Penetration testing (Pen test)

In plain words

Think of hiring a professional burglar to try to break into your new office, with your written permission, before you move the safe in. They try the doors, the windows and the staff, then hand you a list of every way they got in and how to fix it.

A penetration test, or pen test, does the same for software. Qualified testers attack your app, your APIs, your cloud setup or your office network, using the methods real attackers use. They do not stop at listing weaknesses: they try to use them, combine them and show what an attacker could reach, such as another customer’s account or an admin panel. ¹

For a fintech, a recent pen test is close to a standard requirement. Bank partners, card programmes and enterprise customers ask for one in due diligence, and many security frameworks expect regular testing.

How it works

How a penetration test works

From agreeing the rules to proving the fixes worked.

1. 1

   Agree scope and rules

   Which systems, which environment, which dates, what testers may and may not do. Signed authorisation protects both sides.

2. 2

   Test

   Testers map the system, look for weaknesses and try to exploit them, often following public methods such as the OWASP testing guide. ³

3. 3

   Report

   Each finding is rated by risk, with evidence and a recommended fix, plus a summary written for management and partners.

4. 4

   Fix and retest

   Your team fixes the issues and the testers check again. The retest is what turns a list of problems into evidence of a secure product.

Types of penetration test

Tests are described in two ways: how much the testers know before they start, and what they are aimed at.

By target, the common types are:

• External infrastructure: everything reachable from the internet, such as servers, login pages and firewalls.
• Internal: what an attacker could do once inside your network or cloud account, for example with a stolen laptop.
• Web application and API: the logic of your product, such as account takeover, changing someone else’s payment or bypassing limits. For fintech this is usually the most important test.
• Mobile: the iOS and Android apps, how they store data on the phone and how they talk to your servers.
• Cloud configuration: permissions, storage and keys in your cloud provider account.

Pen test vs vulnerability scan

You need both. Scans catch the easy problems between tests. A pen test finds the things a scanner cannot understand, such as a payment API that trusts the amount sent by the app.

When partners and rules ask for one

• Before launch, when a sponsor bank, EMI or card programme reviews your product.
• Every year, as part of ongoing partner reviews, ISO 27001 or SOC 2 evidence.
• After significant change, such as a new app, a new API or a new hosting setup.
• When card data is involved, because PCI DSS requires regular penetration testing for firms in scope.

Pen testing in the UK, EU and Gulf

• United Kingdom. No law sets a single pen test standard for all fintechs. Partners commonly prefer testers who are CREST accredited or hold CREST qualifications, and the NCSC publishes guidance on buying and scoping tests. ^{1 2} Large, systemically important firms also face intelligence-led testing set by the Bank of England.
• European Union. DORA requires financial firms to run a testing programme for their ICT systems, and the most significant firms must also run threat-led penetration testing, usually every three years. ⁴
• Gulf. Saudi rules such as the SAMA Cyber Security Framework and the NCA Essential Cybersecurity Controls expect regular testing, and UAE partners and regulators commonly ask for it too. Check whether a local tester is preferred.

Example: a payments app before its partner review

Common misconceptions

FAQ