This article presents an enlightening case study, illustrating how ISGroup SRL, a company with solid expertise in corporate ethical hacking and cybersecurity, collaborated with Acmebank to enhance its digital operational resilience through a targeted intervention.

We will explore the challenges faced by the bank, the solutions implemented by ISGroup SRL, the tangible results achieved, and, above all, the fundamental role of corporate ethical hacking in identifying and resolving critical vulnerabilities. This case study will provide valuable lessons learned and recommendations applicable to other business entities aiming to strengthen their ICT risk management and digital operational resilience.

The Challenge

Institutions like Acmebank face a series of complex challenges in terms of cybersecurity and digital operational resilience. Critical vulnerabilities in ICT systems can have devastating consequences, including operational disruptions, financial losses, reputational damage, and regulatory compliance breaches.

Furthermore, the growing trend of outsourcing critical functions such as asset management, actuarial calculations, accounting, and data management to third-party service providers introduces additional layers of complexity and risk. This dependency on external parties, particularly critical ICT service providers, can represent a systemic risk if not adequately managed.

As a security manager at Acmebank observed before the intervention: “We were particularly concerned about our dependencies on certain key technology providers. Understanding the real impact of a breach at one of them could represent a blind spot for us.”

In an increasingly stringent regulatory context like the one outlined by DORA, it is essential that financial institutions adopt robust measures to ensure their ability to prevent, detect, respond to, and recover from ICT incidents.

The provisions regarding digital operational resilience and ICT security are not yet fully and consistently harmonized at the European Union level. This regulatory heterogeneity and the increasing sophistication of threats make a proactive, threat intelligence-based approach necessary to assess and improve digital operational resilience.

Acmebank, aware of these challenges, decided to embark on a path of strengthening its digital operational resilience through an in-depth assessment and a targeted intervention conducted by industry experts. The choice fell on ISGroup SRL, a company with proven experience in ethical hacking and cybersecurity, capable of providing an external perspective and specialized skills to identify and address the most critical vulnerabilities.

Corporate ethical hacking: the ISGroup SRL intervention

The corporate ethical hacking intervention conducted by ISGroup SRL for Acmebank was structured around a TIBER-EU (Threat Intelligence-Based Ethical Red Teaming) test, a methodology designed to simulate complex cyberattacks based on real threats. For those who want to delve into the technical lexicon of this field, a complete overview can be found in the guide to all ethical hacking terms.

As a representative of ISGroup SRL explained: “Our goal was not just to identify vulnerabilities, but to understand how a determined attacker, leveraging current threat trends, could compromise Acmebank’s critical operations.”

The TIBER-EU framework is based on a collaborative and intelligence-led approach. It includes several key phases, starting with an in-depth threat analysis. The team of experts at ISGroup SRL began by collecting and analyzing information on the threat landscape relevant to the financial sector and, in particular, to Acmebank.

The Targeted Threat Intelligence Report (TTIR) produced by ISGroup SRL was fundamental. It outlined threat scenarios that simulated plausible attacks against Acmebank’s production systems, which are critical to its critical or important functions (CIF). Based on the TTIR, the ISGroup SRL red team developed and executed realistic attack scenarios against the bank’s systems, with concrete and immediately actionable recommendations.

The simulation

This phase of corporate ethical hacking, similar to advanced penetration testing, aimed to simulate the actions of real cybercriminals, including potential insiders. The red team employed various techniques to compromise the confidentiality, integrity, and availability of Acmebank’s critical systems. The human component and social engineering in ethical hacking played a significant role in this scenario as well.

As stated by the bank’s CISO: “The threat scenarios presented by ISGroup were incredibly realistic, custom-built for our sector and based on known weaknesses.”

To preserve the integrity of the test, only a restricted internal control team was informed. This allowed for the assessment of the actual ability to detect and manage unexpected attacks.

The red team agreed on communication protocols with the control team, sharing Indicators of Attack (IoA) to distinguish simulations from real threats. The activities were planned in the Red Team Test Plan (RTTP), with details on the measures taken to contain any risks.

The testers, who are CREST-qualified or equivalent, documented every phase in detail. This collection of evidence allowed for an in-depth analysis and fed into the Red Team Test Report (RTTR), which included:

• vulnerabilities found
• simulated attack scenarios
• responses of security controls
• recommendations and root causes

In the final phase, ISGroup SRL collaborated with Acmebank to analyze the results, prioritize vulnerabilities, and define a high-level remediation plan.

As a senior IT manager observed: “The report was not just a list of problems, but a concrete guide to understanding how an attacker could have exploited our weaknesses and chained vulnerabilities to achieve their goals. The recommendations were concrete and immediately actionable.”

Results and benefits of corporate ethical hacking

The ISGroup SRL intervention produced significant results and benefits for Acmebank, going beyond the simple identification of vulnerabilities. By simulating real attacks, ISGroup SRL provided valuable insights into the exploitation of potential weak points, allowing Acmebank to proactively address these issues and strengthen its overall security. A structured approach like the one described in this case study falls fully within the scope of the ethical hacking services that ISGroup offers to organizations that want to concretely measure their risk exposure.

The detailed report provided by ISGroup SRL served as a roadmap for resolution. It highlighted the specific vulnerabilities identified and provided customized recommendations to resolve them, thus aligning with the regulatory importance of establishing a formal follow-up process for ICT audit results and ensuring their timely verification and resolution.

As a senior executive of the bank might have commented: “The report was not just a list of problems; it provided us with clear and concrete steps to resolve them. We now have a much clearer understanding of where to focus our security investments.”

The TIBER-EU test, with its focus on realistic attack scenarios, provided a crucial assessment of Acmebank’s ability to detect and respond to sophisticated cyber threats. The identification of successful attack paths and the root causes of effective attacks allowed Acmebank to refine its detection and response mechanisms. To learn more about how this type of activity concretely impacts ICT incident management, a dedicated analysis is available.

Ultimately, the engagement with ISGroup SRL significantly improved Acmebank’s digital operational resilience. The bank gained a deeper understanding of its vulnerabilities, the tactics and techniques that could be used by adversaries, and the effectiveness of existing security controls.

Frequently asked questions about corporate ethical hacking

• How long does an ethical hacking intervention like the one described typically last?
• The duration depends on the complexity of the organization and the agreed scope. A complete TIBER-EU test, including the threat intelligence phase, the simulation, and the production of the final report, generally takes from a few weeks to a few months. More limited interventions can be completed in shorter timeframes.
• Who must be informed internally during the test?
• To preserve the realism of the simulation, knowledge of the test is limited to a restricted control team. Operational staff, including security and IT teams, are not informed in advance: this allows for the assessment of the organization’s real detection and response capability under authentic conditions.
• What happens after the report is delivered?
• The report is not an end point but a starting point. ISGroup SRL collaborates with the client to analyze the results, prioritize vulnerabilities based on actual risk, and define a concrete remediation plan. The recommendations are designed to be immediately actionable, not just theoretical.