Best Penetration Testing Companies for Exchanges, Clearing Houses and Trading Platforms (2026): CFTC, Reg SCI and Prediction Markets

On 29 September 2022, the Commodity Futures Trading Commission (CFTC) settled charges against CX Futures Exchange, a New York designated contract market (DCM) that "primarily listed options and swap contracts relating to weather events" (order). CX "failed to conduct internal or external penetration testing in 2020", after moving its systems to a cloud-based platform, and its board "did not receive or review the results of any IT systems testing". The US$6.5 million penalty also covered reporting and false-statement violations (CFTC release).

In October 2024 came the CFTC's "first action charging a SEF with system safeguards violations" (release): Tradition SEF, ordered to pay US$875,000, had not adequately briefed its board "on the results of certain BCDR, technical risk, and penetration testing and assessments" (order). On 13 October 2026 the CFTC published an advance notice asking how system safeguards should apply to blockchain-based markets, noting that "open source software underlying many blockchain systems may have greater cybersecurity vulnerabilities" (91 FR 64811).

This ranking is for mid-market and enterprise market operators: DCMs including prediction markets, swap execution facilities (SEFs), derivatives clearing organizations (DCOs), swap data repositories (SDRs), SCI entities such as exchanges and clearing agencies, and futures commission merchants. Broker-dealers and their retail trading apps are covered in our wealth management ranking, crypto exchanges in our crypto ranking.

Quick answer. The best penetration testing companies for exchanges, clearing houses and trading platforms in 2026 are Stingrai, NCC Group, Kroll, IOActive, NetSPI, Mandiant, Pen Test Partners, CyberCX, Praetorian, Protiviti and GuidePoint Security. Stingrai ranks first: a CREST-accredited, Toronto-headquartered firm whose named penetration testers run the external and internal tests the CFTC rules define as separate test types, as an outside firm, with the retest included and an attestation letter with every human-led and hybrid report, as a one-time annual test or a continuous program. NCC Group adds threat-led accreditations, and IOActive has published trading-platform research.

What drives a penetration test at an exchange, clearing house or trading platform

For these market operators, four CFTC sections and SEC Regulation SCI name penetration testing; quotes come from the eCFR, current to 8 October 2026.

Designated contract markets and the covered-DCM threshold

Section 38.1051(h) requires "regular, periodic, objective testing and review" of automated systems, including external penetration testing, "attempts to penetrate the designated contract market's automated systems from outside the systems' boundaries to identify and exploit vulnerabilities", and internal testing "from inside the systems' boundaries". A covered DCM, one whose volume "is five percent (5%) or more of the combined annual total trading volume of all designated contract markets", must run both at least annually, test for vulnerabilities quarterly, have key controls tested independently every three years, and "engage independent contractors to conduct the required annual external penetration test". Volume means "the total number of all contracts traded" (38.1051(n)(1)); the CFTC gives each DCM its share by 28 February, and coverage ends only after three consecutive years below 5%.

For every DCM, the scope must reach what "could enable an intruder or unauthorized user or insider to" disrupt operations or "add to, delete, modify, exfiltrate, or compromise the integrity of any data" (38.1051(k)); senior management and the board "shall receive and review reports" of the results (38.1051(l)); and each vulnerability needs a documented decision "whether to remediate or accept the associated risk" (38.1051(m)).

Swap execution facilities

Section 37.1401(h) requires the same test types "at a frequency determined by an appropriate risk analysis", by independent contractors or employees "not responsible for development or operation of the systems or capabilities being tested".

Clearing organizations and swap data repositories

Sections 39.18(e) and 49.24(j) set minimums for every DCO and SDR: external and internal penetration testing "no less frequently than annually", quarterly vulnerability testing, independent key-controls testing every three years, and independent contractors "to conduct the required annual external penetration test". For DCOs, 39.18(d)(3) applies testing to "own and outsourced resources" and, where an independent contractor is required, requires one "independent from both the derivatives clearing organization and any outside service provider used to design, develop, or maintain the resources being tested".

SCI entities under Regulation SCI

SCI entities include national securities exchanges, registered clearing agencies, alternative trading systems above equity trading volume thresholds, plan processors and exempt clearing agencies subject to ARP (242.1000). Each runs an annual SCI review, but "[p]enetration test reviews of the network, firewalls, and production systems shall be conducted at a frequency of not less than once every three years" (242.1003(b)(1)(i)). Security policies also cover indirect SCI systems, those that "if breached, would be reasonably likely to pose a security threat to SCI systems" (242.1000, 242.1001(a)).

The SEC proposed in April 2023 "to require annual penetration testing", saying it had set three years in 2014 "because of the costs associated with penetration testing at the time" (88 FR 23146). A notice published on 17 June 2025 withdrew it: the SEC "does not intend to issue final rules" and would "issue a new proposed rule" for any future action (90 FR 25531). No new Regulation SCI proposal had been published by 13 October 2026, so the three-year floor stands.

Prediction markets

The CFTC's March 2026 advance notice says "A prediction market which offers swaps or futures contracts for trading by the general public must register with the CFTC as a designated contract market (DCM)", and asks whether there are "challenges to the reliability, security or scalable capacity of the systems used by prediction markets" (91 FR 12516). As of 13 October 2026, its DCM list shows Kalshi designated in November 2020 and QCX LLC, now Polymarket US, in July 2025, plus six designations and eleven pending applications dated 2026 across all DCM types.

Polymarket's US operator lists a DCM, Polymarket US, and a DCO, Polymarket Clearing, and says "Both entities are regulated by the Commodity Futures Trading Commission (CFTC)" (QCEX), so 39.18's annual minimums reach the clearing side. Covered status counts contracts, not dollars, and Kalshi says each contract "is worth $1 if you are right" (Kalshi), so an event-contract exchange should check its February share rather than assume it falls below 5%.

Futures commission merchants

The CFTC withdrew its 2024 operational resilience proposal for futures commission merchants (FCMs), swap dealers and major swap participants as of 8 September 2025 (90 FR 43949). NFA Interpretive Notice 9070 asks members for a program review "at least once every twelve months" that, "Under appropriate circumstances", "may include penetration testing of the firm's systems".

What CFTC and SEC enforcement says about testing

• A material change needs a test. CX moved to the cloud, yet no internal or external penetration test ran "between June 2019 and May 2021".

• Outsourcing does not move the obligation. CX's provider ran its IT and wrote a 2020 risk assessment that "identified only three risks applicable to CX"; the violations were CX's.

• The board has to see the results. CX's board saw no testing results from 2017 to 2020; Tradition SEF gave "some test results to individual Directors" but not the full board, a 37.1401(l) violation (order).

• Remote access sits in scope. In a US$10 million SEC order, a zero-day intrusion into a VPN concentrator, a device giving staff access to "ICE's corporate network, and indirectly ICE SCI Respondents' systems", was a systems intrusion that ICE's SCI subsidiaries failed to notify the SEC of, as Regulation SCI requires (order).

What mid-market and enterprise market operators need from a vendor

• Independence in writing. A statement that the firm does not develop, operate or maintain the systems it tests (38.1051(h), 39.18(d)(3)).

• Both boundaries, reported separately. In Stingrai's State of Penetration Testing 2026 data, 92% of internal network findings were High or Critical (408 findings, 8 tests), against 48% for external networks (23 findings, 6 tests).

• A scope traced to the rule. Matching, market data, clearing and settlement, member portals and APIs, surveillance, Active Directory, remote access and cloud.

• Board-ready results and a retest. A summary the board can review, a remediate-or-accept record and a retest report.

• Capacity for material changes. Migrations and new venues between annual tests.

• Threat-led testing. Groups with EU venues may face DORA tests (DORA guide).

• Contracting entity. CREST accreditation is held per legal entity (how to check).

How this ranking was built

Every vendor claim traces to the vendor's own website or CREST Marketplace profile, checked on 13 October 2026. The first two criteria were gates; the other three were weighed.

1. Both boundaries: external plus internal testing, Active Directory or lateral movement on the firm's own site.

2. Checkable qualification: CREST Penetration Testing accreditation for an entity matching the firm's website.

3. Market-infrastructure fit: trading, exchange, clearing, threat-led financial testing or US financial-rule material.

4. North American presence: a US or Canadian office counts in a firm's favour.

5. Usable evidence: retesting, board-level reporting and remediation records.

At a glance: penetration testing companies for market operators

1. Stingrai (top rated for exchanges, clearing houses and trading platforms)

Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.

For a market operator, the case is independent, named testing on both sides of the boundary. Stingrai Inc, the company that signs the contract, holds the CREST Penetration Testing accreditation (Marketplace profile). Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner. The team has 18 published CVEs and Hall of Fame listings at the US Federal Reserve and the US Department of Defense, and Stingrai is rated 5.0 out of 5 on Clutch (20 reviews).

Scope for a CFTC or Regulation SCI test

• External: the external network, remote access, and web applications and APIs such as member portals, tested across every user role for broken authorization and IDOR.

• Internal: the internal network, segmentation between corporate and production systems, and Active Directory privilege paths from an assumed-breach position, with purple teaming to show what your SOC saw.

• Cloud, mobile and people: cloud accounts, mobile trading apps, phishing and vishing, and red teaming.

Delivery and evidence

Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept and prioritized remediation guidance. Retesting is included, and every human-led and hybrid report ships with an attestation letter. Enterprise engagements add a high-level management report and an executive post-remediation report.

Where Snipe fits

Snipe is Stingrai's autonomous AI agent for web applications and associated APIs only. Trained on more than 6,000 HackerOne Hacktivity reports, it hunts IDOR, broken authorization and business logic flaws and opens AutoFix pull requests. The Autonomous Pentest is Snipe alone, with no penetration testers; in the Hybrid Pentest, Snipe and penetration testers test together, with the testers directing its focus. Everything else is human-led.

Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). A market operator's full scope is quoted through get a quote. Best for: DCMs, SEFs, DCOs, SDRs and SCI entities that want the annual external and internal tests from named, certified testers at a CREST-accredited outside firm, with the retest built in, as a one-time annual test or a continuous program.

2. NCC Group

NCC Group is headquartered in Manchester, UK; its office list names Chicago as a regional headquarters and an office in Waterloo, Ontario. Its Marketplace entry holds ten CREST accreditations, including Penetration Testing and TLPT-FS Threat Led Penetration Testing, and says its team can support organisations "through DORA TLPT". Its Part 500 guide describes "independent testing of external, internal, cloud, and application environments", reporting for "board-level oversight" and "optional retesting".

Best for: exchange groups whose UK or EU venues face CBEST, TIBER-EU or DORA tests.

3. Kroll

Kroll's About page says "Kroll Is Headquartered in New York", at One World Trade Center. Its Marketplace entry, Kroll LLC, holds Incident Response, Penetration Testing and Security Operations Centre accreditations. Its datasheet lists internal and external network testing, red teaming and continuous testing, and names the Securities & Exchange Commission among its staff's former agencies. Testing and incident response sit in one accredited entity.

Best for: New York operators that want testing and incident response from one accredited entity.

4. IOActive

IOActive has worked "since 1998" (who we are), and its contact page lists its headquarters in Seattle. Its August 2018 study of brokers' mobile, desktop and web trading platforms found that "mobile apps for trading are less secure than the personal banking apps reviewed in 2013 and 2015", and that for FIX, used "by a majority of exchanges and traders", "the binary version in cleartext was mostly seen". Its red team page describes "a foothold on an internal workstation". Its Marketplace entry, IOActive Inc, lists Penetration Testing with a UK head office.

Best for: trading platforms and retail apps that want testers who have studied trading software.

5. NetSPI

NetSPI is headquartered in Minneapolis with an office in Toronto (contact) and has worked "since its inception in 2001" (home page). Its network testing page offers external and internal network penetration testing, and its mainframe testing covers z/OS and "RACF/TopSecret/ACF2 configurations", calling mainframes "the backbone that keeps our financial systems and other critical industries running". Its Marketplace entry lists Penetration Testing and Threat Led Penetration Testing. Its merger with Synack "officially closed in October 2026" (NetSPI).

Best for: clearing and settlement operators with mainframe estates.

6. Mandiant

Mandiant is part of Google Cloud. Its testing page offers an "External or internal penetration test" using "the internet or simulated malicious insider", and its red team assessment draws on attacker techniques "found in incident response engagements". Its Marketplace entry holds Incident Response, Penetration Testing, Threat Led Penetration Testing and TLPT-FS accreditations, lists CBEST, STAR-FS and TIBER-EU services, and gives an Ireland head office.

Best for: operators that want threat-led testing and incident response from one team.

7. Pen Test Partners

Pen Test Partners has worked "since 2010", lists its UK office in Buckingham and a US office, Pen Test Partners Inc, at 115 Broadway in New York, and calls itself "one of the founding members of the CREST scheme" (About). Its testing page lists internal and external infrastructure testing and names finance among its sectors, and it offers red teaming for CBEST, STAR-FS and TIBER. Its Marketplace entry, the UK company, holds seven accreditations, including TLPT-FS.

Best for: US arms of UK and EU groups that also run CBEST or TIBER tests.

8. CyberCX

CyberCX, "part of Accenture", describes itself on its US site as a provider "across the United States, United Kingdom, Australia and New Zealand", with headquarters in Melbourne (contact) and a US office at 230 Park Avenue in New York (US contact). Its US penetration testing page lists external and internal network testing, and it runs CORIE exercises, "a regulatory framework introduced by the Australian Council of Financial Regulators". Its Marketplace entry, CyberCX Pty Ltd, holds Incident Response, Penetration Testing and Security Operations Centre accreditations with an Australian head office.

Best for: groups in the US and Australia that want testing and regulator-framed red teaming together.

9. Praetorian

Praetorian "was founded in 2010" (newsroom) and is headquartered in Austin, Texas (newsroom). Its penetration testing page describes "external and internal penetration testing" across "systems, Active Directory, and network infrastructure", and its home page pitches its Guard platform as consolidating "Annual Penetration Tests into a single Platform" and lists NYDFS and MAS TRM among the annual test requirements it says it satisfies. Its Marketplace entry lists Penetration Testing.

Best for: operators that want the annual test inside a continuous program on the vendor's platform.

10. Protiviti

Protiviti, a consulting firm that datelines its releases from Menlo Park, California, lists a New York office at 888 7th Avenue (locations). Its attack and penetration page covers red teaming, network penetration testing and social engineering, with a methodology that includes "exploitation, privilege escalation and lateral movement". Its regulatory compliance team includes former "financial regulators" and helps clients "respond successfully to enforcement actions and consent orders". Its Marketplace entry lists Penetration Testing with a United Kingdom head office.

Best for: operators that want testing alongside remediation advice after an examination finding.

11. GuidePoint Security

GuidePoint Security lists its headquarters in Reston, Virginia and an office at 250 West 34th Street in New York (contact). Its penetration testing page covers "internal or external networks, applications, cloud, ICS, security awareness or facilities" with "controlled exploitation, detailed evidence and concise reporting", plus a PTaaS platform and purple and red team assessments. Its Marketplace entry lists Penetration Testing.

Best for: enterprises consolidating security partners that want a Manhattan office.

Also considered

Accenture holds ten CREST accreditations, and its capital markets page offers to "Optimize exchanges, clearing houses, central securities depositories, and custodians"; we ranked CyberCX, part of Accenture, which lists external and internal testing on its site. Coalfire passes both gates, with a datasheet covering "external, internal, cloud, or hybrid topologies", and ranks in our NYDFS guide. Trail of Bits, Include Security, Atredis Partners, Leviathan Security Group and Doyensec had no entry among the 551 on the CREST Marketplace on 13 October 2026.

What a penetration test for a market operator costs

No CFTC or SEC rule sets a price; cost follows scope and the retest. Our cost guide and cost calculator turn scope into an estimate. Stingrai's fixed packages are the Autonomous Pentest at US$3,000 and the Hybrid Pentest at US$6,800 per assessment, each for one web application and associated APIs (pricing); a full market-operator scope is quoted. Compare quotes on independence and the retest (how to compare).

RFP questions for an exchange or clearing house penetration test

• [ ] Will you confirm in writing that you do not develop, operate or maintain the systems you test?

• [ ] Are external and internal tests scoped and reported as separate test types?

• [ ] How does the scope map to the outcomes in 38.1051(k), 39.18(e)(8) or 49.24(l)?

• [ ] Which legal entity signs and holds the CREST accreditation, and who are the named testers?

• [ ] Will you deliver a summary the board can review, and is a retest included?

• [ ] How fast can you test a material change such as a cloud migration, and is any work subcontracted?

Our RFP template turns these into a document.

Frequently Asked Questions

Who are the best penetration testing companies for exchanges, clearing houses and trading platforms in 2026?

The best penetration testing companies for exchanges, clearing houses and trading platforms in 2026 are Stingrai, NCC Group, Kroll, IOActive, NetSPI, Mandiant, Pen Test Partners, CyberCX, Praetorian, Protiviti and GuidePoint Security. Stingrai ranks first: named penetration testers run both tests as an outside firm, the retest is included, and every human-led and hybrid report ships with an attestation letter, as a one-time annual test or a continuous program.

Does the CFTC require penetration testing for designated contract markets?

Yes. Section 38.1051(h) requires every DCM to run external and internal penetration testing at a frequency set by risk analysis. A covered DCM must run both at least annually and use independent contractors for the annual external test.

What is a covered designated contract market?

A DCM whose annual trading volume, counted in contracts, is 5% or more of the combined volume of all DCMs. The CFTC gives each DCM its share by 28 February; coverage ends after three consecutive years below 5%.

Do clearing houses and swap data repositories need an independent penetration tester?

Yes for CFTC-registered clearing houses (DCOs) and SDRs: 39.18(e)(3) and 49.24(j)(3) require independent contractors for the annual external test, and a DCO's contractor must be independent of providers that design, develop or maintain the systems. SEC-registered clearing agencies instead need Regulation SCI penetration test reviews by "objective personnel having appropriate experience".

Does Regulation SCI require annual penetration testing?

No. Rule 1003(b)(1)(i) requires penetration test reviews of the network, firewalls and production systems at least once every three years, inside an annual SCI review. The SEC's 2023 proposal to require annual testing was withdrawn in June 2025, and no new proposal had been published by 13 October 2026.

Do prediction markets have to run penetration tests?

Yes. The CFTC says a prediction market offering swaps or futures to the general public must register as a DCM, so 38.1051 applies; one with its own clearing house also falls under 39.18's annual minimums.

What did the CFTC penalize CX Futures Exchange for?

The 2022 order found no controls testing, insufficient internal and external penetration testing (none in 2020, after a cloud migration), inadequate risk assessments and no board review of results. The US$6.5 million penalty also covered reporting and false-statement violations.

How much does a penetration test for an exchange or clearing house cost?

No rule sets a price. Stingrai's fixed packages are US$3,000 (Autonomous) and US$6,800 (Hybrid) per assessment for one web application and associated APIs; a full scope is quoted.

Related reading

• Wealth Management and Broker-Dealer Pentest Companies

• Crypto Exchange Pentest Companies

• NYDFS Pentest Companies

• CREST-Accredited Companies in the USA and Canada

• DORA Threat-Led Penetration Testing

• Chicago Pentest Companies

References

1. eCFR, 17 CFR 38.1051, 37.1401, 39.18 and 49.24, current to 8 October 2026. https://www.ecfr.gov/current/title-17/section-38.1051

2. eCFR, 17 CFR 242.1000, 242.1001 and 242.1003 (Regulation SCI). https://www.ecfr.gov/current/title-17/section-242.1003

3. SEC, Regulation Systems Compliance and Integrity (proposed), 88 FR 23146, 14 April 2023. https://www.federalregister.gov/documents/2023/04/14/2023-05775/regulation-systems-compliance-and-integrity

4. SEC, Withdrawal of Proposed Regulatory Actions, 90 FR 25531, 17 June 2025. https://www.federalregister.gov/documents/2025/06/17/2025-11110/withdrawal-of-proposed-regulatory-actions

5. CFTC, In the Matter of CX Futures Exchange, L.P., Docket No. 22-51, release 8603-22, 29 September 2022. https://www.cftc.gov/media/7801/enfcxfuturesorder092922/download

6. CFTC, In the Matter of Tradition SEF LLC, Docket No. 24-41, order of 30 September 2024; release 8989-24, 1 October 2024. https://www.cftc.gov/media/11411/enftraditionsefllcorder093024/download

7. SEC, In the Matter of Intercontinental Exchange Inc., et al., Release No. 100206, 22 May 2024. https://www.sec.gov/files/litigation/admin/2024/34-100206.pdf

8. CFTC, Prediction Markets (advance notice), 91 FR 12516, 16 March 2026. https://www.federalregister.gov/documents/2026/03/16/2026-05105/prediction-markets

9. CFTC, Regulation Crypto Asset Transactions and Regulation Crypto Asset Markets (advance notice), 91 FR 64811, 13 October 2026. https://www.federalregister.gov/documents/2026/10/13/2026-20888/regulation-crypto-asset-transactions-and-regulation-crypto-asset-markets

10. CFTC, Operational Resilience Framework for Futures Commission Merchants, Swap Dealers, and Major Swap Participants; Withdrawal, 90 FR 43949, 11 September 2025. https://www.federalregister.gov/documents/2025/09/11/2025-17555/operational-resilience-framework-for-futures-commission-merchants-swap-dealers-and-major-swap

11. CFTC, Industry Filings: Designated Contract Markets, read 13 October 2026. https://www.cftc.gov/IndustryOversight/IndustryFilings/TradingOrganizations

12. Operator statements: QCX LLC and Kalshi. https://qcex.com/ and https://help.kalshi.com/en/articles/13823766-what-are-prediction-markets

13. NFA, Interpretive Notice 9070. https://www.nfa.futures.org/rulebook/rules.aspx?Section=9&RuleID=9070

14. CREST Marketplace profiles and vendor pages linked in each entry, opened 13 October 2026. https://marketplace.crest.org/suppliers/

15. Stingrai, State of Penetration Testing 2026. https://www.stingrai.io/reports/state-of-penetration-testing-2026

Talk to Stingrai

Bring your last report and risk analysis. Stingrai will scope the external and internal tests your rule names, staff them with named penetration testers, post every confirmed finding the same day, retest the fixes and close human-led and hybrid engagements with an attestation letter, as a one-time annual test or a continuous program. Get a quote or see pricing.