T-Bank Successfully Completes Cybersecurity Testing Program
78 independent researchers took part in the tests. Over three months, they failed to execute a single large-scale attack scenario against the bank’s systems.
Cybersecurity priorities have shifted significantly in recent years. Deploying individual security tools is no longer enough to protect information. What matters more is how a company’s entire architecture is designed and whether that architecture can withstand attacks.
Steal Data or Money
T-Bank recently announced the completion of a large-scale cybersecurity test of its infrastructure. The three-month exercise challenged participants not merely to find vulnerabilities, but to carry out a full attack scenario: gaining access to customers’ personal data or even their money. A total of 78 independent researchers took part.
The simulated attackers failed to breach the bank’s security systems. The ethical hackers found just four vulnerabilities, none of which had a critical impact on the bank’s infrastructure. The participants were still paid for identifying the flaws, with the largest reward reaching 3.5 million rubles (approximately $43,000). A successful full-scale breach, however, would have earned a researcher 12 million rubles (approximately $149,000).
Not a One-Off Exercise
Dmitry Gadar, T-Bank’s vice president and head of information security, said the company had prepared for the tests in advance, steadily increasing rewards for vulnerability discoveries. He believes that bringing in independent researchers to identify security gaps is a highly valuable practice. Attackers will keep trying to penetrate corporate infrastructure, so companies are better off setting the rules themselves, giving specialists a clear process for finding vulnerabilities and reporting them to the system owner.
The bank is also paying close attention to the use of artificial intelligence in cybersecurity. Gadar said the team had experimented with AI agents, with some assigned to attack and others to defend. This allowed specialists to observe how automated systems countered one another. For now, he believes, AI offers no guaranteed advantage. Much depends on the model selected, how the task is framed, what data is available and who oversees the AI system’s actions, as well as how that oversight is carried out. Computing resources also play a role.
Response Speed Matters
AI’s biggest impact on cybersecurity is the sheer volume of activity it enables. Attackers can test more options, researchers can submit more reports, and agents can take more actions on people’s behalf. Under these conditions, the decisive factor is not just the security technology itself, but how quickly an organization can respond and make the necessary decisions. Companies therefore need to improve not only their technical defenses but also their organizational structures, making them more flexible and responsive.
As noted above, T-Bank regularly brings in independent ethical hackers to test the resilience of its systems. In 2023, for example, it launched a public bug bounty program, inviting participants to find technical vulnerabilities on the websites and in the mobile apps of its services. Rewards were tied to the severity of each flaw.
Cybersecurity Testing Gains Traction
Meanwhile, large-scale cybersecurity testing has also been gaining popularity in recent years. In 2022, Positive Technologies launched a program to identify critical attack scenarios that could lead to significant financial losses. The program expanded in 2024: in addition to the risk of funds being stolen, it began testing whether attackers could introduce malicious code into the organization’s digital products. In 2025, Positive Technologies and Cyberispytanie JSC signed a partnership agreement that enabled 100 companies to assess their security through testing programs of this kind.
Security experts caution, however, that passing a test successfully does not eliminate the need for continued improvements to defenses. Companies are therefore likely to broaden the scope of their assessments, gradually adding more scenarios involving business processes and critical infrastructure.
