What CREST’s New Cyber Resilience Framework Means for Financial Services Penetration Testing

In October 2026, CREST released a new framework to guide security teams in the financial sector towards stronger cyber resilience, especially as more financial markets and institutions adopt AI and become more closely interconnected.

For security teams responsible for banks, insurers, payment firms, financial markets, or FinTech firms, CREST’s report calls both security teams and the cybersecurity firms that support them to work together as they focus on their security maturity. Specifically, the maturity pathways CREST lays out expects rigorous and continuous security testing covering every critical business service, to be repeated until remediation is proven, and to be delivered by providers whose quality can be independently verified.

How Financial Services Security Teams Can Assess Their Cyber Maturity

Most security leaders in financial services already accept that their institution does not operate alone. An outage at a shared payments processor or a cloud/software supplier breach could disrupt a financial services provider with compliant or mature security controls.

Based on these supply chain risks, CREST proposes maturity pathways for financial institutions, financial supervisors, and cyber service providers, which all are responsible for the financial market’s resilience. While this framework is targeted at managers of cybersecurity programs themselves, its requirements directly impact the people who commission, run, and report on security testing inside financial institutions, and those consequences are the focus here.

CREST asks institutions to determine their risk tier, assess controls against a framework such as the CRI Profile or NIST CSF 2.0, and place each critical service on a five-stage maturity pathway.

The assessment model is organized in three parts, and moves from inherent risk and tiering, to a control framework, to an assessment of how mature and effective those controls are in practice. Tiering determines how much is expected of an institution.

Testing expectations rise from targeted penetration tests of selected systems at Stage 2 to testing every key service, with retests that confirm fixes held, at Stage 3, and then to regular threat-led penetration testing (TLPT) at Stage 4. Moving from Stage 2 to Stage 3 depends less on new tools than on broader coverage and proof of remediation.

The Role Certified In-House Pentesters and Continuous Validation Plays in Cyber Maturity

CREST warns that institutions buying from weaker providers can gain false confidence, and that supervisors can draw the wrong conclusions from “clean” reports produced by basic tests. Its answer is independent accreditation matched to the specific service being bought, backed by evidence of practitioner competence and financial-sector experience. The paper also places TLPT after broad baseline testing rather than in place of it, since a threat-led exercise only pays off once controls and detection are mature enough to learn from it.

How BreachLock Supports Financial Services Teams

BreachLock is a globally CREST-accredited penetration testing company whose penetration tests are delivered by 100% in-house, CREST-certified pentesters.

BreachLock’s Penetration Testing as a Service (PTaaS) covers web applications, APIs, networks, cloud, and mobile, with tests scheduled on demand in as little as 48 hours, so teams can extend coverage to every key service. Every finding is human-validated and reported with proof of concept, and included retests provide the remediation evidence supervisors expect. BreachLock is equipped to help at every stage of CREST’s framework:

• Stage 1 (Ad hoc / informal): Attack Surface Management discovery scans build an inventory of exposed assets. Data breach scans surface leaked credentials.
• Stage 2 (Foundational / initial): Pentests for priority web apps, APIs, internal and external networks, mobile apps and cloud accounts. Teams can track findings as patched or unpatched in the BreachLock Unified Platform’s PTaaS dashboard.
• Stage 3 (Established / evolving): Pentests extend to every key service, including IoT devices and AI models. A rescan confirms each fix across all affected assets, and consolidated reports combine results from several pentests.
• Stage 4 (Reliable / advancing): Breach360 runs internal and external engagements that emulate chosen threat actor profiles known to target similar financial services institutions. It maps how an attack could progress, proves exploitability, and ties findings to the MITRE ATT&CK framework.
• Stage 5 (Advanced / innovating): Scheduled ASM scans track exposure over time, Breach360 automatically pentests target assets on a regular cadence between manual tests, and Jira, ServiceNow, Azure DevOps and GitHub integrations send findings into remediation workflows.

Between manual engagements, Breach360 delivers continuous autonomous validation with optional pentester review. For regulated threat-led exercises, BreachLock works alongside specialist TLPT providers, preparing institutions beforehand and validating remediation afterward.

Final Takeaways and Action Steps

CREST’s message is that resilience depends on testing evidence that holds up when boards and supervisors rely on it. Start by mapping critical business services against current test coverage, confirm each provider’s accreditation covers the service you are buying, and treat retest results as a deliverable in their own right. Read the full CREST whitepaper, or request a BreachLock demo to see how CREST-accredited PTaaS supports each stage of the pathway.

References

CREST, “Cyber Resilience in Financial Services: A whole ecosystem approach” (2026): https://www.crest-approved.org/wp-content/uploads/2026/10/CREST-Cyber-Security-Financial-Services-Ecosystem-Whitepaper.pdf

Frequently Asked Questions

What is CREST’s whole-ecosystem approach to cyber resilience in financial services?

It is a maturity model, published by CREST in October 2026, that treats financial-sector resilience as a shared capability of financial institutions, financial supervisors, and cyber service providers, with an illustrative five-stage pathway for each group and guidance on aligning their development over a multi-year program.

Is the CREST whitepaper a new compliance standard?

No. CREST describes its pathways as illustrative rather than a new compliance standard, intended to provide a common structure into which existing frameworks such as NIST CSF 2.0, the CRI Profile, DORA, CBEST, and TIBER-EU can be mapped.

When should a financial institution begin threat-led penetration testing?

CREST’s model places selected TLPT at Stage 3 and regular TLPT at Stage 4, after an institution has broad technical testing across its key services, mature detection and response, and a track record of validated remediation.

How should financial institutions evaluate a penetration testing provider?

The whitepaper recommends assessing providers across four dimensions (organization, services, people, and sector experience) and relying on independent accreditation that matches the specific service being purchased.

Author

BreachLock Labs