Attack Surface Management for Financial Services: Client Portals, APIs, and Trading Platforms

The External Attack Surface of a Typical Financial Firm

Hadrian's discovery process typically identifies assets financial firms did not know they had. The common categories of external exposure:

• Client portals: Web-based client reporting, valuations, and document sharing — often built on third-party platforms with their own vulnerability histories
• API gateways: Open Banking APIs, data provider integrations, custodian connections — each with their own authentication and vulnerability profile
• Trading and order management systems: External-facing components of platforms that connect to exchanges and counterparties
• Regulatory reporting infrastructure: CAIS, FCA reporting gateways, HMRC integrations — sensitive and often poorly monitored
• Legacy applications: Systems migrated to cloud or internet-connected during rapid digitalisation — often without security review
• Subdomains and forgotten infrastructure: Old marketing sites, test environments, development instances — left accessible and unpatched

How Attack Surface Management Supports PS21/3 Compliance

FCA PS21/3 requires firms to map the technology that delivers their important business services. You cannot set an impact tolerance for client portfolio access if you do not know every system and connection involved in delivering it. Hadrian's continuous discovery provides the technology map that PS21/3 mapping requires — and because it runs continuously, it captures new assets and connections as they are created, not just at the annual review point.

Finding Vulnerabilities Before Attackers Do

Hadrian goes beyond asset discovery to active vulnerability identification: misconfigured cloud storage, exposed admin panels, unpatched web application components, weak SSL/TLS configurations, and API endpoints without adequate authentication. For financial firms, this intelligence directly supports the vulnerability management requirements in PCI DSS v4.0, the testing requirements in PS21/3, and the FCA's expectation that firms identify and remediate security weaknesses promptly. Hadrian provides prioritised findings with remediation guidance — not a raw list of CVEs requiring specialist interpretation.

Continuous Monitoring as a Regulatory Differentiator

Point-in-time penetration testing — the standard approach for most financial firms — provides a snapshot of the attack surface at one moment in time. Hadrian provides continuous monitoring: when a new subdomain is created, a new API endpoint deployed, or a new vulnerability disclosed for software you run, Hadrian detects it. For firms under FCA supervision, continuous monitoring demonstrates the ongoing vigilance that PS21/3 and SYSC 13 require — and provides the evidence trail that supports a defence of adequate controls if an incident occurs.

Frequently Asked Questions