Financial Services
Financial firms hold the data attackers want most and answer to more regulators than anyone. We test the products your customers use, prepare your cryptography for the quantum transition, and secure the AI you put in front of customers and decisions.
Book a ConsultationWhere money moves, logic is the attack surface
Online and mobile banking, payment flows, open-banking APIs, trading platforms and the cloud services behind them are where customers meet your systems — and where attackers look for the flaws a scanner never finds: moving money twice, reading another customer’s statements, approving their own transaction.
Regulators now name testing explicitly. DORA requires EU financial entities other than microenterprises to test every system supporting critical or important functions at least yearly, through independent testers; NYDFS requires annual penetration testing at all but the smallest covered entities; PCI DSS requires it wherever card data flows; and the FTC Safeguards Rule reaches many non-bank lenders and fintechs.
Financial data stays sensitive for years — account histories, contracts, identity records — so traffic recorded today is a harvest-now, decrypt-later target. And the financial system runs on public-key cryptography: payment messaging, customer authentication, PKI and code signing. The G7 Cyber Expert Group suggests addressing the most critical systems around 2030–2032 and completing migration by 2035, and supervisors are starting to move: Singapore’s MAS has proposed requiring an inventory of cryptographic assets, and in July 2026 the ECB told the banks it supervises directly that adopting post-quantum cryptography “must start now”, with a separate letter to follow.
Three services, tuned to finance
Artificial Intelligence Security (AI-BOM)
Customer-facing assistants, AI in fraud and credit decisions, and agents with access to accounts and payment tools. We test prompt injection, leakage between customers, and what an agent can be steered into doing with money — with evidence your model-risk and AI governance teams can use.
Learn more →Post-Quantum Cryptography Readiness (CBOM)
A cryptographic inventory across payments, customer authentication, PKI, hardware security modules and third-party links, ranked by how long the data must stay secret. Delivered as a CBOM, with a migration roadmap that fits your change windows and your regulators’ expectations.
Learn more →Product Penetration Testing
Online and mobile banking, payment and open-banking APIs, trading and customer portals, and the cloud and identity behind them — with business-logic and authorization testing at the centre. Findings come with reproduction steps, fixes, and the documentation your supervisors and auditors expect.
Learn more →Fintech & digital assets
Agents with wallet access
AI agents that can initiate transfers, sign transactions or call smart contracts. We test whether they can be steered into moving funds, and which limits and approvals actually hold.
Quantum risk to signatures
Most blockchains sign with ECDSA or EdDSA, which a quantum computer running Shor’s algorithm can break. Europol’s 2026 report on quantum computing and cryptocurrencies notes that once a public key is exposed it stays vulnerable — so custody design, address reuse and migration belong in your post-quantum roadmap now.
Exchanges, wallets and custody
Trading and wallet apps, exchange and custody APIs, withdrawal and approval flows, and the key-management systems behind them — hardware security modules, multi-party computation and signing services. A compromised signing key is unrecoverable, so we test how keys are generated, stored, approved and used.
Built for regulated money, not generic web testing
Business logic first
The flaws that cost financial firms money are rarely textbook injection bugs. We test how money and permissions move — limits, approvals, race conditions, and the boundaries between customers’ accounts.
Test accounts, not customers
We test with dedicated accounts and test funds in environments agreed up front. Anything that touches live payment flows is agreed step by step, with a stop channel open throughout.
Evidence your regulators read
Scope, methods, tester independence and results are documented so the report stands up in front of supervisors, internal audit and your board — not just your engineers.
Straight about TLPT
Threat-led penetration testing under DORA and TIBER-EU is a separate regulated exercise with its own provider requirements. Our product testing is not TLPT — but it finds and fixes what a red team would find first.
The rules that set your testing calendar
Financial firms answer to overlapping regimes — and most of them now name testing explicitly. Current as of October 2026.
| Market | Instrument | What it means for you |
|---|---|---|
| European Union | DORA Art 24–25 — Reg (EU) 2022/2554 | Applies since 17 January 2025. Financial entities other than microenterprises must test all ICT systems and applications supporting critical or important functions at least yearly — penetration testing among the listed types — and the tests must be run by independent parties, internal or external. |
| European Union | DORA Art 26–27 — threat-led penetration testing RTS: Delegated Reg (EU) 2025/1190 | Designated entities run threat-led tests on live production at least every three years, with external testers at least every third test and strict requirements on testers, from accreditation or codes of conduct to indemnity insurance. TIBER-EU was updated in 2025 to match. A separate exercise from product testing. |
| US — New York | NYDFS 23 NYCRR Part 500 | Annual penetration testing by a qualified internal or external party, from inside and outside your system boundaries, unless you qualify for the limited exemption for small covered entities. All amended requirements, including multi-factor authentication and asset inventory, have applied since 1 November 2025. |
| United States | FTC Safeguards Rule — 16 CFR Part 314 | Since June 2023, financial institutions under the FTC’s jurisdiction must run annual penetration tests and vulnerability assessments every six months unless they monitor continuously; those holding data on fewer than 5,000 consumers are exempt from this. Since May 2024 they must also notify the FTC within 30 days of discovering a breach affecting 500 or more consumers. |
| United States | SEC Regulation S-P, as amended | Broker-dealers, investment advisers and other covered firms need an incident response programme and must notify affected customers within 30 days. Every covered firm has had to comply since June 2026. |
| United States | SR 26-2 — model risk management | Replaced SR 11-7 on 17 April 2026 as the Federal Reserve, OCC and FDIC’s joint guidance on model risk — guidance, not enforceable standards, and most relevant to banks with over $30 billion in assets. It covers traditional and non-generative AI models; generative and agentic AI are expressly outside its scope. There is no binding federal AI rule for banks. |
| Payments | PCI DSS v4.0.1 | An industry standard, enforced mainly through card-scheme and acquirer contracts; v4.0.1 is the current version. Internal and external penetration testing at least yearly and after significant change, and segmentation testing every six months for service providers that rely on segmentation. |
| United Kingdom | CBEST Operational resilience Critical third parties | CBEST is the Bank of England’s intelligence-led testing framework, its guide updated in August 2026. Since 31 March 2025, in-scope firms must be able to stay within impact tolerances for important business services, and AWS, Google Cloud, Microsoft and Oracle were designated critical third parties in July 2026. |
| European Union | MiCA — Reg (EU) 2023/1114 | Fully applicable since 30 December 2024; the transitional period for existing crypto-asset service providers ended on 1 July 2026 at the latest. Authorised providers and issuers of asset-referenced tokens are also within DORA. |
| United States | GENIUS Act (July 2025) — payment stablecoins | Takes effect on 18 January 2027: no implementing rule was finalised early enough to bring that date forward. The OCC’s proposed rules would require issuers to run an IT and security programme that checks key systems — smart contracts included — work as intended, with periodic independent testing, incident response and private-key management. Not yet final. |
| United Kingdom | Cryptoasset regime — SI 2026/102 | FCA final rules were published in June 2026, applications for authorisation opened on 30 September 2026, and the regime goes live on 25 October 2027. |
| European Union | AI Act — Reg (EU) 2024/1689, Annex III | AI used to score the creditworthiness of individuals, or to assess risk and set prices in life and health insurance, is high-risk; fraud detection is excluded. The Digital Omnibus on AI, Reg (EU) 2026/1744, moved the date: these obligations now apply from 2 December 2027. |
| Singapore, Hong Kong | MAS, HKMA | MAS consulted in 2026 on technology-risk rules that include an inventory of cryptographic assets, and issued AI risk-management guidelines on 7 October 2026, which take effect from 7 October 2027. The HKMA launched a quantum preparedness index in July 2026 and is building a new cyber resilience testing framework. |
| Post-quantum | G7 Cyber Expert Group roadmap (January 2026) Europol Quantum Safe Financial Forum | Not regulation, but the sector’s reference timeline: the most critical systems around 2030–2032, and full migration by 2035. Our PQC page covers the wider government timelines. |
What you get
- Findings report — business-logic, authorization and technical findings with reproduction steps and concrete fixes, ranked by what an attacker could actually do with money and data
- Evidence pack — scope, methods, tester independence, results and retest outcomes, ready for supervisors, auditors and your board
- Cryptographic bill of materials — payments, authentication and PKI cryptography in CycloneDX format, with a post-quantum roadmap
- AI bill of materials and test results — the models, data and tools behind your AI features, delivered as a CycloneDX ML-BOM, with findings for your model-risk and AI governance teams
- Retest of fixes — evidence that remediation landed, for your issue tracker and your regulator
Find the flaw that moves money before someone else does.
A financial services engagement starts with your products, your regulators, and the testing calendar you already answer to.
Get in Touch