Best Penetration Testing Companies for Banks in 2026

By Ashkan Khamsehpour Published November 10, 2026 6 min read

Quick answer. CBEST needs Bank of England-accredited CREST members, and DORA TLPT insured testers with set experience: shortlist CBEST-listed firms such as Accenture, KPMG, Mandiant or NCC Group.

Yearly NYDFS tests ask for a qualified party: Bishop Fox or NetSPI. For custody and tokenization, Guardian.

Watch: Best Penetration Testing Companies for Banks in 2026 1:44

Video transcript

Banks do not just buy a pentest. They buy evidence a supervisor accepts, from a tester the rules allow.

Guardian publishes this guide and appears in it. Firms are grouped by need, not ranked.

Two kinds of test apply. Yearly pentests under NYDFS or PCI DSS have looser tester rules. Threat-led red teams like CBEST and DORA TLPT set strict ones.

CBEST needs accredited CREST members with named certifications. External DORA TLPT teams need a manager with at least five years' experience, five references and full insurance.

For CBEST and TLPT, shortlist CBEST-listed firms such as Accenture, KPMG, Mandiant or NCC Group. Bishop Fox and NetSPI suit yearly programs. Guardian covers digital-asset systems, not bank red teams.

Check the exact role. KPMG and Mandiant are listed for CBEST testing, not threat intelligence, so plan for a separately accredited intelligence provider.

Custody, tokenization and stablecoin services need testers who read signing flows and contract code. Guardian tests signing and key management, audits contracts, maps reports to DORA, NYDFS and MiCA, and retests fixes.

Ask each firm for its register entry for the exact service, named leads, insurance and background checks. Write a retest into the statement of work.

Read the full guide for sources and the checklist. If digital assets are in your scope, talk to Guardian at guardian.security.

Disclosure: Guardian publishes this guide and appears in it. Firms are grouped by need, not ranked. Every claim about other firms comes from their own pages or CREST’s public register, with sources at the end.

Banks, asset managers, broker-dealers, insurers and custodians do not just buy a pentest. They buy evidence a supervisor accepts, from a tester the rules allow.

Building for crypto instead? See the best pentest firms for crypto and web3. Payment and lending apps: the best penetration testing companies for fintech.

Where this article discusses regulation, it covers the technical and security side only. It is not legal advice; confirm how the rules apply to you with counsel.

What the Rules Ask of Testers

Two kinds of test apply: threat-led red teams with strict tester rules, and broader yearly pentests with looser ones.

Threat-led tests

Framework	Who runs it	Who may test
CBEST (UK)	Firms and FMIs the regulators request, or agree to on request	Accredited providers that are CREST members
DORA TLPT (EU)	Entities their TLPT authority identifies	Testers meeting Article 27 and RTS 2025/1190
TIBER-EU	Entities tested under a country’s TIBER-EU program	Providers meeting its procurement guidance
iCAST (Hong Kong)	Authorized institutions assessed at medium or high inherent risk	Staff with CREST or HKMA-listed certifications
AASE (Singapore)	Financial institutions following ABS guidelines	Providers with accreditations, background checks and insurance

CBEST also names individual certifications. Providers must employ CREST’s CCTIM for threat intelligence, and for testing CREST’s CCRTS plus a CCRTM or The Cyber Scheme’s CSRTM.

Under DORA Article 27, firms “shall only use” TLPT testers of “the highest suitability and reputability”, certified or bound by codes of conduct, and fully insured.

For external testers, the RTS requires a red team manager with at least 5 years’ experience, at least two more testers with 2 years each, and five references. TIBER-EU was updated in 2024 to match.

Designation, phases and deadlines are in DORA penetration testing and TLPT requirements.

Yearly pentests

Rule	Cadence	Tester
NYDFS 500.5	At least annually, inside and outside the boundaries	Qualified internal or external party
FFIEC IT Handbook	Set by the risk assessment	Management sets the independence needed
PCI DSS 11.4	Every 12 months and after significant change	Qualified and organizationally independent
DORA Article 24	At least yearly, on systems supporting critical or important functions	Independent parties, internal or external

Part 500 covers firms licensed, chartered or registered under New York’s Banking, Insurance or Financial Services Law. Scope it with NYDFS Part 500 penetration testing.

The FFIEC handbook is examiner guidance, not a rule.

For MiCA, MAS, VARA and the SFC, see the pentest requirements by regulation matrix.

The tester is a vendor too

The firm you hire is a third party. The Fed, FDIC and OCC’s 2023 guidance covers its staff background checks, insurance and confidentiality.

It adds that a vendor’s own pentest results can inform due diligence. A vendor’s SOC 2 report need not include a pentest: see does SOC 2 require penetration testing.

That guidance still applies, but in September 2026 the agencies and the NCUA proposed replacing it. The draft drops the background check and pentest wording; comments close November 16, 2026.

How We Chose the Firms

On November 10, 2026, we read each firm’s entry on CREST’s public marketplace and the firm pages cited below. We compared five things:

Register entries: CBEST, CREST pentesting, NCSC CHECK or PCI QSA.
Frameworks the firm says it runs or aligns to.
Financial-services work, in its own words.
Retest, if stated.
Digital assets: custody, blockchain or contract testing.

“Not stated” means the pages we read did not say so. Ask.

There is no score: firms are alphabetical within each group. We used no pricing, interviews or references.

Best Pentest Firms Compared

Firm	Register and frameworks	Financial-services evidence	Retest stated	Digital assets
Accenture	CBEST threat intelligence and testing; CHECK; TIBER-EU, iCAST, AASE	Financial services among its target sectors	Not stated	Not stated
KPMG	CBEST testing; CHECK; PCI QSA; TIBER-EU, iCAST, AASE	15+ years of attack simulations for financial clients	Not stated	Not stated
Mandiant (Google Cloud)	CBEST testing; TIBER-EU	Not stated beyond its CBEST listing	Not stated	Not stated
NCC Group	CBEST threat intelligence and testing; CHECK; TIBER-EU, iCAST, AASE	Banking, payments, insurance, asset management	Not stated	Crypto-custody assessments
Bishop Fox	CREST pentesting; aligns to FFIEC, GLBA, NYDFS, DORA, TIBER-EU	Banks, investment firms and insurers	Not stated	Not stated
NetSPI	CREST pentesting and threat-led testing; no CBEST listing	Nine of the top 10 US banks	Remediation testing listed	Enterprise blockchain deployments
Guardian	No CREST or TLPT claim; reports mapped to DORA, NYDFS, MiCA	Services for custodians and stablecoin issuers	Fixes reviewed and retested	Custody, signing, tokenization, contracts

Best CBEST and TLPT Providers

These are four of the CBEST providers on CREST’s register, not the full list. Each also lists alignment with TIBER-EU, the model for DORA TLPT.

Others on the register include PwC for CBEST threat intelligence and Deloitte for TIBER-EU-aligned testing.

Accenture

Its listing adds Australia’s CORIE and Saudi Arabia’s FEER, each for threat intelligence and testing.

Its listing says the February 2026 purchase of CyberCX extended its capabilities across Asia Pacific.

KPMG

Its listing adds testing approvals in France (ANSSI PASSI), Singapore (a CSA license) and India (CERT-In empanelment).

It is listed for CBEST testing, not threat intelligence, and is also a PCI QSA.

Mandiant (Google Cloud)

Mandiant is listed for CBEST testing only, so pair it with a separately accredited intelligence provider.

Its listing says its red team uses attacker techniques seen in real incident response work, with non-destructive methods.

NCC Group

Its attack simulation page also names CORIE and FEER. CREST lists it for both CBEST roles.

Under DORA’s TLPT rules, one firm can fill both roles if its intelligence and red team staff stay separate.

Best for Yearly Test Programs

Bishop Fox and NetSPI have no CBEST listing. We group them for yearly programs such as NYDFS 500.5 tests.

Bishop Fox

Its financial services page also lists PCI DSS, SOX IT controls and NIST CSF.

It describes targeted attacks on payment systems and segmentation tests across hybrid environments.

NetSPI

Its CREST listing adds 200+ financial institutions worldwide as clients.

Its test menu includes mainframe pentesting.

Best for Digital-Asset Systems

A bank’s custody, tokenization or stablecoin service needs testers who read signing flows and contract code.

Guardian

Guardian is the digital-asset specialist here, not a bank red team provider.

Tests: signing services, key management, cloud accounts and privileged access, plus web apps and APIs
Audits: two independent teams on one scope, manual review with invariant fuzzing and Helix, its AI auditor; only human-verified findings
Evidence: its DORA scope separates routine testing from any TLPT obligation
Team: offchain work led by Carlos Polop, who co-founded and built HackTricks
Its own controls: NIST CSF 2.0 and CCSS aligned; SOC 2 Type II underway

Map each test to its article with Guardian’s DORA, MiCA and NYDFS evidence workbook.

What to Ask Every Firm

Ask for	Why
The register entry for the exact service	CBEST needs CBEST accreditation, not a general pentest badge
Named leads, CVs and certificates	CBEST names the certifications; the TLPT rules require CVs
Professional indemnity insurance	DORA requires it for TLPT; the ABS guidelines ask for it
Background checks on testers	The 2023 interagency guidance and ABS both name them
Data handling and secure deletion	Testers hold your credentials; the TLPT rules require their deletion
Independence from the systems tested	DORA and PCI DSS require it; the FFIEC handbook weighs it
A retest in the statement of work	PCI DSS 11.4.4 repeats tests; DORA wants fixes validated
Reports in your supervisor’s format	CBEST deliverables follow its templates, unredacted for the regulator

Set stop conditions and production limits first, with a pentest rules of engagement template.

Frequently Asked Questions

How often is threat-led testing required?

Identified entities run DORA TLPT at least every 3 years, and their authority may raise or lower that. CBEST follows the PRA and FCA supervisory cycle. Singapore’s AASE guidelines recommend an exercise at least every 24 months.

Can our internal red team run a TLPT or CBEST?

Only within limits. Under DORA, credit institutions classified as significant under ECB supervision must use external testers only. Others need authority approval, an external threat intelligence provider and external testers every third test. CBEST uses accredited outside firms.

Must every tester hold a CREST accreditation?

No. CBEST requires CREST membership, but NYDFS asks only for a qualified party. Hong Kong’s iCAST accepts listed equivalents such as GPEN or OSCP. Singapore’s AASE guidelines say not to discount a provider just because it lacks a particular accreditation.

Sources

Test the digital-asset systems in your scope

Guardian pentests custody, signing and token systems, audits the contracts, and can map each report and retest to the rules in scope.

Talk to Guardian Explore institutional security