A visitor’s perspective
We started where a visitor starts: a laptop and the guest WiFi credentials the bank hands out at the front desk. That is the whole starting position, the same one available to anyone who walks in off the street.
Within hours, the guest network gave up a way in. It was meant to be isolated from internal systems; it wasn’t. From it, we found paths straight into the bank’s corporate infrastructure.
Where the digital met the physical
The physical assessment landed just as hard. Doors, badges and locked screens hold up on paper, but they only work if the habits around them do — and here the habits gave way.
“The most sophisticated digital defenses become meaningless when an attacker can simply walk in and sit down at an unlocked computer.”
What the bank did with it
Leadership didn’t reach for quick fixes. They took the findings and rebuilt, working a prioritized remediation roadmap that closed the gaps while keeping the business running.
Six months on, the change ran past the technical fixes. The biggest shift was cultural: security became a shared responsibility across the organization instead of an IT problem, backed by regular awareness work. Physical security was overhauled too — biometric access control, mandatory badge visibility, and an expectation that staff challenge anyone they don’t recognize.
Where the bank landed
Regular penetration tests now turn up minor issues, not critical ones. More important, the bank can detect, respond to and recover from incidents before they become breaches — and it knows where it stands well enough to prove it.