Move value
Transfers, payments, refunds, benefits, limits, and approvals.
Penetration Testing for Financial Institutions (Banks and Fintechs)
We protect the systems that move the money
A financial institution penetration test simulates real attacks against banks, fintechs and credit unions to find exploitable flaws in applications, APIs, PIX, Open Finance, internet and mobile banking, network and cloud before criminals do. Berghem scopes it to BACEN 4.893/538, PCI DSS and DORA, with an executive report and retest included.
PENTEST
Penetration testing for financial institutions
Berghem's pentest for banks and fintechs follows OWASP (WSTG, ASVS and API Security Top 10), PTES and NIST SP 800-115, combining manual analysis with automation to chain flaws until business impact is demonstrated: moving value, reaching another customer's data or bypassing anti-fraud controls.
Typical scope covers web applications, REST and GraphQL APIs, PIX and Open Finance integrations, internet and mobile banking, internal network and perimeter, and cloud environments (AWS, Azure and GCP). Every surface is tested with synthetic identities and no irreversible operations.
Deliverables: an executive report with CVSS risk rating, a technical report with reproducible evidence and remediation guidance, and a retest of the fixes included. It is the same format as our penetration testing for financial institutions aligned with Central Bank requirements.
Sector Focus
Why financial services need specialized security
Banks and fintechs sit at the intersection of regulatory pressure, sophisticated adversaries, and 24/7 availability demands. A breach is measured in regulatory fines, customer churn, and systemic risk — not just downtime.
For regulated institutions and payment providers, see also our cybersecurity consultancy for the financial sector, with pentest, Red Team and alignment to BACEN resolutions.
80%
Sector Focus
Focused on Financial Services
Over 80% of Berghem's historical work has been dedicated to financial services, giving us unmatched depth in payment security, banking infrastructure, and fintech protection.
Specialized Services
What we do for the financial sector
Payments Analysis
Comprehensive analysis of payment processing systems including tokenization, encryption, and transaction flow security.
EMV Testing
Security assessment of EMV chip implementations, contactless payment systems, and card-present transaction security.
POS Security
Point-of-sale terminal security testing, firmware analysis, and physical security assessment of payment devices.
ATM Security
ATM hardware and software security testing, jackpotting prevention, skimmer detection, and network security assessment.
Anti-Fraud Systems
Assessment and testing of fraud detection systems, transaction monitoring rules, and behavioral analytics platforms.
Electronic Voting Audit
Security audit of electronic voting systems, ballot processing, result tabulation, and end-to-end verifiability.
Sector Reality
$10.5T
projected annual cybercrime cost by 2025
$5.9M
average cost of a financial services breach
238
median days to identify a financial breach
74%
of attacks target finance, healthcare, or critical infrastructure
Main Threats
Why financial services need specialized security
Payment fraud and card skimming
EMV bypass, ATM jackpotting, POS malware, magnetic stripe cloning.
Open Finance and API attacks
Token theft, scope abuse, BOLA/IDOR in PIX and Open Finance APIs.
Anti-fraud bypass
Behavioral analysis evasion, mule networks, synthetic identities.
Insider threats
Privileged access abuse, deliberate data exfiltration.
Ransomware and extortion
Double extortion targeting trading and treasury operations.
Third-party and vendor risk
Compromise via SWIFT integrations, KYC providers, CIs.
Compliance & Frameworks
Standard requires penetration testing or a security assessment
REGULATION
Mandatory pentest: BACEN 4.893/538, PCI DSS, DORA and EU AI Act
In Brazil, Resolução CMN 4.893/2021 (updated by CMN 5.274/2025) and Resolução BCB 538/2025 require an annual penetration test performed by independent professionals, with an action plan and evidence kept available to the BCB. See the BACEN Resolution 4893 compliance page for the detailed requirements.
Anyone storing, processing or transmitting card data must meet PCI DSS, which requires internal and external pentests at least annually and after significant changes. In Europe, DORA (Regulation EU 2022/2554) requires digital operational resilience testing, including TLPT (threat-led penetration testing) for designated entities, and the EU AI Act imposes risk-management obligations on high-risk AI systems such as credit scoring.
Berghem designs the scope so a single pentest and Red Team cycle produces evidence reusable across all four regimes, with an executive report and retest included — in Brazil and, through Berilo, in Europe.
MISSIONS
Risk is measured in business impact
In financial services, a single exposure can combine technology, business rules, process, identity, and regulatory pressure.
Access data
Another customer's information, regulated data, statements, and documents.
Bypass controls
Segregation of duties, anti-fraud, authentication, and reconciliation.
Disrupt operations
Critical processes, channels, treasury, settlement, and customer service.
AGENTIC EHT
Web → API → Web: one journey, multiple surfaces
The agent can observe the interface, form a hypothesis, test an in-scope API, and confirm the impact on the journey.
Sample missionBG · FIN
- Objective
- Validate improper access to financial information.
- Identities
- Customer A and Customer B.
- Routes
- Web→API→Web
- Boundaries
- Synthetic data and no irreversible operations.
Why it matters03 · POINTS
States and permissions change along the journey.
Sensitive flows can exist even without a traditional vulnerability.
Evidence must be understandable to both Security and Business.
CONTEXT
Controls and standards come in as context, not as an isolated checklist
PCI, Open Finance, Banco Central requirements, LGPD, and internal controls help define boundaries, evidence, and priorities.
Controls
Authentication, authorization, anti-fraud, segregation, monitoring, and response.
Processes
Approval, reconciliation, exceptions, customer service, and account recovery.
Evidence
Impact, reproduction, action trail, recommendation, and retest.
RED TEAM
Red Team for banks and fintechs
While a pentest measures the exposure of a system, a Red Team measures the detection and response capability of the whole institution. We simulate an adversary with a defined objective — fraud, access to regulated data or disruption of a channel — using techniques mapped to MITRE ATT&CK under rules of engagement agreed with the CISO.
The exercise combines phishing and social engineering, external intrusion, lateral movement, identity abuse and third-party integrations. Berghem's Red Team for financial institutions also covers AI models and agents used in credit, anti-fraud and customer service, where prompt injection and data leakage open new fraud paths.
The outcome is an attack timeline, the points where detection failed and a prioritized improvement plan for the defense team. See the full adversarial Red Team service.
EHT
EHT Silver, Gold and Diamond in the financial sector
EHT (Ethical Hacking Test) is Berghem's pentest format for the financial sector, offered in three tiers. Silver covers a bounded surface — one application, one API or one network segment — with OWASP Top 10 testing, an executive report and 1 retest within 30 days.
Gold extends to OWASP ASVS Level 2, STRIDE threat modeling and business-logic analysis — the most common tier for internet banking, PIX and Open Finance — with 2 retests within 90 days. Diamond covers OWASP ASVS Level 3, deep fraud and business-logic analysis, source-assisted testing, compliance mapping (PCI DSS, ISO 27001) and unlimited retests for 6 months.
Regulated institutions usually combine an annual Gold or Diamond EHT with targeted tests at each relevant release, so the evidence keeps pace with the real risk of the environment. To get started, hire a penetration testing company with a scope aligned to BACEN and PCI DSS.
Security for financial services
Specialized tracks for banks, fintechs and payment providers.
Related reading
Guides on breach cost, BACEN compliance and vulnerability management.
FAQ
Frequently asked questions about financial services security
What does a financial services penetration test cover?
We cover the surfaces where risk becomes impact: core banking, Open Finance apps and APIs, payments, POS, ATM, and anti-fraud. The goal is to chain flaws until we demonstrate improper movement of value, access to another customer's data, or a control bypass — always with synthetic data.
Which regulations and standards apply to financial security in Brazil?
We account for PCI-DSS and the other PCI standards (PIN, P2PE, MPoC), the BACEN/CMN resolutions on cybersecurity, including 4.893, the LGPD, and Open Finance Brasil requirements. They enter as context for scope, evidence, and priority — not as an isolated checklist.
How do you test PIX and Open Finance APIs?
We examine authentication, authorization, and consent across journeys, hunting for BOLA/IDOR, scope abuse, token theft and reuse, and broken segregation between institutions. We validate whether a participant can reach data or initiate transactions outside consent, using test identities and no irreversible operations.
What does Berghem deliver at the end of the project?
We deliver reproducible evidence with business impact, an action trail, a risk rating, prioritized recommendations, and retesting of the fixes. The report is understandable to both Security and Business teams and supports responses to regulatory audits and to your own customers.
Is penetration testing mandatory for banks and fintechs in Brazil?
Yes. Resolução CMN 4.893/2021, updated by CMN 5.274/2025, and Resolução BCB 538/2025 require financial and payment institutions authorized by the Central Bank to run an annual penetration test by independent professionals, with documented results, action plan and evidence. Institutions handling card data add the pentest required by PCI DSS.
What is the difference between a pentest and a Red Team for banks?
A pentest assesses the exposure of a system or set of systems within a defined scope and produces a prioritized list of vulnerabilities. A Red Team simulates an adversary with a business objective — fraud, exfiltration or disruption — without warning the defense team, and measures whether the institution detects and responds. Mature banks use both: pentest to fix, Red Team to validate detection and response.
How much does a penetration test for a financial institution cost?
Price depends on the size and complexity of the scope (number of applications, APIs, endpoints and network segments), depth (EHT Silver, Gold or Diamond), test type (black, grey or white box), the need to test in production and specific regulatory requirements. After a scoping meeting, Berghem sends a fixed-price proposal with timeline, deliverables and retest included.
How often should a financial institution run a pentest?
At least once a year, which is the BACEN and PCI DSS requirement, and after significant changes to infrastructure or applications. Institutions with frequent releases adopt a full annual pentest combined with targeted tests at each relevant change in PIX, Open Finance, internet and mobile banking.
Can a pentest disrupt the bank's operations?
Not when properly planned. We define test windows, load limits, synthetic identities and a no-irreversible-operations rule, with a direct channel to the operations team. Production testing only happens with explicit approval and a rollback plan; the rest runs in staging with representative data.
Get Started
Ready to secure what moves the money?
Talk to a senior consultant about a pentest, a PCI engagement, or an Open Finance threat model tailored to your institution.