CORIE Framework

CORIE (Cyber Operational Resilience Intelligence-led Exercises) is the Council of Financial Regulators' framework for testing Australia's financial sector the way a sophisticated threat actor would: an intelligence-led red team exercise against an institution's Critical Business Services, covering technology, personnel and incident response, and simulating the techniques of nation-states, organised cybercrime and advanced persistent threats.

Banks, insurers and payment providers mandated by the Council of Financial Regulators, along with financial institutions that want to enhance resilience against advanced persistent threats ahead of any mandate.

It follows the CORIE-mandated engagement lifecycle: threat intelligence and reconnaissance, initial compromise, persistence and lateral movement, impact and objective execution, then post-engagement review and uplift.

The functions that, if disrupted, would significantly impact the confidentiality, integrity or availability of core financial systems. Identifying and prioritising them is part of the engagement, and their resilience is tested during objective execution.

A CORIE exercise assesses the end-to-end security posture of the organisation, targeting technology, personnel and incident response capabilities, rather than testing a defined system. It is intelligence-led and tailored to the attack paths facing financial institutions.

Yes. We field the team structure the framework specifies. Our founders have delivered CBEST engagements in the United Kingdom, the intelligence-led framework CORIE was modelled on, and have led red team exercises against major Australian banks and ASX-listed organisations. Exploit development is held by consultants certified OSEE and OSED who have discovered and disclosed previously unknown vulnerabilities in commercial software from Hexagon, VMware and Commvault. SilentGrid is a CREST ANZ approved company.

Named before you sign, not after. The CORIE framework specifies a Red Team Lead, a Red Team Specialist and an Exploit Development Specialist. Our exploit development capability is held by consultants certified OSEE and OSED who have discovered and disclosed previously unknown vulnerabilities in commercial software from Hexagon, VMware and Commvault. Credentials across the delivery team include OSEE, OSCE3, OSEP, OSWE, GXPN, CRTO, CRTE, CRTP and OSCP, and every consultant is listed publicly on our team page.

Through a specialist intelligence partner, managed by us. We think that is the right structure rather than a compromise: the targeting package is produced by dedicated analysts instead of by the operators who will execute against it, which keeps the intelligence honest about what a real adversary would find. Ask any provider claiming in-house intelligence who the analysts are and what they do between engagements.

Through a Control Group: a small, named set of people at your organisation who know the exercise is running, agreed before it starts. Defenders are not told. Communications with the control group run out of band, away from the systems in scope, so an exercise is not revealed by the response to it. Deconfliction procedures let the control group confirm within minutes whether an alert is us or a real intrusion.

Yes, and they are in scope where the threat scenario justifies them. Social engineering is delivered in person, over video calls, and via email, SMS, voice and social media. Physical intrusion is scoped separately with written authorisation, since it carries obligations that email-based phishing does not.

Yes. SilentGrid is a CREST ANZ approved company, listed on the CREST ANZ approved companies register. Worth noting for procurement: CREST approval is not the same as CORIE capability, and the Council of Financial Regulators does not treat one as evidence of the other. CORIE is intelligence-led and built around adversary objectives rather than vulnerability discovery, so evaluate the two separately.

An attack execution report documenting red team activity step by step with actionable recommendations, a board-level executive summary, tactical uplift workshops with a custom remediation roadmap, and a Critical Business Services analysis.