01 · The challenge
Long exposure windows
Annual, fixed-scope pentesting created a false sense of security, and generic scanner findings missed the business-logic flaws that represent real risk.
Case Study How Iberia Cards Uses Sara AI Pentesting to Stay Ahead of Modern Threats
Iberia Cards needed real risk reduction and the regulatory traceability the Bank of Spain requires. By combining the Synack Red Team with Sara AI Pentesting, it moved from point-in-time compliance exercises to continuous, intelligence-driven testing.
200,000+ Customers served
20+ years Under Bank of Spain regulation
Grey-box Authenticated testing of payment services, web apps and APIs
Board-ready Documented, reproducible evidence of risk
From annual audits to continuous validation
A once-a-year test could not keep pace with payment infrastructure that cannot afford gaps in coverage.
02 · The approach
Human depth plus AI frequency
Deep, human-led Synack Red Team engagements, with Sara AI Pentesting providing frequent validation between those cycles.
03 · The outcome
Risk reduction and compliance together
High-impact findings, reproducible evidence for leadership and full vulnerability tracking that supports Bank of Spain requirements.
Why annual testing was not enough
For a Credit Financial Institution under Bank of Spain regulation, security cannot be a check-the-box exercise. Customer data is core to the business, and regulatory traceability is non-negotiable.
CISO José Manuel Rivera García needed a program that could surface real risk, document it in a way regulators could follow and repeat often enough to keep pace with attackers.
AI made the need more urgent. He saw attacks become lower in volume but far better aligned with business logic, as adversaries gained tools that add organization-specific context to reconnaissance and exploitation.
The serious problems are always in the business logic. There’s always time to improve the perimeter later, but if you’re only testing once a year, you’re not finding what matters.
Human depth, AI frequency
The program focuses on customer-facing payment services and their web applications and APIs, both public and authenticated. A grey-box approach gives testers credentials, so they can test authenticated business logic directly.
Synack Red Team
Deep, human-led engagements that surface the high-impact, business-logic vulnerabilities automated scanners miss, with documented evidence that drives remediation.
Sara AI Pentesting
Frequent validation between deeper SRT engagements, adding coverage without significant cost or operational overhead. Iberia Cards first ran it on assets SRT researchers had already tested, to compare results directly.
“The real differentiator is not that it replaces the researcher model, but that it complements it. It enables more frequent testing at a reasonable cost and effort.”
From technical intuition to board-ready evidence
Rivera García does not report vulnerability counts to senior management. He reports documented risk with measurable business impact, tracked transparently in the Synack Platform from first finding to final fix.
The most valuable outcome wasn’t what they found, it was what it allowed me to do with it. For the first time I could go to senior management with a real case, not a hypothetical scenario.
With Synack I solve two problems simultaneously. Effective risk reduction, every vulnerability reported has real impact. And regulatory compliance. The platform allows me to maintain the traceability the regulator requires.
What keeps bringing me back to Synack is the convergence of three things you rarely find together: professionalism, breadth in vulnerability discovery, and real depth in findings.
José Manuel Rivera García
CISO, Iberia Cards
What Iberia Cards achieved
Found the risk scanners miss
Surfaced high-impact, business-logic vulnerabilities that automated scanners missed.
Gave leadership a real case
Turned technical findings into documented, reproducible evidence for executive and board-level conversations.
Kept regulatory traceability
Tracked every vulnerability from discovery through remediation in the Synack Platform, meeting Bank of Spain compliance requirements.
Made testing a recurring layer
Established Sara AI Pentesting as a recurring part of the annual security program, covering the time between deeper SRT engagements.
Built a continuous security validation model
Created a testing program that delivers risk reduction and compliance evidence at the same time, the model Rivera García now points to when advising other security leaders.
Questions about the Iberia Cards case study
Who is Iberia Cards?
Iberia Cards is a financial credit institution regulated by the Bank of Spain, with over 20 years of experience and membership in the IAG Group. It serves more than 200,000 customers and issues co-branded cards for individuals and businesses, linked to the Iberia Club and On Business loyalty programs.
Which Synack solutions does Iberia Cards use?
The Synack Red Team for deep, human-led engagements and Sara AI Pentesting for frequent validation between those cycles, with findings tracked in the Synack Platform.
How does Iberia Cards use Sara AI Pentesting?
As a recurring layer in its annual security program, validating risk between deeper SRT engagements. The team first ran Sara on assets SRT researchers had already tested to compare results, and its next step is testing with credentials, the same starting point the SRT uses.
What did the testing cover?
Customer-facing payment services and their web applications and APIs, both public and authenticated, tested with a grey-box approach so researchers could test authenticated business logic directly.
How does Synack support regulatory requirements?
Iberia Cards tracks each vulnerability from discovery through remediation in the Synack Platform. This keeps tracking transparent and auditable and gives the team the traceability the Bank of Spain requires.
Get the Iberia Cards case study
Read the full five-page story of how a Bank of Spain regulated institution combined human-led and AI pentesting to validate real risk across its payment infrastructure.
