs, and audits and tests large surveillance installations. Our founder Joseph Caruso holds the CISSP, and his career spans software development, mainframe databases, real time transaction systems, mobile networks and cybersecurity incident response.
Tell us the systems, the owners, the objective and the deadline. Before any validation begins we define targets, exclusions, test identities, data handling and operating constraints in writing. For industrial systems, include the engineers who can explain the process and approve methods and timing.
Call (800) 868-8189 or request a scoping call to plan the work around your operations.
Principal services
Penetration Testing, Industrial Security and Code Review From One Team
The starting point may be a business network, an application, an industrial process or the code behind a product. Authorization and operating limits are agreed in writing before any testing begins.
Penetration testing that shows what an intruder could reach
We test authorized network and application attack paths and validate the real consequence of each material weakness. Targets, access, exclusions and stop conditions are defined up front, and your technical team receives the evidence, remediation priorities ranked by business impact and an agreed retest scope.
Scope a network or application testSCADA and OT assessments planned around the process
We assess industrial access, segmentation, monitoring and recovery readiness around the process your team operates. Documentation review and passive observation establish context first, and engineering approves the methods and timing of any active validation, so testing fits the windows your operators set.
Plan an assessment around operationsCritical infrastructure security with evidence that holds up
We connect operational security findings, incident readiness and supporting evidence across infrastructure environments. Define the technical questions and the audience for the report, and we will match it to an assessment, incident response or audit support engagement.
Explore infrastructure security and evidence supportSource code security review by engineers who read code
We trace identity, authorization, data flows and trust decisions through the agreed version of your source code. Manual review and our SourceScan platform surface candidate findings, and our engineers confirm each one in application context, explaining the conditions, consequences and the fix your developers need.
Discuss a codebase or release reviewHow the work runs
Reports Boards Can Read and Engineers Can Act On
A useful assessment explains what was examined, what each finding means in your environment and what should happen next, in language fit for the people who have to decide.
Assessment or penetration test: which one you need
A vulnerability assessment identifies and prioritizes weaknesses across an agreed scope. A penetration test examines authorized paths and the conditions under which a weakness becomes a business consequence. Each answers a different question, and we will tell you plainly which you need.
Bring the business decision, the system owners, the test identities, the available logs, the data handling rules and the validation you will permit. For production and industrial systems, add the operating constraints and the conditions under which work stops.
Review vulnerability assessment scopeFindings, remediation and retesting, documented like evidence
Each report covers the affected systems or code, the observed evidence, the preconditions, the business or operating consequence, the recommended change and the remaining limits. Leadership and engineering read the same findings at different depths, and we write for both.
We agree up front which corrections will be retested and what evidence proves closure. The report names the tested scope and method, so an auditor, an insurer or a customer can see exactly what was covered and when.
Prepare a penetration testing scope requestSpecialist services
Browse Every Cybersecurity Service
Pick the page that matches your systems and your decision. Each one explains what we test, how we do it and what your team receives.
Testing and assessment for networks and applications
Start with the decision you need to make. Exposure assessment, application testing and continuous validation serve different purposes, and the AI assisted options below describe how we use automation under human control.
SCADA, maritime, water and utilities
Choose a specific industrial service when the scope centers on supervisory systems, incident evidence or audit support, from a single plant to a utility’s compliance record.
AI systems and security decisions
Review the governance, architecture and technical behavior of the AI systems you deploy so leaders understand the risks before they scale. This work is distinct from the use of AI tools during a penetration test.
Incident response and preparation
An active event needs containment, preservation and coordinated response, and our hotline is answered 24/7. Readiness work defines the records and responsibilities in advance so the next incident is answered from evidence rather than guesswork.
Aviation, rail, vessels, traffic and surveillance
Aircraft, rail signaling, ships, traffic signals and camera networks all run on connected systems that were rarely designed with an intruder in mind. These engagements test them against the standards their regulators and operators apply, including DO-326A/ED-202A, DO-356A/ED-203A and EASA Part-IS for aviation.
Additional services
Architecture, Leadership and Audit Evidence Services
The services below address segmentation, connected devices and industrial inventory, and the advisory and evidence work that executives, acquirers and regulators ask for.
Architecture, connected systems and industrial inventory
Choose a defined architecture or system review when the question concerns segmentation, asset inventory, connected devices or a mainframe environment, areas where our founder’s engineering background reaches back to 1980.
Leadership, diligence and audit evidence
These engagements support a defined business decision or a technical evidence requirement, whether that is an acquisition, a board briefing or a regulator’s request. We agree applicability, scope and reporting responsibilities so the output serves the people who must rely on it.
The people behind the findings
Meet the Specialists Who Sign the Report
Tools find candidates. People establish what a finding means in the application or the plant under review, and ours have explained their findings under oath.
Industrial, application and incident experience on the team
Joseph Caruso, our founder, CEO and CTO, holds the CISSP and began his technology career in 1980, and it spans software development, mainframe databases, real time transaction systems, mobile networks and cybersecurity incident response. Robert Knudsen combines the CISSP, the Certified Computer Examiner credential and CompTIA Security+ and Network+ with eighteen years of forensic casework, twenty years with the New York City Police Department and hands on support of business computer and network environments.
Ask for current CVs during scoping and we will confirm who leads your engagement and which specialists join it.
Meet the GDF teamSourceScan and source code security review
SourceScan is GDF owned software, developed and maintained in partnership with PNNX, that applies AI assistance to source analysis and tracks findings through remediation. Our engineers assess every material finding against the relevant source version and application context, so the tool informs the review and human judgment supports the conclusions.
When the question is code ownership, copying or disputed software behavior in litigation, follow the separate expert witness service.
Send us the systems and the deadline, and the first call will set the scope, the approvals and the schedule.
Choose the Industrial Cybersecurity Engagement for Your Operation
Industrial and transportation systems fail differently from office networks, so each scope starts with the operator who owns the process, the evidence that already exists, the access we are allowed and the engineering or safety roles who must sign off on anything active.
For ports, terminals and the vessels that call at them, a maritime cybersecurity assessment examines cyber access and recovery against the actual operation; the maritime assessment preparation guide and the maritime assessment deliverables preview show what to gather and what you receive. Water and wastewater utilities get a water and wastewater cybersecurity assessment of assets, remote access and recovery around treatment dependencies, with a water and wastewater preparation guide and a water and wastewater deliverables guide to match.
For generation, transmission, renewables and storage, a power and energy cybersecurity assessment maps access paths and recovery with qualified electrical roles and outage windows built into the plan; the power and energy preparation guide and the power and energy deliverables guide set out what the work needs and what it produces. Utilities facing an audit or an incident can start with utility audit and incident readiness, which ties the applicable controls to evidence and closes the gaps.
Aircraft, rail and road systems sit in the same family. GDF tests avionics, aircraft networks, in flight entertainment and connectivity, in flight satellite communications, airline and MRO IT and ground systems for aviation cybersecurity and airworthiness penetration testing, and applies the same discipline to railroad ATCS cybersecurity, vessel cybersecurity assessments, traffic control systems cybersecurity and surveillance system security audits. Every preparation and deliverables guide sits in the GDF resource library.
What Makes a Security Finding Worth Acting On
An assessment measures coverage and weaknesses; a penetration test proves selected attack paths under written authorization. Either way the agreed scope names the targets, the starting access, the excluded providers, the permitted actions and the stop conditions, and the report is written so someone who was not in the room can check every finding.
Each finding names the affected asset, the access required, what we observed, the evidence, the consequence to the business and the recommended fix, so your engineers can verify it and close it.
Retesting records the corrected target and the result against the original evidence, so closure is documented rather than asserted.
Monitoring, incident response, regulatory submissions and implementation work are scoped as their own engagements, which keeps the assessment report clean and its conclusions easy to defend.
Ask to see a sample report and the proposed lead's relevant experience during your free consultation.
Tell us which systems matter most and we will sequence the testing around them.
When the Incident Becomes a Legal Matter
We preserve the logs and records before remediation changes them and coordinate device, email and cloud examination with response and testing. The findings separate observed access from possible access and name the gaps in the record, so your team, your leadership and your insurer understand the evidence behind the incident account.
Send the systems and the testing window, and a senior tester will propose the scope.
Explore Digital Forensics & LitigationWhat to Have Ready for the First Call
Have the environment, the objective, the operating constraints and the deadline in mind, and know who can authorize testing and who needs the report. We will arrange secure sharing before any credentials, source code or detailed architecture change hands.
For work across sites, our regional engagement information shows the sixteen US offices and the international line we work from.
If an incident is underway, call the hotline now. It is answered 24/7, and the first conversation with a practitioner is free.
Prepare for the first call
Preparation Packs for Assessments and Audits
Each pack helps your team identify the systems, policies, evidence and owners a specific assessment or regulatory review will ask about, and write down the questions the specialist will need answered. Teams that arrive with that work done spend the scoping call on decisions instead of discovery.
Every guide is free to read online. A download asks for a work email and company, which you may skip, and the file starts immediately.
Scope your assessment
Plan an OT assessment with the sector packs and workbook
Use the four sector packs, the project workbook and the shared source records to organize a proposed OT assessment before engineering, operations and security sit down together.
File: ZIP: PDFs, XLSX workbook and CSV records.
NYDFS 23 NYCRR Part 500 Audit Preparation
Gather entity details, policy records, system evidence and the questions a Part 500 specialist will need answered before the review begins.
File: ZIP with a guide and editable CSV checklists.
New York SHIELD Act Private Information Preparation
Map the private information you hold, the safeguards around it, the service providers who touch it and the incident records a privacy or breach review will examine.
File: ZIP: guide and editable CSV checklists.
CMMC and NIST SP 800-171 preparation
Organize contracts, information boundaries, system records and evidence requests for a defense cybersecurity specialist to work from.
File: ZIP: guide and editable CSV checklists.
EAR and ITAR preparation
Gather the product, technical data, access and transaction facts an export control specialist needs to evaluate your exposure.
File: ZIP: guide and editable CSV checklists.
Security Assessment and Penetration Testing Preparation
Record the proposed scope, system owners, safety boundaries and permissions before any audit, security assessment or physical or cyber testing begins.
File: Editable CSV preparation checklist.
Talk with a security lead
Put Your Attack Surface in Front of a Senior Operator
Tell us the systems, the objective and the deadline. A senior security lead will call or write back promptly to walk through the recommended testing depth, the timeline and who would lead the work, and the first conversation is free.
Global Digital Forensics has operated since 1992 with 24/7 incident response, court tested experts and sixteen US offices.
Reviewed by Joseph Caruso, Founder, CEO and CTO, CISSP. Last reviewed .