Why Security Testing Matters in Hong Kong
Hong Kong's regulators expect organisations to test their defences: the HKMA builds intelligence-led attack simulation testing (iCAST) into its Cyber Resilience Assessment Framework, and the Protection of Critical Infrastructures (Computer Systems) Ordinance requires designated operators to carry out regular security risk assessments and audits.
We combine both sides of security testing: penetration tests, in which experienced testers attack your systems like a real adversary, and continuous vulnerability management, which detects new weaknesses on your perimeter between the tests and tracks them until they are fixed.
Penetration Testing
- External network testing — Internet-facing systems such as web servers, mail gateways, VPN endpoints and cloud services
- Internal network testing — Simulation of an attacker inside your network: segmentation, privilege escalation and lateral movement
- Web application and API testing — In-depth testing based on the OWASP Top 10 and OWASP API Security Top 10
- Mobile application testing — iOS and Android apps, including data storage, communication and authentication
- Cloud configuration review — Identity, network and storage settings in AWS, Azure and Google Cloud
- Social engineering — Controlled phishing simulations to test the security awareness of your employees
Vulnerability Management
- Continuous perimeter scanning — Automated scans of your internet-facing systems detect new vulnerabilities and misconfigurations
- Risk-based prioritisation — Findings rated by severity and exposure, so your team fixes what matters first
- Remediation tracking — Every finding becomes a task with an owner and a due date, verified by a re-scan
- Reporting — Trends and open risks for management, and evidence for auditors and customers
Requirements in Hong Kong
Regular security testing helps you meet the requirements that apply to your organisation:
- HKMA C-RAF and iCAST — Cyber resilience assessment and intelligence-led cyber attack simulation testing for authorised institutions
- Protection of Critical Infrastructures (Computer Systems) Ordinance — Regular security risk assessments and independent security audits for designated operators
- PDPO Data Protection Principle 4 — Practicable steps to protect personal data, including testing of security measures
- PCI DSS — Penetration testing and quarterly vulnerability scans for organisations that process payment card data
- ISO/IEC 27001 — Technical vulnerability management (Annex A 8.8) and security testing (Annex A 8.29)
How Does It Work?
Scope & Plan
We agree the scope, objectives and rules of engagement with your team. All testing is carried out under explicit written authorisation.
Test & Scan
Our testers combine manual techniques with professional tools, following OWASP, PTES and NIST SP 800-115, while scanning runs continuously.
Report & Retest
You receive an executive summary, technical findings and prioritised recommendations, and we retest to confirm the fixes.
Why ResGuard?
- Experienced, certified testers with a manual, attacker-minded approach — not just automated tools
- Actionable reports with findings mapped to your compliance obligations
- One platform — findings from tests and scans are tracked in the Pentest Manager and the Vulnerability Scan Manager of the ResGuard Compliance Manager
- Building an ISMS? Combine testing with our Outsourced CISO (vCISO)