Practical cybersecurity guidance for African organisations.
How to write a VAPT RFP or tender that selects a real penetration test: scope, vendor requirements, evaluation grid, timeline and a copy-paste checklist.
Our guide to penetration testing across Africa: the threat reality, the regulators in Nigeria, Ghana and South Africa alongside Rwanda and Kenya, manual VAPT compared with automated scanning, and how to choose a provider.
A mobile-money-dominated market, CBK guidance, the Data Protection Act and ODPC, SACCOs and fintech: what real penetration testing looks like in Kenya, and how to choose a provider.
AI fraud detection models in East African banks are themselves attack surfaces. How adversaries exploit them and what to do about it.
How supply chain attacks through local vendors and integrators compromise African banks, with defence strategies and a vendor risk checklist.
Minimum security requirements for Rwandan fintech startups: common vulnerabilities, when to get your first pentest, a compliance roadmap and cost-effective security.
How to build a BNR-compliant incident response plan for your bank: IRP requirements, tabletop exercises, testing methodology and reporting.
Practical guide to PCI DSS compliance for Rwandan banks and payment processors. Level requirements, penetration testing, timeline, and costs.
Practical ransomware defense guide for African banks. Threat landscape, prevention controls, detection capabilities, recovery planning, and reporting.
Red team exercises vs penetration tests: the scope differences, when to use each, a maturity model for banks and a cost comparison.
How to assess and manage third-party vendor security risk in East African banking: assessment methodology, contractual requirements and ongoing monitoring.
A practical guide to BNR cybersecurity compliance for banks, MFIs and fintechs: Regulation N° 50/2022, the penetration testing mandate and the filing deadlines.
How to choose a penetration testing company in Kigali: what to check in methodology, certifications and reporting, the questions to ask before you sign, and the red flags.
What drives penetration testing pricing in Rwanda: scope, methodology, certifications and compliance, plus how to evaluate quotes.
The March 2026 fraud at a major Rwandan bank exposed gaps in vendor security, mobile money controls and transaction monitoring. What to review.
Cloud adoption in East Africa is growing faster than cloud security. The common AWS and Azure misconfigurations, and how to fix them.
How to achieve SWIFT CSP compliance in Rwanda: mandatory controls, security testing, penetration testing, and the attestation process.
ISO 27001 certification guide for Rwandan banks and fintechs: BNR Regulation N° 50/2022 alignment, penetration testing role, costs, and timeline.
Banking APIs are a prime attack vector for financial institutions. This post covers the OWASP API Security Top 10 and real findings from our lead tester's earlier banking assessments.
Why USSD banking services such as *182# need dedicated security testing, the vulnerabilities that come up most often and our testing methodology.
Mobile banking apps are the primary attack surface for African banks: what a security assessment covers, common findings, and how often to test.
How we test mobile money platforms (MoMo, M-Pesa, Airtel Money) for security vulnerabilities across USSD, apps, APIs and agent networks.
What a data breach costs an East African bank: direct losses, regulatory fines, reputational damage and the case for prevention.
What automated scanners and vulnerability assessments can and cannot find compared with manual penetration testing, and the testing cadence BNR sets for banks.
What the National Bank of Rwanda expects under Regulation N° 50/2022, from annual penetration testing and twice-yearly vulnerability assessments to vendor risk, and how to prepare for a BNR examination.
Cybersecurity across East Africa: the key threats, the regulatory frameworks in Rwanda, Kenya, Uganda, and Tanzania, and practical protection strategies.
Penetration testing in Rwanda: who needs it, what BNR Regulation N° 50/2022 requires, the credentials to verify, costs and choosing a provider.