STAR-FS (Simulated Targeted Attack and Response for the Finance Sector) is the CREST-run, intelligence-led penetration testing scheme for FCA-regulated financial firms. It is a companion to CBEST that covers a wider range of firms and relies on commercially available threat intelligence rather than CBEST's bespoke, systemic-risk focus. Delivering it requires CREST-accredited threat intelligence and red team providers. The list below opens with our Featured partner, clearly labelled, followed by the wider set of providers carrying the CREST STAR accreditation in our directory.
Related: CBEST-accredited companies · CREST pen testing companies · Threat-led penetration testing (TLPT)
STAR-FS is the CREST scheme for intelligence-led penetration testing of FCA-regulated financial services firms. It works the same way as CBEST, mimicking the tactics, techniques, and procedures of real threat actors against a firm's Important Business Services, but relies on commercially available threat intelligence rather than the bespoke, systemic-risk intelligence CBEST uses. It can be supervisory-led or self-initiated, and self-initiated tests can count for supervisory purposes if the firm involves its regulator.
An engagement follows the same phases as CBEST (Initiation, Threat Intelligence, Penetration Testing, and Closure) and typically runs up to 24 weeks, with the red team phase lasting up to six weeks. Both the threat intelligence and the red team must be delivered by CREST-accredited providers.
The providers below carry the CREST STAR accreditation in our directory. Because STAR-FS uses the same accredited pool and qualifications as CBEST, look for demonstrated financial-sector red team experience and CCRTS and CCRTM staffing, and confirm a supplier's current STAR-FS scheme status with CREST before appointing them.
UK offensive security consultancy delivering CREST-accredited penetration testing, adversary simulation and CBEST, TIBER-EU and TBEST threat-led testing, mainly for financial services and other large organisations.
Global Big Four professional services firm delivering CREST, CHECK, and CBEST-accredited penetration testing and red teaming services from London, serving the UK's largest enterprises and regulated organisations.
CREST and CHECK-accredited UK penetration testing and managed security provider formed in 2026 from Pentest People, Bulletproof, and Target Defense, with CREST STAR/TLPT-FS capability and the GuardNest vulnerability management platform.
Global enterprise cybersecurity consultancy founded in 1999 in Oxford, holding rare CREST STAR-FS accreditation and delivering penetration testing, red and purple teaming, and PCI QSA services across five international offices.
Elite UK offensive security consultancy specialising in CBEST/STAR/TIBER red teaming, advanced adversary simulation, and CREST-accredited penetration testing for FTSE 100 clients.
CREST and CHECK-accredited UK penetration testing consultancy with CBEST approval, specialising in infrastructure, application, and simulated attack assessments across the public and private sectors.
Subscription-based offensive cybersecurity firm delivering continuous cyber attack services with CREST STAR and CBEST accreditations from its London headquarters.
STAR-FS (Simulated Targeted Attack and Response for the Finance Sector) is a CREST-run, intelligence-led penetration testing scheme for FCA-regulated financial firms. It mimics the tactics of real threat actors against a firm's Important Business Services, and is a companion to the Bank of England's CBEST that covers a broader range of firms.
Both are intelligence-led red team schemes for UK financial services that run the same phases. CBEST is the Bank of England's regulator-led scheme for systemically important firms and uses bespoke, systemic-risk threat intelligence. STAR-FS is CREST-run, covers a wider range of FCA-regulated firms, can be self-initiated, and relies on commercially available threat intelligence.
STAR-FS engagements must be delivered by CREST-accredited threat intelligence and red team providers, using the same accredited pool and consultant qualifications (CCRTS and CCRTM) as CBEST. Always confirm a provider's current STAR-FS status with CREST before appointing them.
A STAR-FS engagement follows the same phases as CBEST and typically runs up to 24 weeks end to end, with the red team (penetration testing) phase lasting up to six weeks.