Regulatory testing
Threat-led testing that satisfies your regulator and strengthens your real-world resilience. Built for organisations operating across domestic and international obligations, from CBEST to STAR-FS to DORA.
CovertSwarm named in the Gartner® Hype Cycle™ for Security Operations, 2026
Less audit.
More adversary.
Full regulatory rigour.
Full attacker intent.
Regulators expect you to test your defences against realistic adversaries. Most organisations treat that as a box to tick. The scenarios are predictable, the attack paths are narrow and the findings confirm what everyone already knew.
Real attackers do not follow your testing schedule. They chain weaknesses across technology, people and suppliers. They adapt when a route closes. A threat-led engagement tests your organisation against that intent, not against a framework checklist. It’s why UK regulators built CBEST and STAR-FS around threat intelligence.
Meet the requirement, but demand more from the test with Constant Cyber Attack.
Give your regulators the evidence they expect.
Testing aligned to your regulatory, industry and assurance requirements. Our operators simulate the adversaries most likely to target your sector, using current threat intelligence and executing across your full attack surface.
Your engagement is scoped against the frameworks that apply to you. CBEST for firms and financial market infrastructures selected by the UK regulators. STAR-FS for a wider range of financial services firms running intelligence-led testing with regulatory reporting. Scenario testing evidence for PRA and FCA operational resilience requirements. DORA threat-led penetration testing for EU entities in UK-headquartered groups selected by their competent authorities. PCI DSS for organisations handling cardholder data.
Across all of them, the approach is the same. We chain attack paths rather than test systems in isolation, execute across digital, physical and social vectors, and deliver findings structured for your regulator, your board and your technical team in one report.
Turn attacker pressure into boardroom confidence.
What would an attacker target in your business? Talk to our team about what you need to protect and what you want to prove.
Together, we’ll explore the objectives, scope and approach for a realistic compliance exercise.
Want the attack to keep going after the report lands? Explore Constant Cyber Attack
How it works
Your engagement starts with a clear objective: what matters most to your business, and how an attacker might reach it.
Together, we agree the scope, timeframe and rules before putting your defences to the test.
1
Threat intelligence scoping
We identify the adversaries most relevant to your organisation and select credible TTPs against your specific assets and business objectives.
2
Rules of engagement
Scope, targets, permitted techniques, and stop conditions are formally agreed and signed off before any activity begins.
3
Threat-led execution
Our operators execute across digital, physical, and social vectors, adapting as the engagement unfolds to reflect how a real adversary would operate.
4
Multi-level reporting
Findings are structured for your regulator, your board, and your technical team. Evidence, narrative, and prioritised remediation in one report.
Don’t just test your compliance.
Prove it works.
Clear accountability.
Know who leads your engagement and who to contact. Before the attack begins, agree how decisions are made, how concerns are escalated and who can pause the exercise.
Agreed guardrails.
Set the scope, permitted activity and exclusions upfront. Rules of engagement define how the team operates around your production systems, sensitive data and business priorities.
Expert operators.
Work with the people conducting the attack. Understand their decisions, challenge their findings and get clear answers about what the evidence means for your business.
Evidence you can understand and act on.
See results presented for all your audiences: regulators, executives, practitioners. Know which objectives were achieved, where defences held and how your team responded.
An attack narrative and prioritised recommendations give technical teams and leadership a clear basis for action.
Meet requirements across borders.
Your business operates internationally. Your security testing needs to account for that. We work with UK organisations to scope testing around domestic requirements and the obligations that come with their EU and US operations.
From CBEST and STAR-FS engagements in the UK to DORA threat-led penetration testing in the EU and penetration testing supporting NYDFS Part 500 in the US, we bring the relevant objectives, scope and evidence into a clear engagement plan.
CREST accreditation and ISO-certified management systems give you greater confidence in the team delivering the work.
PRICING
From £1,725 per day
Your regulatory and compliance engagement is priced around the objectives, scope and work involved. Tell us what you need to prove, any specific requirements and your preferred timing. We’ll develop a proposal that sets out the approach, deliverables and cost.
Agreed objectives
Rules of engagement
Named engagement lead
Debrief and retest
What affects your quote
- Objectives and scope: what we’re trying to achieve and what’s involved.
- Attack scenarios: the technical, social and physical activities agreed.
- Duration and complexity: the time, preparation and expertise required.
- Deliverables and follow-up: reporting, debriefing and any agreed retesting.
Frequently Asked Questions
We scope testing around your regulatory, industry and assurance requirements. In the UK, these may include CBEST, STAR-FS, PRA and FCA operational resilience requirements, PCI DSS, ISO 27001 and UK GDPR. Some mandate specific testing; others use testing as supporting assurance. For international operations, engagements may include DORA TLPT for EU financial entities selected by their competent authorities and NYDFS Part 500 for US covered entities. CovertSwarm scopes applicable multi-jurisdictional obligations together into one engagement plan.
CBEST is a threat intelligence-led penetration testing framework run by the Bank of England, PRA and FCA for the firms and financial market infrastructures most important to the UK financial system. The regulators decide which firms take part and stay involved throughout. Each assessment combines threat intelligence with a penetration test that mirrors the attackers most likely to target the firm’s important business services. CovertSwarm is CREST-accredited to deliver CBEST engagements.
Both are intelligence-led penetration testing frameworks recognised by the UK regulators. CBEST is for the firms most important to the UK financial system, with regulators closely involved at every stage. STAR-FS, introduced in 2024, extends the same approach to a wider range of firms and lets them manage the test themselves while still reporting to the regulator. CovertSwarm is CREST-accredited to deliver both.
The Digital Operational Resilience Act is an EU regulation. It covers EU financial entities, so a UK firm isn’t covered just because it’s a UK firm. An EU financial entity in a UK-headquartered group can be covered. If its regulator identifies it for threat-led penetration testing (TLPT), it must run one, normally at least every three years. Separately, a UK ICT provider that the EU’s financial supervisors designate as critical can come under DORA oversight. That’s oversight of the provider, not a TLPT requirement. CovertSwarm delivers DORA-aligned TLPT engagements and scopes UK and EU obligations together.
PRA and FCA operational resilience rules require firms to identify their important business services, set impact tolerances and show they can stay within them during severe but plausible disruption. A threat-led engagement tests that against a realistic cyber attack, showing how far an attacker gets and how quickly your team detects and contains them. That evidence can feed into your scenario testing and self-assessment.
Looking for something specific?
Talk to us. We’d love to hear from you.
Stop testing.
Start knowing.
You’ll know exactly where you stand, and you’ll be able to prove it. To your board, your regulator, and yourself.
Transform to a proactive, continuous offensive security programme
Your budget is aimed at the risk that matters, not the one you were handed
You show the board what security prevented, not a request for more
Security clears the way for the business to move faster
You enter the boardroom in command
It starts with a 30-minute Attack Discovery call.
No access to your systems required.