CBEST Penetration Testing Providers

CBEST is the UK's intelligence-led penetration testing framework specifically designed for the financial services sector, developed by the Bank of England in collaboration with CREST and the UK government's National Cyber Security Centre (NCSC). Introduced in 2014, CBEST was one of the first threat intelligence-based red teaming frameworks globally and served as a model for subsequent frameworks including TIBER-EU. CBEST assessments simulate realistic cyber attacks against UK financial institutions by combining targeted threat intelligence with controlled red team operations against live production environments.

The framework requires that both the threat intelligence provider and the red team provider hold specific CBEST accreditation, which involves demonstrating advanced capabilities beyond standard CREST accreditation. CBEST tests are commissioned by financial regulators and conducted under the supervision of the Bank of England's supervisory teams. The threat intelligence phase identifies the most likely and capable threat actors targeting the specific institution, their tactics and techniques, and the institution's most critical functions and assets. The red team phase then designs and executes realistic attack scenarios based on this intelligence, testing the institution's ability to detect, respond to, and recover from sophisticated cyber attacks.

CBEST results are shared with regulators and inform supervisory assessments of the institution's cyber resilience. Only a small number of companies hold CBEST accreditation, making it one of the most exclusive and demanding security testing credentials. CBEST assessments are considered the gold standard for financial sector security testing in the UK.