Breach Craft

Breach Craft is a cybersecurity consulting firm based in Havertown, PA, specializing in penetration testing, compliance assessments, and virtual CISO services for organizations across the United States.
We test networks, web applications, APIs, wireless environments, and internal infrastructure. Every report is structured for how security teams actually work: executive summaries for leadership, technical detail for engineers, and CIS Top 18 and NIST 800-53 mappings for auditors and compliance teams.
Our team holds OSCP, GPEN, CISSP, CISM, CEH, and Security+ certifications with 20+ years of experience across offensive security, security engineering, and security leadership. We follow PTES, OSSTMM, the OWASP Testing Guide, and NIST SP 800-115.
We support 18+ compliance frameworks: NIST CSF, NIST 800-53, NIST 800-171, PCI-DSS, HIPAA, SOC 2, ISO 27001, CMMC 2.0, NYDFS, CISA CPG, FedRAMP, FISMA, NERC CIP, and more. Our clients range from small businesses to critical infrastructure operators, including water utilities, healthcare providers, financial institutions, and government contractors.
Our assessments go beyond automated scans. Human creativity and critical thinking drive every engagement — we find business logic flaws, chained vulnerabilities, and attack paths that tools miss.
On the strategic side, we provide virtual CISO services, gap assessments against frameworks like NIST CSF and CIS Top 18, security program development, board-level reporting, vendor risk management, and tabletop exercises. Organizations that need executive security leadership without the cost of a full-time hire work with us on flexible monthly engagement models.
Most assessment types are available remotely. External and web application testing is fully remote. Internal testing is conducted through our custom remote access platform or client-provided access for engagements such as Assumed Breach and Cloud Security Assessments. We serve 18+ markets across the Northeast, Mid-Atlantic, and Midwest, with national reach for all remote-capable work.
Since our founding, we've supported the local cybersecurity community through sponsorships and participation in events like BSides Philadelphia. We also host our own community events to help strengthen the security ecosystem in the Delaware Valley.