How General Bank of Canada Validated Years of Security Investment Against Real-World Attacks
General Bank of Canada and its sister companies had spent years strengthening their cybersecurity posture. TrollEye conducted a multi-faceted Red Team assessment to determine whether technical, human, physical, and response controls could withstand a sophisticated threat actor.
The assessment used attack paths ranging from dark-web intelligence and phishing to external testing and physical breach attempts.
How General Bank of Canada Prevented a Simulated Physical Intrusion From Reaching Its Network
TrollEye tested whether believable pretexts, perceived authority, and urgency could persuade employees to bypass physical access procedures. The Red Team’s objective was to enter restricted areas and connect a rogue device to the organization’s internal network.
Employees consistently challenged unverified visitors and supported the access controls protecting restricted areas.
How General Bank of Canada Tested Its Response to an Insider-Led Compromise Before It Became Ransomware
TrollEye developed a custom tabletop exercise informed by the broader Red Team engagement. Executives, security, IT, risk, and compliance stakeholders worked through a realistic incident to evaluate detection, containment, recovery, communication, and executive decision-making.
The exercise progressed from compromised credentials and insider access through lateral movement and potential ransomware deployment.
Years of improvement still left one unanswered question.
Cyberattacks and breaches were creating growing financial and operational disruption across the financial sector. At the same time, cybersecurity regulations and expectations were becoming increasingly stringent.
General Bank of Canada and its sister organizations had already spent several years improving security. Technical controls had matured, awareness programs had expanded, and cybersecurity risk had become a prominent part of the organizations’ risk registers. As GBC explained, “We had undertaken significant efforts over several years to strengthen our security posture, and it was time to test the effectiveness of these measures.”
Leadership no longer needed confirmation that controls existed. It needed independent evidence that those controls would work together against a sophisticated attacker.
Individual controls did not reflect real-world attacks
Vulnerability scans and isolated assessments could identify individual weaknesses, but they could not evaluate how the entire security ecosystem would perform during a coordinated attack.
Sophisticated attacks cross multiple boundaries
A realistic threat actor could combine exposed intelligence, phishing, external access, physical intrusion, compromised credentials, and internal movement.
Detection and response also needed validation
Preventive controls were only part of the security posture. Leadership also needed to know whether suspicious activity would be detected, contained, escalated, and remediated.
Practical testing instead of theoretical confidence.
Leadership formed a joint committee across General Bank of Canada, First Canadian Insurance Corporation, and Millennium Insurance Corporation to determine the next step. GBC recognized that “theoretical security measures require practical testing against sophisticated attack scenarios to validate their effectiveness.” The committee determined that a specialist third party should conduct a comprehensive Red Team exercise and provide an independent, evidence-based view of how the entire security ecosystem performed under realistic attack conditions.
Technology could not protect the network if an attacker reached it physically.
Technical controls were only one part of GBC’s security posture. A determined attacker could avoid digital defenses entirely by entering a facility, reaching a restricted area, and connecting a device directly to the internal environment.
The organization had invested in access controls, physical security, and employee-awareness training. However, the effectiveness of those measures depended on how employees responded to believable social engineering under real-world conditions.
The assessment needed to determine whether staff would challenge perceived authority, verify unfamiliar visitors, and consistently enforce access procedures.
Familiar roles can lower suspicion
Customers, utility providers, internet technicians, and maintenance personnel all have plausible reasons to request access, creating opportunities for convincing impersonation.
Urgency can override established procedures
Fabricated work orders, service disruptions, and urgent maintenance scenarios can pressure employees to prioritize convenience or continuity over identity verification.
One successful entry could bypass digital defenses
Reaching the internal environment with a rogue device could provide an attacker with a foothold that external security tools were not designed to prevent.
A realistic test of people and physical controls.
The assessment needed to go beyond reviewing badge systems, surveillance, and documented visitor procedures. TrollEye would test all three locations using believable pretexts and determine whether employees could recognize suspicious behavior and prevent physical access from becoming network access.
A documented response plan had to work under real pressure.
Even strong preventive controls cannot eliminate every possibility of compromise. If credentials were stolen or an insider gained access, GBC needed confidence that its teams could identify the incident, contain it, and prevent further escalation.
Response readiness depended on more than the security team. Executives, IT, risk, compliance, communications, and business stakeholders could all be required to make decisions during a major incident.
The organization needed to validate whether those groups could coordinate their actions while managing technical, operational, financial, regulatory, and reputational consequences.
Technical events could escalate quickly
Compromised credentials and insider access could lead to lateral movement, privileged access, data exposure, operational disruption, and potential ransomware deployment.
Response crossed organizational boundaries
Security and IT teams could contain systems, but leaders across risk, compliance, communications, and the business also needed to manage escalation and impact.
Plans had not been tested against this scenario
Written procedures could not show how participants would interpret incomplete information, prioritize competing concerns, and coordinate decisions during a developing incident.
A realistic exercise built around its actual risks.
Rather than running a generic ransomware workshop, GBC needed a scenario informed by the wider Red Team engagement. The exercise had to challenge participants from initial compromise through containment and recovery while revealing how technical decisions and business decisions affected one another.
TrollEye tested the organization the way a real adversary would.
TrollEye designed a comprehensive Red Team exercise that evaluated the security ecosystem rather than testing individual controls in isolation.
Intelligence gathering informed the attack strategy, and multiple vectors were combined to determine how an attacker could move from publicly available information to human manipulation, external access, physical intrusion, and the internal environment.
The objective was to provide a realistic assessment of how GBC’s controls performed together under coordinated pressure.
Six attack vectors created one connected view of the security program.
Each activity supported the wider engagement instead of producing a series of disconnected reports.
Reconnaissance
TrollEye researched the organizations, facilities, personnel, vendors, and potential routes an attacker could use.
Dark-Web Analysis
Exposed information and intelligence were reviewed for data that could strengthen a realistic attack.
Phishing Campaigns
Targeted scenarios and lookalike infrastructure tested employee awareness and resistance to credential-based attacks.
External Testing
Internet-facing systems were assessed for routes into the environment and opportunities to chain weaknesses together.
Physical Intrusion
The Red Team attempted to bypass facility controls and reach the internal network using realistic social-engineering pretexts.
Internal Assessment
Internal access, rogue-device detection, lateral movement, and the response to simulated compromise were evaluated.
The assessment tested attack chains, not just individual weaknesses.
Many alternatives focused on isolated controls or relied heavily on automated scanning. TrollEye combined human expertise with technical, physical, and organizational testing to determine how weaknesses could be chained together and whether the organization could detect and respond to the resulting activity.
TrollEye turned plausible everyday interactions into realistic intrusion attempts.
TrollEye assessed all three locations through realistic physical penetration testing and social engineering.
The Red Team researched each facility, identified the types of visitors employees would reasonably expect, and developed believable pretexts supported by fabricated work orders and urgent service requests.
The objective was clear: gain unauthorized access to restricted areas and connect a rogue device to the internal network.
Each attempt tested whether employees would consistently enforce access procedures.
The scenarios reflected ordinary business interactions rather than obvious or theatrical attack attempts.
Research the Facilities
TrollEye studied each location, common visitors, local service providers, entry points, and plausible reasons for requesting access.
Assume Trusted Identities
Testers posed as customers and local electrical and internet providers using believable maintenance and service scenarios.
Attempt Restricted Access
The Red Team tested identity verification, visitor handling, employee awareness, restricted-area controls, and the ability to reach the network.
Technology, procedures, and employee judgment had to work together.
The test did not simply inspect doors, cameras, or badge systems. It evaluated how employees interpreted unfamiliar situations and whether they would challenge believable visitors despite urgency and perceived authority. That provided direct evidence that physical controls were supported by strong human behavior.
TrollEye transformed a realistic compromise into a cross-functional decision exercise.
TrollEye built a customized incident-response tabletop exercise informed by the wider Red Team engagement and the risks most relevant to GBC.
The scenario began with compromised credentials and an insider threat, then progressed through internal access, lateral movement, operational escalation, and potential ransomware deployment.
Executives, security, IT, risk, compliance, and business stakeholders had to interpret incomplete information, coordinate actions, and make decisions as the situation developed.
The scenario escalated from initial access to organization-wide consequences.
Each stage introduced new information and forced participants to reassess technical and business priorities.
Compromised Access
The exercise began with compromised credentials and an insider threat gaining access to the environment.
Lateral Movement
Participants assessed detection, investigation, segmentation, and containment as the attacker moved through the network.
Ransomware Escalation
The scenario introduced operational disruption, data risk, business-continuity concerns, and regulatory consequences.
Debrief and Improvement
Teams reviewed decisions, identified gaps, evaluated alternatives, and established practical response improvements.
Every team saw how its decisions affected the wider response.
Security and IT tested technical containment and recovery while executives and business stakeholders considered operations, communication, regulatory responsibilities, and organizational risk. The exercise connected those decisions so participants could practice incident response as one coordinated organizational process.
GBC established six objectives to define a successful assessment.
The Red Team engagement was designed around specific measures established by GBC. Together, they evaluated whether the organization could prevent, detect, and respond to realistic attack simulations across its people, facilities, and technical environment.
Prevent Unauthorized Physical Access
Determine whether physical security controls and employee procedures could prevent unauthorized entry into GBC facilities.
Detect External Penetration Attempts
Assess whether technical controls could detect and prevent attempts to compromise internet-facing systems and gain external access.
Evaluate Employee Phishing Awareness
Test how employees responded to targeted phishing campaigns and whether they recognized suspicious requests and credential threats.
Detect Rogue Devices on the Network
Determine whether GBC could identify an unauthorized device connected directly to its internal network.
Assess Exposure to Lateral Movement
Evaluate whether an attacker with initial access could move through the network, expand privileges, and reach additional systems.
Validate Incident Response Capabilities
Test whether teams could detect, contain, escalate, and remediate a developing security incident under realistic conditions.
Findings and response performance provided the evidence.
GBC evaluated the engagement through a classification system of critical, high, medium, and low findings together with the ability of its teams and controls to detect and respond to each simulated attack.
GBC gained a clearer view of how its defenses performed together.
The engagement gave GBC more than a collection of findings. It showed how people, technology, physical controls, and response processes behaved when placed under one coordinated, adversary-led assessment.
A connected assessment replaced isolated assumptions.
By combining reconnaissance, dark-web intelligence, phishing, external testing, physical intrusion attempts, and internal testing, GBC could evaluate whether weaknesses could be chained together and whether existing controls could interrupt a realistic attack.
Realistic Control Validation
GBC received evidence of how its controls performed when exposed to coordinated pressure rather than being reviewed individually.
Attack-Path Visibility
The organization could see how information, human behavior, technical access, and physical access might contribute to a wider attack chain.
Greater Security Confidence
The exercise helped GBC distinguish between controls that appeared effective on paper and those that held up during realistic testing.
The result was evidence leadership could use.
GBC gained a practical understanding of where its security program was resilient, where attack paths could emerge, and where future improvements would have the greatest value. The engagement turned testing into a broader assessment of organizational readiness rather than a conventional vulnerability report.
The test validated the strength of GBC’s physical security culture.
Employees consistently applied access procedures and prevented the Red Team from reaching restricted areas or connecting a rogue device to the internal network.
The Red Team was unable to complete its intrusion objective.
Across the tested locations, employees challenged believable visitors, followed verification procedures, and supported the technical and physical controls protecting the environment. The outcome validated both GBC’s security-awareness training and its investment in physical safeguards.
Restricted Access Protected
The Red Team was prevented from reaching the sensitive areas required to complete its simulated attack.
Employees Enforced Procedures
Staff members demonstrated awareness, exercised judgment, and challenged plausible social-engineering scenarios.
Training Was Validated
The results demonstrated that security-awareness investments were translating into effective behavior during realistic situations.
Security controls worked because employees supported them.
The exercise gave GBC direct evidence that its doors, procedures, visitor controls, and employee awareness operated as one protective system. Rather than assuming training had been effective, the organization was able to observe employees applying that training against realistic intrusion attempts.
GBC validated its ability to coordinate through a developing security incident.
The exercise brought technical teams, executives, risk, compliance, and business stakeholders into one escalating scenario, giving each group visibility into how its decisions affected the wider response.
The response process remained effective as the scenario escalated.
Participants worked through compromised access, insider activity, lateral movement, operational disruption, and potential ransomware. The exercise demonstrated strong user vigilance and an incident-response process capable of supporting detection, containment, and recovery decisions.
Detection and Escalation Tested
Teams practiced interpreting incomplete information and escalating concerns as the simulated compromise developed.
Containment Decisions Practiced
Security and IT evaluated investigation, segmentation, containment, recovery, and operational tradeoffs under pressure.
Cross-Functional Alignment
Executives and business stakeholders practiced coordinating technical, operational, regulatory, and communication responsibilities.
Incident response became a shared organizational process.
The exercise helped GBC validate more than its technical playbooks. It showed how teams would communicate, coordinate priorities, and make decisions when a cyber incident created business-wide consequences. That gave participants a shared understanding of their responsibilities before facing a real event.
Find out how your security program performs when everything is connected.
TrollEye combines human-led testing, technical validation, and realistic attack scenarios to reveal how weaknesses, controls, people, and response processes interact across your organization. See what holds up, what breaks down, and what deserves attention next.