Intelligence-led testing for Hong Kong.
Threat intelligence for the Hong Kong Monetary Authority’s Intelligence-led Cyber Attack Simulation Testing (iCAST). We have delivered intelligence for iCAST engagements — scaled to each institution’s inherent risk and built to give the testing team realistic, regionally relevant scenarios.
Hong Kong’s intelligence-led attack simulation testing.
iCAST is part of the HKMA’s Cyber Resilience Assessment Framework (C-RAF), a pillar of the Cybersecurity Fortification Initiative for authorised institutions in Hong Kong.
C-RAF assesses an institution’s inherent cyber risk, then its cyber resilience maturity. Institutions with higher inherent risk are expected to go further, with iCAST: simulated attacks against their systems based on threat intelligence, to test whether defences hold up against realistic adversaries.
Like TIBER-EU and DORA TLPT, iCAST is intelligence-led: the quality of the test depends on the quality of the intelligence behind it.
The right depth of intelligence for your risk level.
The intelligence required for iCAST scales with an institution’s inherent risk rating under C-RAF.
Sector threat intelligence
Intelligence on the threats facing Hong Kong’s financial sector and institutions like yours, used to shape realistic test scenarios.
- Sector and regional threat landscape
- Relevant threat actors and techniques
- Scenarios for the testing team
Institution-specific intelligence
A targeted assessment of your institution: its footprint, the actors most likely to target it, and bespoke scenarios against your critical services.
- Digital footprint and targeting assessment
- Institution-specific actor profiles
- Bespoke, ATT&CK-mapped scenarios
From intelligence to simulation.
Scope
Agree objectives, critical services and the intelligence depth required.
Collect & assess
Regional and sector intelligence, plus your footprint where required.
Profile actors
Threat actors relevant to Hong Kong and Asia-Pacific financial services.
Build scenarios
Realistic, executable scenarios for the testing team.
Support & review
Support during testing and input to remediation and maturity improvement.
Flexible ways to engage.
Direct with your institution
We act as your threat intelligence provider and work alongside your chosen testing team.
Alongside a testing partner
We partner with your red team or attack simulation provider to deliver the intelligence component.
Ongoing intelligence
Between iCAST cycles, managed threat intelligence keeps your threat picture current for the next assessment.
Intelligence you can defend in front of a regulator.
Every judgement we make is graded, sourced and stated with an explicit level of confidence — so your control team, red team and board know exactly how much weight to put on it.
Admiralty-style reliability and credibility
Sources are graded for reliability and each piece of information for credibility, so a single unverified forum post is never presented with the same weight as corroborated reporting.
Calibrated probabilistic language
Assessments use a consistent probability scale (in line with UK intelligence practice), so “likely” always means the same thing.
MITRE ATT&CK mapping
Threat actor behaviour and scenarios are mapped to ATT&CK tactics and techniques, giving red teams, SOCs and auditors a shared reference.
Structured analysis and TLP
Structured analytic techniques challenge our own assumptions, intelligence gaps are stated openly, and reporting is marked and shared using the Traffic Light Protocol.
Who needs to perform iCAST?
Authorised institutions in Hong Kong whose inherent risk rating under C-RAF calls for intelligence-led testing. The depth of intelligence expected increases with the inherent risk level.
What is the difference between sector and institution-specific intelligence?
Sector intelligence describes the threats facing Hong Kong’s financial sector and institutions like yours. Institution-specific intelligence goes further, assessing your own footprint and the actors most likely to target you, and building bespoke scenarios.
How does iCAST compare with TIBER-EU and DORA TLPT?
All three are intelligence-led: realistic threat intelligence defines the scenarios that testers then simulate. The frameworks differ in governance and detail, but the intelligence discipline is the same — and so is our approach.
Can you work with our existing testing provider?
Yes. We can deliver the intelligence component alongside your chosen red team or attack simulation provider.
Can you deliver for a Hong Kong institution from the UK?
Yes. Intelligence work is delivered securely and remotely, with briefings and workshops scheduled to suit your team.
More on intelligence-led testing.
TIBER-EU threat intelligence
Targeted threat intelligence for TIBER-EU and national TIBER tests.
Learn moreDORA TLPT threat intelligence
Threat intelligence for DORA threat-led penetration testing.
Learn moreManaged threat intelligence
Analyst-led cyber threat intelligence built on your priority intelligence requirements.
Learn morePreparing for iCAST?
Talk to us about the intelligence your assessment needs — in confidence.