Australia’s framework for intelligence-led financial sector resilience testing.
CORIE testing scaled to your tier, that puts your institution’s defences to a realistic test.
Our CORIE threat-led penetration testing helps you meet APRA’s requirements and tests your resilience against financial industry threats.
We have delivered CORIE engagements for major financial institutions, including a 2025 exercise that combined iCAST and CORIE for one of the largest banking and financial services groups in the world.
SECFORCE can deliver testing to all four tiers of CORIE covered entities, including purple, red teaming and gold teaming exercises.
SECFORCE is a CREST-accredited, CBEST-approved offensive security provider with certified CCRTM (CREST Certified Red Team Manager) and CCRTS (CREST Certified Red Team Specialist) consultants.
We work with Threat Intelligence (TI) partners familiar with the threats facing APAC institutions. However, regardless of where you get your TI from, we can work alongside TI providers throughout to ensure that scenarios are realistic and that the transition into testing (which comes after the TI phase) is smooth.
Our Red Team combines experienced offensive security researchers with a dedicated R&D function and proprietary in-house tooling to reflect the tactics, techniques and procedures (TTPs) of threat actors targeting APAC financial institutions today. Test plan, milestones and contingencies are agreed before testing starts, and we’re also ISO 27001 and SOC 2 certified.
Reports are built around what CORIE requires, pairing an executive narrative with technical depth. We also offer remediation guidance and retesting, and stay involved before, during and after the exercise.
CORIE (Cyber Operational Resilience Intelligence-led Exercises) is the Australian Prudential Regulation Authority’s (APRA) framework for intelligence-led cyber resilience testing of systemically important financial institutions in Australia, including major banks, insurers and superannuation entities.
Participation is directed by APRA and forms part of Australia’s broader approach to strengthening the operational resilience of the financial system under CPS 234 and related prudential standards.
| CORIE Requirement | SECFORCE |
|---|---|
| A Red Team of at least a Red Team Lead, a Red Team Specialist and an Exploit Development Specialist | 
|
| Recognised industry certifications (CCRTM, CCRTS, OSCP, OSCE, CRTO) |
|
| Demonstrated experience delivering intelligence-led red team exercises |
|
The exercise is scoped, the Control Group is set up, the institution completes its Cyber Risk Assessment and identifies its Critical Business Services, and providers are procured.
The TI provider produces TI and Targeting reports on the institution, which a Red Team, such as SECFORCE, turns into scenarios and a detailed test plan and executes the attack simulation.
The Blue Team is told the exercise took place, the Red Team delivers its report, key attacks are replayed, and the institution shares its remediation plan with the CFR and the relevant regulator.
Australia is not the only place with a mandatory red team framework. If your institution operates elsewhere too, you may need to undergo testing under TIBER-EU, CBEST, TBEST, DORA TLPT or iCAST as well.
We work across all of these frameworks. Our regulated testing background covers Australia, Hong Kong, Japan, the UK, the Netherlands, Belgium and Germany, giving us the experience that cross-jurisdictional engagements require.
Thank you!
Please try again later.
