Penetration Testing for Banks and Credit Unions

The FFIEC handbooks treat penetration testing and vulnerability assessment as expected components of an information security program, and examiners ask for the results. The FTC Safeguards Rule makes annual penetration testing explicit for the non-bank financial institutions it covers, and NYDFS 23 NYCRR 500.5 makes it explicit for New York-regulated entities. In practice every institution we work with is asked for a recent independent test. Fintech partners you sponsor carry obligations of their own, covered in our guide to fintech penetration testing requirements.

Not by name, and there is no separate GLBA penetration testing mandate for banks. The Interagency Guidelines that implement GLBA call for regular tests of key controls, run or reviewed by someone independent of the people who maintain them, at a frequency set by your risk assessment. An independent penetration test is the most direct way to show that testing happened, and examiners ask for the results. The FTC’s rule for non-bank lenders goes further and names annual testing: see FTC Safeguards Rule penetration testing.

The testing standard is the same. Federally insured credit unions follow NCUA Part 748, Appendix A, which mirrors the bank guidelines: regular tests of key controls, independent testers or reviewers, and a frequency set by the risk assessment. NCUA is an FFIEC member agency, so the same handbook applies. For member-facing apps, mobile banking app penetration testing covers the iOS and Android apps and the API behind them.

Section 500.5 requires penetration testing from inside and outside your information systems’ boundaries at least once a year, by a qualified internal or external party. It also requires automated vulnerability scans, with manual review of systems the scans do not cover, at a frequency your risk assessment sets and promptly after material system changes. The results support the annual certification of compliance. Our NYDFS cybersecurity regulation guide covers the rest of Part 500.

Yes, with the vendor’s authorization, which most digital banking providers grant through a standard testing policy. We handle the request with you, test within the vendor’s rules using accounts you control, and report findings in a form you can hand to the vendor for remediation. Testing your own instance is the only way to know how your configuration and your members’ data actually hold up.

External network testing starts at $4,200, internal network testing at $6,000, web application testing at $5,200, and phishing campaigns at $3,600, each fixed in writing before work starts. The penetration tests include a free retest of remediated findings. A typical annual program for a community institution combines external, internal, and phishing testing and is quoted as one number. Our network penetration testing services page shows how the external and internal tests fit together.

Rules of engagement are agreed with your operations and IT teams before testing begins: windows, systems to handle with care, vendor connections that are off limits, and an emergency contact. We never use denial-of-service techniques, we coordinate any testing that touches payment systems, and internal testing is delivered remotely through a device we ship so no branch has to host a tester. That is also how we serve Charlotte banks and their vendors without a travel charge, while community banks on Long Island and Westchester banks and credit unions can meet us on site.

Annually at a minimum, which is what NYDFS 500.5, the FTC Safeguards Rule, and examiner expectations line up on, and again after a core conversion, a digital banking migration, a merger, or a significant change to remote access. Vulnerability assessments run more often, usually as a quarterly or monthly vulnerability management program, and phishing is best measured on a recurring schedule rather than once.

Yes. Phishing, voice, and text campaigns are scoped to the roles that approve payments and change account details, with pretexts that mirror real fraud attempts. The report shows who clicked, who submitted credentials, who reported, and how fast, and a red team assessment can extend the exercise to an objective such as originating a test wire. A Microsoft 365 security assessment from $4,200 reviews the tenant controls the same fraud depends on: MFA, conditional access, and mailbox forwarding rules. In person, physical penetration testing checks whether someone posing as a vendor or technician can get past a branch or back office, from $6,800 for one New York metro site.