Security testing for financial services.

A generic pen test produces a list of vulnerabilities. A regulated firm needs a clearer line from realistic attack paths to important business services, business impact and remediation ownership.

Why it matters

• Operational resilience. Firms in scope of FCA operational resilience rules must identify important business services, set impact tolerances and test against severe but plausible disruption.
• DORA. The EU Digital Operational Resilience Act has applied since 17 January 2025. Its testing programme includes penetration testing; threat-led penetration testing applies to selected entities.
• Third-party scrutiny. Banking partners, platforms and institutional clients may ask for independent testing evidence during due diligence.
• Real attackers. Fraud, ransomware and account compromise can threaten the services clients depend on.

Who we help

What we test

• Client-facing applications & APIs: authorisation, account takeover, transaction logic and cross-client data exposure.
• Infrastructure & Active Directory: external perimeter, internal attack paths and privilege escalation.
• Cloud & Microsoft 365: identity, conditional access, mailbox and tenant configuration.
• Assumed-breach scenarios: start with a compromised user or supplier and test the route towards an important business service.
• AI & LLM applications: prompt injection, RAG data leakage and agent or tool abuse.

Threat-led, service-focused testing

We shape scenarios around realistic threats to your firm: relevant actors, techniques and entry points. Where useful, we map scenarios to MITRE ATT&CK and tie them to important business services. The result addresses a practical question: could an attacker disrupt a service our clients rely on?

For firms in scope of intelligence-led testing frameworks, ThreatInsights offers targeted threat intelligence for the intelligence phase of TIBER-EU and DORA TLPT engagements.

What you receive

• Fixed-price statement of work agreed before testing starts.
• Senior, hands-on testing with clear ownership from scoping to report sign-off.
• Live findings published to the SMARTSEC client platform during the engagement.
• Board-ready executive summary connecting findings to services, impact and remediation ownership.
• Technical evidence with CVSS scoring, attack paths, remediation and retest criteria.
• Evidence pack for audit, risk committees, resilience reviews and client due diligence.
• Retest terms agreed in the statement of work.

Relevant experience

SMARTSEC is led by Andy Playford, with 20 years in offensive security, threat intelligence and security operations. His experience includes security intelligence at a UK credit reference agency, leading a penetration testing team at a national telecoms provider, and delivering threat intelligence for a TIBER-EU / DORA TLPT engagement at a European bank.

Frequently asked questions

Do FCA operational resilience rules require a penetration test?

They do not name a penetration test as a universal requirement for every firm. Firms in scope must identify important business services, set impact tolerances and carry out scenario testing. Independent security testing can provide evidence about the controls protecting those services. See the FCA Handbook, SYSC 15A.

Does DORA apply to UK firms?

DORA directly applies to EU financial entities. UK groups with EU-regulated entities may have obligations through those entities, while UK ICT suppliers to EU firms may face testing and assurance requests through their contracts. Scope and requirements depend on the entity and relationship. See the EU summary of DORA.

What is threat-led testing?

Testing shaped by intelligence about the actors and techniques most relevant to your firm. It focuses on realistic attack paths against important business services, rather than a generic checklist.

Do we need a full TIBER-EU or DORA TLPT engagement?

Only selected firms are in scope of formal threat-led testing frameworks. A proportionate, threat-informed test can still provide useful evidence for firms outside those frameworks.