A dim, teal-lit office corridor with a lone figure at a reception desk and a distant exit sign, evoking the physical intrusion staff walked past without noticing.

The one where compliance wasn’t enough.

A long-established financial institution trusted its CBEST testing cycle to prove its defences held. The Swarm found what the audit missed: digital footholds, chained privilege escalation, and a physical intrusion into the client's own office. Ten months later, the client doubled its coverage and stopped measuring security by a certificate.

  • Read Time2 mins

A long-established global financial institution trusted its CBEST testing cycle to prove its defences held. On paper, it did. Real attackers don’t check the audit calendar.

No fixed scope. No warning. Just a live, persistent adversary.

A dim, teal-lit office corridor with a lone figure at a reception desk and a distant exit sign, evoking the physical intrusion staff walked past without noticing.

The target

The client is well resourced and highly regulated, required to undergo CBEST testing every two to three years. Leadership wanted more than a compliance pass. They wanted proof their defences could survive a live, persistent adversary, not just a scheduled review.

The CBEST gap

The swarm found what the testing cycle missed. Open-source reconnaissance turned up dangling DNS records exposed to the public internet; the client fixed them within hours of the report landing.

We then compromised crown-jewel infrastructure, established command and control, and exfiltrated sensitive data. Chaining small misconfigurations together let us escalate privileges step by step until we reached critical systems. A CBEST cycle catches a snapshot of known risks; it doesn’t catch a chain like that.

At the same time, our operators walked into the client’s main office, reached the IT equipment, and prepared to remove hardware without being caught. Staff walked past us without a glance. Strong technical controls mean nothing if the humans around them miss the same thing.

The swarm

We replayed every breach until it failed. Once the client hardened its SOC, tuned its SIEM rules, and tightened firewall and endpoint controls, the same payloads that had bypassed those defences stopped working.

Three months later, we tried the physical intrusion again. This time, staff challenged us and threw us out. Each cycle became a chance to close a gap and harden the client’s posture.

The outcome

Within ten months, the client raised its subscription from 25 per cent to 50 per cent coverage.

They no longer measure success by a compliance certificate. Their internal team now faces a live, persistent adversary that forces constant evolution of their defences. Compliance is a by-product now, not the goal. For the first time, the board could see how its security investment translated into real-world resilience.

A CBEST pass proves you cleared a checkpoint. It doesn’t prove you’d survive what comes next.

What would a live, persistent adversary find behind your next CBEST cycle?

Compliance tells you when you last passed. It doesn’t tell you what’s changed since. Contact CovertSwarm and put your compliance programme, and your building, under the same constant pressure a real adversary would.