Intelligence-led resilience testing for Hong Kong’s financial sector.
iCAST that meets the HKMA’s C-RAF requirements and shows how your bank responds to a real attack.
Our threat-led penetration testing (TLPT) helps you meet the HKMA’s requirements and tests your resilience against financial industry threats.
We have delivered iCAST engagements for major financial institutions in Hong Kong and worked with some of the region’s largest banks, exchanges, and financial groups since 2019.
We are CREST-accredited and CBEST-approved, our consultants are certified to CCRTM and CCRTS standards, and we have delivered more than 60 iCAST, CORIE, TIBER-EU, and CBEST engagements combined.
In 2025, we ran a combined iCAST and CORIE engagement for one of the largest universal banking groups in the world, coordinating across more than one regulator and more than one framework at the same time. Our regulated testing work spans Hong Kong, Australia, Japan, the UK, the Netherlands, Belgium and Germany.
Our reports are tailored to meet iCAST’s specific requirements, combining executive narrative with technical depth. Remediation guidance and retesting are also available, and we provide support before, during, and after the engagement.
We can introduce you to a Threat Intelligence (TI) partner familiar with the threats facing APAC institutions. Or, if you already have a TI partner in place, we are glad to work with them or whoever the HKMA has chosen. Regardless of who provides the TI, our testers (the iCAST team) stay involved throughout the engagement, from the TI phase through scenario development and attack simulation, ensuring a seamless flow into a realistic, risk-managed exercise.
Our testers combine experienced offensive security consultants with proprietary tooling and attack simulation capabilities to emulate the tactics, techniques and procedures (TTPs) of relevant threat actors. We deliver every engagement within agreed risk parameters, supported by detailed planning, continuous oversight, and strong governance.
iCAST (Intelligence-led Cyber Attack Simulation Testing) is the Hong Kong Monetary Authority’s (HKMA) framework for threat-led penetration testing of systemically important financial institutions (typically major banks and financial market infrastructures).
Aligned with international TLPT frameworks such as TIBER-EU and CBEST, iCAST requires institutions to undergo sophisticated, intelligence-driven red team exercises that simulate the tactics, techniques and procedures of advanced threat actors relevant to Hong Kong’s financial system.
| iCAST Requirement | SECFORCE |
|---|---|
| iCAST manager certified to CREST Certified Red Team Manager (CCRTM) standard, or an accepted equivalent | 
|
| iCAST specialist certified to CREST Certified Red Team Specialist (CCRTS) standard, or an accepted equivalent |
|
| iCAST Testers certified to CREST Certified Infrastructure Tester (CCT INF) or CREST Certified Web Application Tester (CCT APP) standard, or an accepted equivalent |
|
| Demonstrated experience delivering intelligence-led red team exercises |
|
| Able to meet iCAST’s governance and reporting requirements |
|
The institution maps its business functions and systems, and agrees a threat category and test goal for each with testers like SECFORCE.
The TI team researches the adversaries relevant to the institution and writes a tailored Threat Intelligence Report.
Threat intelligence becomes test scenarios, each with a goal, a method of initiation, milestones, a timeline for every task, chains of tasks with de-chaining provisions, and pre-agreed conditions for continuing or stopping the test.
The iCAST team (testers like SECFORCE) runs the scenarios against the systems in scope, checking in with the control group at least weekly before cleaning up and handing over a draft Simulation Test Report.
The engagement ends with a finalised Simulation Test Report, a Blue Team Report, and an Improvement Plan, agreed through a 360 Degree Replay Workshop and signed off by the institution’s management.
If you operate beyond Hong Kong, you might need to comply with more than one regulatory testing framework at the same time.
Alongside iCAST, we also test under TIBER-EU, CBEST, TBEST, DORA TLPT and CORIE.
Thank you!
Please try again later.
