On this page, you will find concrete solutions to help you not only pass your exams, but also to fill them with substance: through realistic tests, understandable reports, and targeted preparation.
Your partner for BaFin compliance.
And for real security when it counts.
ProSec.
…demand more than just security concepts on paper. What is needed is evidence that protective measures function in an emergency.
For financial institutions and IT service providers (e.g. cloud, SOC, managed services) who want – and need – to take responsibility.
…deliver what supervisors want to see. Our Penetration tests, TLPTs and red teaming help you to demonstrably meet regulatory requirements – realistically, comprehensibly and precisely documented.
Realistic attack scenarios instead of war games
Understandable results for audit & IT
Prioritized recommendations for action
Between January 2023 and June 2024, the European financial sector 488 cyber incidents publicly reported (Source: ENISA Threat Landscape: Finance 2025). Most affected credit institutions – 61% of attacks were directed against banks, with the most frequent being Ransomware attacks in focus.
The effects were serious: In 38% of cases resulted in financial damagein 35% to data loss and in 20% to operational disruptionsIn this context, ENISA explicitly warns of long-term consequences for the supply chain and the stability of the entire sector.
Such figures show that regulations such as DORA, MaRisk or the BSI Act are not abstract obligations – but necessary responses to real dangers. Anyone who wants to not only declare safety but also prove it needs realistic tests, clear responsibilities and a safety culture that can withstand regulatory pressure.
you wonder, which requirements specifically affect your company in the financial sector – and whether, for example, TLPT (Threat-Led Penetration Testing), phishing tests or other realistic tests are mandatory or recommended for you?
Our Article “Regulations in the financial sector” provides you with:
Even more focused and prepared for decision-makers:
The Executive Summary “Which IT requirements apply to your financial company – and why” as a PDF with a clear matrix, concrete examples and an overview of the specific audit obligations arising from the specifications – also for companies with a service provider role (e.g. cloud, SOC, managed services).
Regulated companies in the financial sector face very different challenges. Therefore, we do not offer standard products, but targeted solutions – tailored to your regulatory status, your testing requirements and your technical framework.
For many companies in the financial sector, DORA not only poses new requirements, but also completely new questions: Who is affected? What does TLPT mean in practice? And how can regulatory certainty be combined with operational efficiency?
Our DORA page provides answers – exactly where others only quote paragraphs.
Use our expert knowledge and get answers:
Pleasing: Most DORA-regulated companies are already actively addressing the issue of resilience to cyber attacks.
For the Step to the next level of maturity (and thus to precise risk management) often only a regular, independent audit from outside – and the continuous translation of the results into concrete Optimization measures.
ProSec supports both aspects transparently and with efficient Knowledge transfer to your internal team or service provider. Through realistic tests and practice-oriented recommendations for action, we help you not only to formally meet the requirements of BaFin and DORA, but also to implement them sustainably.
Do you need to convince internally – or do you want clarity about your next steps?
This additional content provides what strategic decision-makers need now:
What distinguishes MaRisk, VAIT, §8a & DORA – and how to navigate safely:
Executive Summary (PDF) – with classification aid, practical examples & clear matrix on MaRisk, DORA, VAIT & Co.
Anyone who takes IT security seriously—or needs to demonstrate it—needs more than standard reports. Our pentests combine a real-attack approach, technical depth, and strategic translation for decision-makers. Whether auditors, management, or IT managers—our results provide answers that everyone can work with.
You can count on:
