Penetration testing for financial institutions