The UK’s gold standard for regulated cyber resilience testing in finance.
CBEST penetration testing that simulates your most sophisticated adversaries to show how your people, processes and technology hold up under a real attack.
Our CBEST threat-led penetration testing helps you meet the regulator’s requirements and tests your resilience against threats facing the UK financial services industry.
SECFORCE is a CBEST-approved penetration testing provider with certified CCRTM (CREST Certified Red Team Manager) and CCRTS (CREST Certified Red Team Specialist) consultants. Our team has delivered multiple CBEST engagements to date for firms including UK high-street banks, major financial institutions, and other regulated entities.
We have also delivered cross-framework engagements combining CBEST with DORA/TIBER, offering multi-jurisdictional expertise that few providers can offer. Our CBEST engagements bring together a CBEST-approved penetration testing team, a dedicated R&D function, and proprietary in-house tooling.
Get best-in-class threat intelligence from our network of trusted, CBEST-approved partners or from any TI provider selected by you or your regulator.
Even though the Threat Intelligence phase runs before testing, our Red Team is actively involved throughout it. This keeps scenarios realistic, grounded in your actual threat landscape, and ensures a seamless handover into a risk-managed attack simulation.
We are ISO 27001 and SOC 2 accredited, reflecting independently audited controls around how we handle client data throughout an engagement. Separately, our consultants are experienced at working with internal teams and Control Groups (CG), providing detailed test plans, safe and realistic testing, and comprehensive reporting. The result is a fully bespoke, threat-led CBEST engagement.
We stay involved before, during and after the engagement, offering remediation guidance and retesting so that findings translate into meaningful improvements.
CBEST penetration testing is a multi-stage, intelligence-led assessment.
Designed in 2014 by the Bank of England (BoE) to help financial services firms and financial market infrastructures (FMIs) understand their defence capabilities, it is today directed by the BoE, the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA).
CBEST testing combines threat intelligence from a Threat Intelligence service provider (TISP) and attack simulations from a Penetration Testing service provider (PTSP).
Systemically important banks, insurers and financial market infrastructures supervised by the BoE or PRA typically undergo CBEST testing at the regulator’s request, though it can also be initiated voluntarily. Testing must be managed by a CCRTM (CREST Certified Red Team Manager).
| CBEST Requirement | SECFORCE |
|---|---|
| CREST-accredited |  |
| Approved under the CBEST scheme | |
| CCRTS (CREST Certified Red Team Specialist) Consultants | |
| CCRTM (CREST Certified Red Team Manager) Consultants | |
The assessment is launched, the scope is agreed, and the firm procures its Threat Intelligence and Penetration Testing service providers.
Intelligence is gathered on the firm’s threat landscape, and realistic attack scenarios are developed by the TISP.
The firm’s critical systems and functions, named important business services (IBS), are tested by a CBEST-certified PTSP, such as SECFORCE, through intelligence-led attack simulation.
Findings are turned into a remediation plan, which the regulator reviews and supervises through to completion. The closure phase typically takes five weeks.
CBEST is one of several regulated Threat-Led Penetration Testing (TLPT) frameworks we deliver.
If your requirements extend beyond the UK, we also run TIBER-EU, DORA TLPT, iCAST and CORIE engagements, and have delivered a combined portfolio of over 60 TIBER-EU, iCAST, CORIE and CBEST engagements.
This includes some of the first multi-jurisdictional, cross-framework engagements in the world, such as CBEST and TIBER.
Thank you!
Please try again later.
