Pen testing for financial services