Jacksonville processes card payments, pays health claims and ships cars. All three run on service accounts.
Jacksonville's big employers write software for banks, adjudicate health claims and move containers and vehicles off the St. Johns River. Much of that work happens machine to machine. Batch jobs, payment switches, terminal systems and claim engines all log in as something, and often nobody knows who owns that login.
- Secrets & Certificate LifecycleCybersecurity
- Machine & Workload IdentityCybersecurity
- Customer Identity (CIAM)Cybersecurity
- Healthcare Payer Platforms (Facets)Enterprise Platforms
- API IntegrationApplication Services
- OT & ICS SecurityCybersecurity
- Identity Threat Detection & ResponseCybersecurity
We help Jacksonville financial technology firms, health insurers and logistics operators get control of human and machine identities.
That covers secrets and certificate management for payment platforms, member identity and FHIR API authorization for health plans, and MFA and least privilege for port and rail systems under Coast Guard rules. Cohash is headquartered in Frisco, Texas, serves Jacksonville remotely and travels in for workshops and launches.
Cohash has no Jacksonville office. The team works from Frisco, Texas, runs Northeast Florida projects remotely and travels in for discovery workshops, terminal walk-throughs and go-live.
- rules
- Florida breach notification, Fla. Stat. §501.171CMS Interoperability and Prior Authorization Final RuleCoast Guard maritime cybersecurity, 33 CFR Part 101 Subpart FFTC Safeguards Rule, 16 CFR Part 314
What's specific about Jacksonville
Each figure comes from a public source, linked on the card.
JAXPORT reports 1,388,841 TEUs, 506,237 vehicles and 10,230,114 total tons of cargo for fiscal year 2025.
source ↗ 02Of the Jacksonville metro's 802.8 thousand nonfarm jobs in September 2026 (preliminary), 68.1 thousand were in financial activities and 170.6 thousand in trade, transportation and utilities, BLS data show.
source ↗ 03FIS lists 347 Riverside Avenue in Jacksonville as its address and says it serves clients across 150 countries with technology for financial institutions, businesses and developers.
source ↗ 04JAXUSA Partnership, the region's economic development group, counts more than 165 corporate operations centers in Northeast Florida, along with two deep-water ports and three Class I railroads.
source ↗Who we work with in Jacksonville, and the rules they work under
-
Financial technology and payments
Core banking and card platforms run thousands of scheduled jobs, each with credentials to a database, a file transfer server or a partner network. We find those credentials in code, job schedulers and config files, give each an owner, and move them to a vault with rotation so a leaked key stops working within hours instead of staying live for years.
-
Health insurers and benefits administrators
Plans have to let members, providers and other payers call FHIR APIs while keeping claims data locked down. We design the authorization server setup, the consent records and member identity proofing, and we build the pipelines that pull clean data from the claims platform into the API layer.
-
Port, rail and distribution
Terminal operating systems, gate kiosks and railcar tracking often depend on vendor support accounts that never expire. The Coast Guard's cybersecurity rule expects separate credentials on critical systems and MFA on remotely reachable OT. We route vendor access through a recorded gateway and retire shared logins.
-
Corporate operations centers
Shared service centers for finance, HR and IT handle data for whole companies, so a single compromised analyst account can reach a lot. We tighten privileged roles, add identity threat detection for unusual access patterns, and run access certifications that match how the center is organized.
-
Florida breach notification, Fla. Stat. §501.171 ↗
A breach notice sent under the rules of a covered entity's primary federal regulator counts as compliance with the individual notice duty, as long as a copy reaches the Department of Legal Affairs on time. That matters for Jacksonville firms supervised by bank or insurance regulators.
-
CMS Interoperability and Prior Authorization Final Rule (CMS-0057-F) ↗
Covers Medicare Advantage organizations, Medicaid and CHIP plans, and issuers of qualified health plans on the federal exchanges, which is the marketplace Florida uses. Most new API requirements, including Provider Access and Payer-to-Payer, apply from 1 January 2027.
-
Coast Guard maritime cybersecurity, 33 CFR Part 101 Subpart F ↗
In effect since 16 July 2025 for regulated facilities and US-flagged vessels. Section 101.650 requires account lockout, changed default passwords, MFA on password-protected IT and remotely accessible OT, and least privilege on admin accounts. The first Cybersecurity Assessment is due by 16 July 2027.
-
FTC Safeguards Rule, 16 CFR Part 314 ↗
Payment and lending firms that are not banks fall under the FTC's rule. It requires a Qualified Individual to run the security program, MFA for system access, and a report to the FTC within 30 days of a notification event involving 500 or more consumers.
Most requested in Jacksonville
The services clients in Jacksonville ask us for most.
01Our payment platform has service accounts nobody can explain. How long does an inventory take?
It depends on how many places credentials hide. A typical first pass covers code repositories, the job scheduler, CI pipelines and the main vault, and it usually turns up accounts tied to people who left years ago. We sort findings by blast radius so the riskiest ones get rotated first.
02We're a health plan selling on the federal exchange. Does CMS-0057-F apply to us?
Yes, if you're a qualified health plan issuer on a federally facilitated exchange, and Florida uses HealthCare.gov. Your Medicare Advantage and Medicaid lines are covered too. We'd start by checking how much of the earlier Patient Access API you can reuse.
03Does the Coast Guard cyber rule apply to a warehouse near the port?
The rule covers facilities and vessels already regulated under the Maritime Transportation Security Act, so a terminal usually is and an off-port warehouse usually isn't. Check your facility security plan status with your Coast Guard captain of the port before scoping work.
04Can you train our team to run the vault after you leave?
Yes. We hand over runbooks for onboarding new applications, rotating secrets and handling a leaked credential, and we pair with your engineers on the first few onboarding requests so the process belongs to them.
More cities in Florida
a0784385 - 01JAXPORT, cargo statisticsjaxport.com ↗
- 02BLS, Jacksonville economy at a glancebls.gov ↗
- 03FIS, about usfisglobal.com ↗
- 04JAXUSA Partnershipjaxusa.org ↗
- 05Fla. Stat. §501.171flsenate.gov ↗
- 06CMS, Interoperability and Prior Authorization Final Rulecms.gov ↗
- 07eCFR, 33 CFR Part 101 Subpart Fecfr.gov ↗
- 08eCFR, 16 CFR Part 314ecfr.gov ↗
Tell us what you're running. We'll tell you what we'd do first.
A 30-minute working session with a senior engineer. No slides.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it