Bank Negara Malaysia's RMiT framework is explicit on one point that organisations sometimes overlook: penetration testing must be conducted by independent, qualified assessors. This article explains why that requirement exists and what genuine security assurance looks like.
The Explicit Independence Requirement
RMiT specifies that penetration tests must be conducted by independent, qualified assessors — meaning internal IT teams cannot simply test their own systems. Malaysian financial institutions must engage a qualified third-party VAPT provider. This is not a suggestion within RMiT; it is a defining characteristic of compliant testing.
Why Independence Is Required
The rationale for independence is sound. A team that builds and operates a system shares the assumptions that shaped its design — including the blind spots. The engineers who implemented an access control are not always best positioned to discover how it can be bypassed, because they tend to test that it works as intended rather than probing how it can be made to fail. An independent assessor approaches the system as an external attacker would, without those preconceptions.
There is also an accountability dimension: independent testing provides objective, third-party evidence of control effectiveness that a regulator can trust during examination, in a way that self-assessment cannot.
Why Qualified Human Expertise Matters
Independence addresses who tests; qualification and methodology address how. A penetration test goes well beyond automated scanning. A qualified ethical hacker uses the same techniques as real attackers — actively attempting to exploit vulnerabilities, bypass controls, escalate privileges, and access sensitive data. This human-led approach is what distinguishes a genuine penetration test from a vulnerability scan.
The vulnerabilities that lead to the most serious breaches — authorisation flaws, business-logic abuse, chained exploits — cannot be found by pattern-matching tools alone. They require qualified testers who understand how a system is meant to work in order to discover how it can be subverted.
Avoiding the Common Scoping Gap
A frequent RMiT shortfall is testing only internet-facing systems while skipping internal networks and the application layer. Genuine assurance requires comprehensive scope. An independent, qualified provider with a rigorous methodology covers external and internal attack scenarios and tests the application logic where the most damaging vulnerabilities often hide.
How Simuna Infosec Helps
Simuna Infosec is an independent, qualified security specialist whose human-led methodology directly meets RMiT's independence and competence expectations. Our certified offensive security experts test manually against real-world attack techniques across internet-facing systems, internal networks, and the application layer — closing the common scoping gap — and our dual-round model verifies that remediation holds. For Malaysian financial institutions, we provide the independent, comprehensive, examination-ready testing that RMiT requires.
*This article reflects publicly available information as of mid-2026 and describes general security testing principles. Consult the current RMiT policy and qualified legal counsel for compliance decisions.*