Illustration: a scan film, in point clouds, of the places a bank, insurer, fund or fintech runs on: the head office, an operations desk where a core system’s admin login fills in, a data centre, a trading floor, a branch at night, a phone paying at a card terminal and the Cantic mark. The labels show synthetic readings and addresses.
We break into your bank or insurer before a criminal does.
From your website and app to the core systems behind them. With Fortify, we write the fix within 24 hours.
Real attack Santalucía, an insurer See the attacks
Financial services
Your customers log in from anywhere. So can a criminal.
Every line to the internet is a door.
Eclipse, our own model trained to attack, keeps going until it can prove full control.
In plain words: an attacker that works for your company.
How far Eclipse goes
- Website
- Apps
- Logins
- Cloud
- Servers
- Internal network
- Machines
What your business runs on
We know what a financial firm runs on. So do criminals.
Outside firms
- Your IT provider
- Core software provider
- Card and payment processors
- Fintech partners
- Outsourced call centre
Remote access
- VPN
- Remote desktop
- Remote support
- Partner APIs
- Provider portals
- Cloud consoles
-
Branch
- Teller systems
- Cash machines
-
App and web
- Website
- Online banking
- Mobile app
- Customer and broker portals
-
Payments
- Card processing
- Transfers
- Open banking APIs
-
Markets
- Order management
- Market data
- Broker portals
-
Data centre
- Core banking
- Policy administration
- Admin login
- Backups
-
Office
- Claims
- CRM
- Call centre
-
Spain
Santalucía, an insurer
Customers’ names, addresses, phone numbers and ID numbers were viewed without authorisation, it said.
Sources Escudo Digital APD
-
United States
Aflac, an insurer
Social engineering let an intruder in; files possibly affected may hold health data, it said.
Sources Aflac Incorporated, SEC Office of the Attorney General of Iowa (Aflac’s notice, sent by Hogan Lovells)
-
United States
Coinbase, a cryptocurrency exchange
A criminal paid support staff for customers’ data and demanded money not to publish it.
Sources Coinbase Global, SEC The Register
Compared
This is not a yearly pentest.
| A normal pentest | Cantic |
|---|---|
| Once a year | Day and night, and on every change |
| A PDF weeks later | Proof as it happens, with a replay |
| Stops at the website | From the website to the server and the machine |
| You work out the fix | We write the fix within 24 hours |
| You hope it holds | We attack again to check it holds |
Under your control
Inside the rules you sign.
Guardrails and data privacy for financial firms and their customers.
Nothing runs until you sign
An authorisation and rules of engagement, signed by someone entitled to authorise the test.
Inside the limits you set
Your scope, hours and limits. It stops once it can prove control.
Stop it within 60 seconds
Rate-limited and time-boxed, so your systems do not slow down.
Every action on the record
Hashed and timestamped in a ledger you can inspect, and followed live.
A person on every critical finding
A named lead on our team.
No outside AI company sees your data
Eclipse is our own model, on our own servers.
Destroyed when the work is done
Deleted in several steps on our side; we do not keep it. First test reports: 14 days unless you subscribe.
Your IT provider gets the fix
Findings and fixes go to your own team or your IT provider.
Regulation
The rules a financial firm answers to.
- DORA asks firms in scope, microenterprises aside, to test their critical systems at least once a year (Articles 24 and 25). 1
- Firms their supervisor identifies must also run threat-led penetration tests (TLPT) at least every three years (Article 26). 1
- The first notice of a major ICT incident is due within four hours of classifying it as major (Article 19). 2
Questions
What buyers ask us
- Does it help with DORA? Does it replace TLPT?
- It supports DORA’s testing requirements with a record of every step, but does not certify compliance or replace TLPT.
- What does our auditor get?
- The signed scope, each finding with proof and a replay, the fix that closes it and proof of the retest.
- How is our data handled, and will you ever name us?
- Findings are encrypted and handled under NDA, and no client is ever named.
How it starts
Your results in one day.
You sign the rules
An authorisation and rules of engagement, signed before anything runs.
Eclipse tests what is in scope
From the outside, the way an attacker would. There is nothing to install.
We put the findings on the table
In plain words, with what to do. Every finding comes with proof.
Sources
- EU Official Journal (publications.europa.eu), Regulation (EU) 2022/2554 on digital operational resilience for the financial sector, . Read on .
- CNMV, Preguntas frecuentes sobre el Reglamento 2022/2554 de resiliencia operativa digital (Reglamento DORA), . Read on .
- EU Official Journal (legislation.gov.uk), Directive (EU) 2015/2366 on payment services in the internal market, . Read on .