Penetration testing for Indonesian banks and financial services

An Indonesian bank cannot wait for an OJK examination to find out whether its internet banking app or its BI-SNAP connection is exploitable. SEOJK 29/2022 makes that testing a standing obligation rather than a one-off project: internet-facing systems tested at least once a year by an independent third party, critical internal systems checked quarterly, and findings fixed against a clock. This page covers what has to be in scope for a bank specifically, how the two forms of testing the regulation recognises differ, and what happens to the report once it lands. For how a penetration test works in general, see our penetration testing service page.

Why penetration testing is a standing obligation for banks

Security testing sits inside the same framework as the rest of a bank's cyber resilience programme. POJK 11/2022 treats cyber risk as one of eight risk categories a commercial bank must manage, and SEOJK 29/2022 turns that into a concrete testing schedule, not a discretionary good practice.

The table below summarises what SEOJK 29/2022 mandates on testing and remediation, on top of the SWIFT Customer Security Programme requirements that apply to banks connected to SWIFT.

Two forms of security testing, one regulation

SEOJK 29/2022 recognises two forms of cyber security testing, and it is worth keeping them separate rather than treating "testing" as one undifferentiated activity. Vulnerability-analysis-based testing is the classic penetration test: it identifies weaknesses in a defined scope and attempts to exploit them. Scenario-based testing is closer to a red-team exercise, run against live defences to check how well the bank detects, contains, and recovers from a simulated incident.

For the full detail on cadence, scope, and how OJK treats each form, see our article on penetration testing requirements for Indonesian banks under POJK 11/2022. If you are weighing a lighter-touch vulnerability scan against a full test, our page on vulnerability assessment vs penetration testing sets out where each one fits.

What we test and how we deliver it

A bank's attack surface is wider than a single web app, so scoping has to account for every channel that reaches customer money or data.

Every engagement includes a free retest once fixes are in, because a report that says "fixed" only means something if someone checks. Findings are categorised by severity and mapped to remediation timeframes the bank can defend to OJK, and results can be presented directly to the Board Risk Committee in the format examiners expect.

What the numbers say about the sector

Untested systems are how a single exploitable gap turns into an incident on the scale of the Bank Syariah Indonesia case. With only 12 percent of Indonesian organisations rated mature on cyber readiness, an annual test that actually gets acted on is one of the more direct ways a bank can move off that baseline. For the regulatory background behind the testing mandate, see our article on OJK cybersecurity requirements for Indonesian banks.

If your annual test is coming up and you want it scoped to what OJK and your own risk profile actually require, our team can set out a concrete next step.