Wealth and investment managers are a particular kind of target. They hold high-value client assets and sensitive personal data, they move money on instruction, and they often run on lean IT teams with heavy reliance on platforms and outsourced providers. Attackers know this.
If your annual pen test is "scan the website", you're probably testing the least likely route in. These are the five attack paths we'd look at first.
1. Client and adviser portals
Portals are where client data and instructions live. The highest-impact issues are rarely exotic. They're authorisation failures: one client seeing another's valuations or documents by changing an ID, an adviser account reaching clients outside their book, or a document download that skips the access check. Automated scanners are poor at finding these. A tester working with multiple test accounts, one per role, finds them reliably.
2. Microsoft 365 and email
Payment instruction fraud and business email compromise remain among the most damaging attacks on wealth firms. The route is usually a phished mailbox, then mail rules that hide replies, then a convincing change of bank details. Testing should cover:
- conditional access and MFA coverage, including legacy authentication;
- which users can create forwarding rules or register apps;
- email authentication (SPF, DKIM, DMARC) and spoofing resistance;
- how far a compromised user could reach in SharePoint and Teams.
3. Payment and instruction workflows
Every process where a client or adviser can change a bank account, request a withdrawal or authorise a transfer should be tested as business logic. Can a step be skipped? Can an instruction be replayed? Is a call-back check enforced by the system or just by policy? These are the findings that link most directly to client harm.
4. Platform and third-party integrations
Most firms connect to investment platforms, custodians, CRM systems, open banking providers and document services. API keys stored in the wrong place, overly broad integration accounts, and unauthenticated webhook endpoints are common. Test the integrations you own, and check what each supplier connection could do if it were compromised.
5. The internal network and Active Directory
Assume one laptop is compromised. How long until an attacker is a domain administrator, and what can they reach from there: back-office systems, file shares full of client documents, backups? An internal or assumed-breach test answers the question every board actually cares about: if someone gets in, how bad is it?
Making the results useful
For an FCA-regulated firm, each finding should map to an important business service and a client-harm scenario. "Critical: IDOR on /api/documents" means little to a board. "Any logged-in client can download any other client's statements" gets fixed the same week.
The bottom line
Scope your test around how money and client data actually move through the firm. That's where attackers focus, and where your regulator will expect your testing to give you assurance.
FAQs
What should a wealth management pen test include?
Client and adviser portals with multi-role authorisation testing, Microsoft 365 and email security, payment and instruction workflows, third-party integrations, and an internal or assumed-breach test.
Talk to SMARTSEC
Want a test scoped around your client journeys?
Fixed-price testing, scoped and delivered by a senior tester, with live findings on the SMARTSEC client platform.
See financial services testing →