Founded
2016
Team Size
40+ security professionals
Vision
To advance the standard of offensive security by delivering realistic, intelligence driven attack simulations that help organizations understand and reduce real world risk.
Mission
White Knight Labs partners with organizations to proactively identify vulnerabilities across applications, infrastructure, hardware, and human attack surfaces. Through adversary emulation, deep technical testing, and actionable reporting, we enable leadership teams to make informed risk decisions and strengthen overall security posture.
Company Success Story
Since 2016, White Knight Labs has grown into a nationally recognized offensive security firm serving technology companies, healthcare organizations, financial institutions, and regulated enterprises.
The company has helped clients uncover critical vulnerabilities in externally facing applications, internal networks, cloud environments, and embedded systems before those weaknesses could be exploited in production.
White Knight Labs is frequently engaged to support:
- Pre acquisition and pre funding security due diligence
- Regulatory and compliance validation
- Incident response validation through ransomware simulation
- Secure product development lifecycle testing
By delivering technically rigorous assessments combined with executive level reporting, the firm has built long term relationships with organizations that require precision, discretion, and measurable risk reduction.
Leadership Team
John Stigerwalt – Co Owner
John co leads White Knight Labs with a focus on offensive security strategy, client engagement, and operational oversight. He brings extensive experience in penetration testing, red team operations, and security program development.
Greg Hatcher – Co Owner
Greg oversees technical execution and innovation across service lines. His background includes advanced adversary simulation, hardware and embedded system security testing, and complex enterprise security assessments.
Main Services
White Knight Labs provides comprehensive offensive security services across digital and physical attack surfaces:
Web Application Penetration Testing
Manual and automated testing of custom web applications to identify vulnerabilities such as injection flaws, authentication weaknesses, access control issues, and business logic abuse. Includes detailed proof of concept exploitation and remediation guidance.
API Security Testing
Assessment of REST, SOAP, and GraphQL APIs for improper authentication, authorization bypass, input validation failures, data exposure, and rate limiting weaknesses. Focused on real world abuse scenarios.
Network Penetration Testing
Internal and external network testing to identify exploitable services, misconfigurations, privilege escalation paths, and lateral movement opportunities. Includes Active Directory exploitation and segmentation validation.
Red Team Operations
Full scope adversary emulation designed to test detection and response capabilities. Simulates advanced threat actors using stealth techniques to evaluate SOC effectiveness, incident response readiness, and executive decision making.
Ransomware Simulation
Controlled ransomware attack simulation to evaluate containment, backup integrity, detection capabilities, and crisis response workflows. Tests technical controls and executive level communication processes without impacting production systems.
Cloud Security Assessments
Security testing of AWS, Azure, and GCP environments, including IAM misconfigurations, privilege escalation, exposed services, container security, and storage misconfigurations.
Mobile Application Security Testing
Static and dynamic analysis of iOS and Android applications to identify insecure data storage, improper certificate validation, insecure API communication, and reverse engineering risks.
Embedded Hardware Testing
Security evaluation of firmware, hardware interfaces, JTAG/UART exposure, bootloader security, and physical attack vectors. Focused on identifying vulnerabilities in connected devices and IoT systems.
Medical Device Testing
Specialized testing for connected medical devices to identify risks impacting patient safety, regulatory compliance, and data protection. Includes wireless protocol analysis, firmware review, and network attack surface testing.
Social Engineering Assessments
Phishing simulations, pretexting, and physical intrusion testing to evaluate employee awareness and procedural weaknesses.
Insider Threat Assessments
Simulation of credential misuse and trusted user abuse scenarios to identify detection gaps and privilege control weaknesses.
Malicious Developer Simulation
Evaluation of software development lifecycle risks by simulating a rogue or compromised developer. Tests code review processes, CI CD pipeline integrity, and access controls within engineering environments.
Security Architecture Review
Technical review of system design, trust boundaries, and security controls to identify structural weaknesses before deployment.
Secure Code Review
Manual source code analysis to identify logic flaws, insecure patterns, cryptographic misuse, and data handling weaknesses.
Future Commitment
White Knight Labs remains committed to advancing offensive security methodologies, expanding research in embedded and medical device security, and refining adversary simulation capabilities.
The company will continue investing in talent, tooling, and research driven testing approaches to help clients anticipate emerging threats, validate defensive investments, and maintain operational resilience in an evolving threat landscape.