White Pine Labs
00 / Summary

Security testing and CMMC readiness for Michigan businesses.

We find what an attacker can reach from the internet, help you prepare for CMMC Level 2, and write it up so your IT lead and your owner can both act on it.

Start a conversation Fixed scope · Quoted after a short scoping call · Veteran-owned

01 / Who it's for

Usually, something lands on your desk first.

We work with manufacturers, defense suppliers, and medical device companies, most with a small IT team or a single outside provider. The call usually starts with one of these:

  • Flow-down A prime contractor sends DFARS 7012 language and asks for your SPRS score.
  • Questionnaire A customer's security questionnaire asks for evidence you don't have on file.
  • Insurance Your cyber insurance renewal asks about MFA, remote access, and backups, and the answers matter.
  • CMMC CMMC Level 2 is showing up in contracts and you need to know how far off you are.
  • Nobody's looked No one has checked your network from the outside in years.
02 / Services

Four fixed-scope services.

Each one has a written scope and a fixed price, quoted after a short scoping call. Other engagements by request.

  1. 01

    External Attack Surface Assessment

    We map what an attacker can see and reach from the internet, then hand you a prioritized list of what to fix first.

  2. 02

    CMMC Level 2 Readiness

    We assess you against NIST SP 800-171, show you where the gaps are, and build a realistic roadmap to close them before your certification assessment.

  3. 03

    Cloud Assumed-Breach Test

    We start from a realistic foothold in your cloud tenant, like a phished user account, and show you how far an attacker could get and how to stop them.

  4. 04

    Security Questionnaire Support

    When a customer or prime sends a security questionnaire, we help you answer it accurately, back it with evidence, and avoid promising things you don't do.

03 / How it works

Four steps, all in writing.

  1. 01

    Scoping call

    30 minutes. You tell us what prompted the call and what you have. We tell you what we would test and whether we are the right fit.

  2. 02

    Fixed-scope proposal

    A written scope, a fixed price, and the dates. Nothing starts until you sign it and give written authorization.

  3. 03

    Testing window

    We work only inside the agreed window and only against assets you listed. Your contact can reach us the whole time.

  4. 04

    Report and walkthrough

    A summary for leadership, a technical report for IT, and a call to go through the findings together.

Rules of engagement and data handling →

04 / Sample finding

What a finding looks like.

Every report is a list of findings like this one: what we saw, why it matters to your business, and what to do about it, in that order.

Example finding · not from a real clientSeverity High

WPL-EX-004

Remote Desktop exposed to the internet on a legacy file server

What we saw
TCP 3389 open on 203.0.113.24, answering with a Windows Server 2012 R2 login screen. Network Level Authentication was off, and the server's certificate name matched an internal hostname, FS01-QUALITY.
Why it matters
Exposed Remote Desktop is one of the most common ways ransomware crews get in. This server is out of vendor support, so new flaws will not be patched, and anyone on the internet can try passwords against it.
Fix
  1. Close 3389 at the firewall today. Put remote access behind the VPN you already have, with MFA.
  2. Check the server's security log for failed and successful remote logins over the last 90 days.
  3. Plan the move off Server 2012 R2. Until then, keep it off the internet entirely.
Evidence
$ nmap -Pn -p 3389 --script rdp-ntlm-info 203.0.113.24
3389/tcp open  ms-wbt-server
| rdp-ntlm-info:
|   NetBIOS_Computer_Name: FS01-QUALITY
|_  Product_Version: 6.3.9600
05 / Why us

What you can count on.

Local
We're based in Southwest Michigan, and we can come to you for the walkthrough.
Veteran-owned
Veteran-owned and operated.
Fixed scope, fixed price
You know what we'll do and what it costs before we start. No hourly meter.
Written for two readers
A summary your owner can read in five minutes, and a technical section your IT team can work from.
Careful with your data
Encrypted, access-limited, and deleted after the retention period we agree on.
Honest about limits
We help you prepare for CMMC. We don't certify, and we won't promise a result we don't control.
06 / Next step

Tell us what prompted the question.

A questionnaire, a flow-down, a renewal, or just a feeling. A short call is enough to tell whether we can help.

Start a conversation