--- title: FINMA-regulated pentesting · avantguard cyber security description: FINMA-regulated penetration testing --- [Skip to content](https://avantguard.io/en/finma-regulated-pentesting#main) [![avantguard cyber security](https://avantguard.io/hs-fs/hubfs/LogoInverted.png?width=128&height=61&name=LogoInverted.png)](https://avantguard.io/en?hsLang=en) - [Services](https://avantguard.io/en/services?hsLang=en) - [About Us](https://avantguard.io/en/about-us?hsLang=en) - [Experience](https://avantguard.io/en/experience?hsLang=en) - [Career](https://avantguard.io/de/karriere?hsLang=en) - [Research](https://avantguard.io/en/blog?hsLang=en) - [Contact](https://avantguard.io/en/contact?hsLang=en) [DE](https://avantguard.io/de-ch/finma-reguliertes-pentesting) EN [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) [DE](https://avantguard.io/de-ch/finma-reguliertes-pentesting) EN [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) Services # FINMA-regulated penetration testing With [FINMA Circular 2023/1 "Operational risks and resilience" (margin no. 69)](https://www.finma.ch/de/~/media/finma/dokumente/dokumentencenter/myfinma/rundschreiben/finma-rs-2023-01-20221207.pdf), penetration testing becomes mandatory for many institutions: [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) > "Executive management regularly has vulnerability analyses and penetration tests carried out. These must be performed by qualified personnel with adequate resources." **What does this mean for your company?** Carrying out penetration tests is not only mandatory, it also requires a clearly structured process, from planning to reporting. Among other things, this means: - Drawing up **policies and internal directives** for penetration testing - Defining **test objects and test cycles** - Holding **scoping meetings** - Documenting the entire **penetration testing process in an audit-proof way** - **Meeting deadlines** and tracking findings For many FINMA-regulated companies this means planning, carrying out and evaluating numerous penetration tests every year, on top of day-to-day operations. **Our support:** We support you in every phase, from drafting the policies through execution to evaluation, tracking and reporting of the results. **Our solution:** With [**mesher**](https://avantguard.io/en/mesher?hsLang=en), our purpose-built client platform, you manage the entire penetration testing process efficiently. The software is already in successful use with clients such as **Allianz Suisse** and ensures clear workflows, traceability and secure documentation. ## References - [![Allianz](https://avantguard.io/hubfs/allianz_logo.png)](https://www.allianz.ch) - [![Migrosbank](https://avantguard.io/hubfs/migros_bank.png)](https://www.migrosbank.ch) - [![Blkb](https://avantguard.io/hubfs/Kunden_Logos/blkb.png)](https://www.blkb.ch/) - [![Valiant](https://avantguard.io/hubfs/Kunden_Logos/logo_Valiant.png)](https://www.valiant.ch/) And many more clients, from the local bakery to the nuclear power plant. Success Story ## Allianz Suisse > "avantguard supports us in penetration testing in two areas: one is preparation and coordination, the other is carrying out the penetration tests, which are performed at a very, very high level of quality and are also very well received by external auditors such as FINMA." (translated from German) **Christian Bormann** Head of IT Risk and Compliance Management, Allianz Suisse ## What our clients say Many FINMA-regulated companies already rely on our expertise. Here are some of our success stories: > «avantguard supports us under a long-term mandate in planning, preparing, carrying out and debriefing penetration tests. With the support of mesher and avantguard, we are increasing the number and quality of penetration tests and delivering a first-class service to our customers in line with our 5-star strategy. avantguard has established itself as a reliable partner and makes a decisive contribution to successfully implementing the regulatory requirements for penetration testing.» (translated from German) ![](https://avantguard.io/hs-fs/hubfs/Zitate/christian_bormann_allianz_suisse_2.jpg?width=96&height=96&name=christian_bormann_allianz_suisse_2.jpg) **Christian Bormann**Head of IT Risk and Compliance Management ![Allianz Suisse](https://avantguard.io/hs-fs/hubfs/allianz_logo.png?width=300&name=allianz_logo.png) > «For us, penetration testing by avantguard means not just meeting regulatory requirements but real added value: clear insights into risks and concrete approaches for improving our security. With avantguard, we make sure that our systems are not only tested in line with FINMA, but that we receive concrete recommendations that make our bank more resilient in the long term.» (translated from German) ![](https://avantguard.io/hs-fs/hubfs/Zitate/joey_ryser_migros_bank.png?width=96&height=96&name=joey_ryser_migros_bank.png) **Joey Ryser**Information Security Officer ![Migros Bank](https://avantguard.io/hs-fs/hubfs/migros_bank.png?width=300&name=migros_bank.png) > «As Information Security Officer and the person responsible at Valiant Bank AG, I greatly value working with avantguard in the field of penetration testing. The projects are carried out with great care, high commitment and remarkable flexibility. The reports impress with their high level of detail, clear structure and sound technical expertise. They provide valuable insights and effectively support us in continuously developing our security measures. I am extremely satisfied with the service and can recommend avantguard without reservation as a competent and reliable partner in cyber security.» (translated from German) ![](https://avantguard.io/hs-fs/hubfs/Zitate/rico%20zemp.jpg?width=96&height=96&name=rico%20zemp.jpg) **Rico Zemp**Information Security Officer ![Valiant Bank](https://avantguard.io/hs-fs/hubfs/Kunden_Logos/logo_Valiant.png?width=300&name=logo_Valiant.png) ## Penetration testing process 1. Policy ### Policies and directives Review existing requirements and develop new policies to implement the FINMA requirements effectively. 2. Target ### Definition of test objects Define test objects and test cycles in a targeted way, based on the applicable policies and directives. 3. Accept ### Create acceptance for pentesting All stakeholders involved are informed about the necessary tests and brought on board. This creates internal acceptance for the tests. 4. Scope ### Scoping of test objects Each test object is scoped promptly to define a clear scope and an appropriate test depth. 5. Support ### Support the pentest We actively support the penetration tests to ensure a smooth process and respond quickly to any challenges. This is how we ensure efficient, targeted tests. 6. Test ### Penetration Testing The penetration tests are carried out by qualified personnel with adequate resources to meet FINMA requirements. 7. Report ### Reporting and tracking All results are recorded and evaluated. On this basis, reports are created regularly, and progress and findings are monitored through continuous tracking. 8. mesher ### Automation mesher automates the entire penetration testing process, from planning to reporting. Workflows are managed transparently, audit-proof and efficiently. ## Features ### Mandate We support you in defining the directives and design the entire penetration testing process, from planning and execution to follow-up. Flexible mandates or quotas allow for tailored, reliable support. ### Penetration Testing Our qualified specialists carry out the penetration tests with the necessary resources, ensuring thorough, compliant and professional security testing of your IT systems. ### mesher With mesher, our in-house development, we automate the entire penetration testing process. This creates transparent workflows and audit-proof documentation and lastingly increases the efficiency of your security testing. Our in-house software mesher supports the entire penetration testing process. mesher also ensures that the whole process is carried out in line with regulatory requirements and is audit-proof. mesher is already in successful use at Allianz Suisse. [More about mesher](https://avantguard.io/en/mesher?hsLang=en) ![mesher\_logo](https://avantguard.io/hs-fs/hubfs/Mesher/mesher_logo.png?width=1000&name=mesher_logo.png) ## FAQs ### What does FINMA-regulated penetration testing mean in practice? In Circular 2023/1, FINMA requires institutions to carry out **vulnerability analyses and penetration tests regularly**, carried out by **qualified personnel** and with **adequate resources**. ### Which institutions are affected? They apply to, among others, **banks**, **persons under Art. 1b BankA (FinTech licence)**, **securities firms** and **financial groups/conglomerates**. ### How often must penetration tests take place? FINMA does not prescribe a fixed frequency; it requires **regular, risk-based** tests. In practice, internet-exposed systems are tested at least once a year, depending on risk and the pace of change. ### Which systems must be tested? **All internet-exposed ICT components** and, on a risk basis, **non-internet-exposed components** that are required for **critical processes**. ### Do the penetration tests have to be carried out externally? **What matters is qualification and sufficient resources**. For reasons of **independence and capacity**, many institutions rely on external specialists. ### Does FINMA require further tests? Yes, FINMA names **scenario-based cyber exercises** (e.g. **table-top** or **red teaming**) as a complementary instrument. ### How does avantguard support the implementation of the FINMA requirements? We support the **entire process**: policies/directives, scoping, execution by **qualified specialists**, reporting and **tracking**, **including mesher** for audit-proof management. ### What is mesher and what do I need it for? *mesher* is our client platform that automates **planning, monitoring, findings tracking, reporting** and **versioning**: **efficient, traceable, audit-proof**; already in use at **Allianz Suisse**, among others. ### What documentation does FINMA expect? Requirements include **transparent risk and control reports**, evidence of the **effectiveness of key controls**, **incident/cyber reporting** and traceable **penetration test results** (including measures and prioritisation). ## How secure are your systems really? Tell us about your project. We will get back to you with a non-binding offer. [Request an offer](https://avantguard.io/en/request-an-offer?hsLang=en) [+41 55 253 30 30](tel:+41552533030) [![avantguard cyber security](https://avantguard.io/hs-fs/hubfs/LogoInverted.png?width=140&height=66&name=LogoInverted.png)](https://avantguard.io/en?hsLang=en) avantguard cyber security AG Neue Jonastrasse 52 8640 Rapperswil-Jona, Switzerland [+41 55 253 30 30](tel:+41552533030) [info@avantguard.io](mailto:info@avantguard.io) ## Company - [Services](https://avantguard.io/en/services?hsLang=en) - [About us](https://avantguard.io/en/about-us?hsLang=en) - [Experience](https://avantguard.io/en/experience?hsLang=en) - [AI at avantguard](https://avantguard.io/en/how-we-use-ai?hsLang=en) - [Careers](https://avantguard.io/en/careers?hsLang=en) - [Research](https://avantguard.io/en/blog?hsLang=en) - [Contact](https://avantguard.io/en/contact?hsLang=en) ## Services - [Penetration Testing](https://avantguard.io/en/penetration-test?hsLang=en) - [Red Teaming](https://avantguard.io/en/red-teaming?hsLang=en) - [Attack Simulation](https://avantguard.io/en/attack-simulation?hsLang=en) - [FINMA-regulated pentesting](https://avantguard.io/en/finma-regulated-pentesting?hsLang=en) - [AD Security Improvement](https://avantguard.io/en/ad_improvement?hsLang=en) - [mesher](https://avantguard.io/en/mesher?hsLang=en) - [All services](https://avantguard.io/en/services?hsLang=en) ## Research - [All posts](https://avantguard.io/en/blog?hsLang=en) © 2026 avantguard cyber security AG - [Privacy policy](https://avantguard.io/en/privacy-policy) - [Deutsch](https://avantguard.io/) ```json { "@context" : "https://schema.org", "@type" : "FAQPage", "mainEntity" : [ { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "In Circular 2023/1, FINMA requires institutions to carry out vulnerability analyses and penetration tests regularly, carried out by qualified personnel and with adequate resources." }, "name" : "What does FINMA-regulated penetration testing mean in practice?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "They apply to, among others, banks, persons under Art. 1b BankA (FinTech licence), securities firms and financial groups/conglomerates." }, "name" : "Which institutions are affected?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "FINMA does not prescribe a fixed frequency; it requires regular, risk-based tests. In practice, internet-exposed systems are tested at least once a year, depending on risk and the pace of change." }, "name" : "How often must penetration tests take place?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "All internet-exposed ICT components and, on a risk basis, non-internet-exposed components that are required for critical processes." }, "name" : "Which systems must be tested?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "What matters is qualification and sufficient resources. For reasons of independence and capacity, many institutions rely on external specialists." }, "name" : "Do the penetration tests have to be carried out externally?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Yes, FINMA names scenario-based cyber exercises (e.g. table-top or red teaming) as a complementary instrument." }, "name" : "Does FINMA require further tests?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "We support the entire process: policies/directives, scoping, execution by qualified specialists, reporting and tracking, including mesher for audit-proof management." }, "name" : "How does avantguard support the implementation of the FINMA requirements?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "mesher is our client platform that automates planning, monitoring, findings tracking, reporting and versioning: efficient, traceable, audit-proof; already in use at Allianz Suisse, among others." }, "name" : "What is mesher and what do I need it for?" }, { "@type" : "Question", "acceptedAnswer" : { "@type" : "Answer", "text" : "Requirements include transparent risk and control reports, evidence of the effectiveness of key controls, incident/cyber reporting and traceable penetration test results (including measures and prioritisation)." }, "name" : "What documentation does FINMA expect?" } ] } ```