Penetration Testing in Hong Kong After the New Cybersecurity Law
Hong Kong’s first dedicated cybersecurity law came into force on 1 January 2026, and with it the operators of the city’s critical infrastructure took on statutory duties to assess, audit and secure the computer systems that keep essential services running. The timing reflects what the city has been facing. Hong Kong Police detected more than 1.54 million pieces of cyber threat intelligence aimed at Hong Kong in 2025, and the largest share, 34%, related to system vulnerabilities rather than phishing or reconnaissance, while HKCERT handled a record 15,877 security incidents, around 27% more than the year before. The law applies to a defined group of operators, but the weaknesses it is designed to close run through every organisation connected to them, from the law firms and financial institutions that hold their data to the suppliers that host and manage their systems. This is a look at what finding and testing those weaknesses actually involves.
What the New Law Actually Requires
The Protection of Critical Infrastructures (Computer Systems) Ordinance (Cap. 653) places obligations on operators that the government designates across sectors such as energy, banking and financial services, transport, healthcare, telecommunications and information technology. Those operators must maintain a security management plan for their critical computer systems, carry out a risk assessment of those systems every year, arrange an independent security audit at least once every two years, and take part in security drills, with a new Commissioner’s Office overseeing compliance. Vulnerability assessment and penetration testing are among the practical ways operators are expected to show that the risk assessment and audit reflect how their systems would actually hold up under attack, rather than how they look on paper.
Why It Reaches Further Than the Operators
A critical infrastructure operator rarely runs every system itself. Hosting, software, payment processing, client portals and outsourced IT all sit with third parties, and HKCERT named supply chain and third-party weaknesses as one of the main risks facing Hong Kong organisations in 2026. As operators work through their own obligations, the natural next step is to ask the companies they depend on for evidence that their systems have been independently tested, in the same way that insurers and auditors increasingly do.
The same exposure exists well outside the regulated sectors. A law firm holding client files, a hotel group processing guest and payment data, or a business that built a booking system quickly on a cloud platform is reachable in exactly the same way as a utility, and the Police figures suggest that the people scanning Hong Kong’s systems are looking for vulnerabilities first. None of these organisations need a statutory duty to have a reason to know what an attacker would find.
A Scan Is Not a Test
The two terms are often used as if they mean the same thing, and the difference matters when deciding what to commission. A vulnerability assessment is a technical review of networks, servers and applications that identifies known vulnerabilities, outdated software and weak configuration, with every finding ranked by risk so the team knows what to fix first. It answers the question of what is wrong.
A penetration test goes a step further by testing the weaknesses under controlled conditions to show which of them are a real risk and how far an attacker could get, both from the internet and from inside the network, where the threat may be someone who has already got in or someone who works for the organisation. It answers the question of what those weaknesses would allow. Most organisations begin with an assessment, and a test follows once they know where to look.
Where an Engagement Begins
Because Futurum’s background is in intelligence and investigations, an engagement starts where an attacker would, with what can be learned about the organisation from the outside: the domains and services it exposes, the staff and suppliers associated with it, and the information already in circulation about how it operates. That picture shapes where the testing goes, so that effort is spent on the routes someone would realistically try rather than on a generic checklist.
Every test is authorised in writing and carried out under signed Rules of Engagement that set out exactly what will be tested, when, and by whom. Where systems are hosted or managed by a third party, their permission is arranged as part of agreeing the scope. Nothing that could take systems offline is used, and testing stops if a system shows any sign of strain.
Choosing the Depth
Every service is offered at three levels. An Essential engagement identifies and ranks the vulnerabilities and configuration weaknesses in a system, and suits smaller environments and first assessments. A Standard engagement carries out controlled testing of selected weaknesses to confirm which pose a real risk, which suits established businesses and organisations whose customers, insurers or auditors want evidence that testing has been done. An Advanced engagement is a full, scoped test that links weaknesses together and follows realistic attack paths to show what an attacker could achieve, and its report is independently reviewed before it reaches the client. A retest is included at every level, so that fixes can be shown to have worked.
Question Worth Asking Before Commissioning a Test
The first is where the systems actually sit. Testing rules depend on where systems are hosted as well as where a company is registered, and some jurisdictions in the region, Singapore among them, require penetration testing providers to hold a local licence, so the location of every system in scope should be confirmed before work begins. The second is who the report is for. A board needs to understand what each finding would mean for the business, while an IT team needs the evidence and the steps to fix it, and a useful report serves both. The third is what happens after the report is delivered, because a list of findings without a retest leaves the organisation unable to show that anything has changed.
For operators now working under the new law, and for the many organisations connected to them, the value of a test lies less in the report itself than in the conversation it allows: a clear, evidenced account of where the organisation is exposed, what to fix first, and proof that the fixes have held.
