Member data and payment authorities in one place. APRA's watching.
As an RSE licensee, you hold concentrated member data, payment authorities, and beneficiary information — and you've been in APRA's focus since the 2025 credential-stuffing and account-takeover wave. CPS 234 applies equally to you as to the major banks. CPS 230 adds tested critical operations resilience. FAR extended to superannuation in March 2025, placing personal exposure on the accountable person responsible for information management and IT systems.
Your specific challenges
Credential stuffing is the proven vector
The 2025 wave of super fund attacks was credential-stuffing and account takeover. Members reuse passwords across services. The attack path is well understood and actively being used against the sector.
Same rules, smaller security teams
CPS 234 applies equally to a $300B fund and a $30B fund. But the security team, pentesting budget, and tripartite response resources are not proportional.
APRA's focus has sharpened
After the 2025 credential-stuffing attacks, APRA told RSE licensees to self-assess their authentication controls against CPS 234 by 31 August 2025, and required a special-purpose engagement from directly affected funds.
Built for your situation
Staff credential exposure
AD Password Audit finds weak, breached and reused staff passwords in Active Directory and shows how far each one reaches. Phishing Impact Testing proves what a phished staff login can reach.
Member portal and API validation
External pentesting tests the internet-facing footprint behind member portals and integrations, NodeZero WebApp Pentesting (launched July 2026) tests the applications themselves, and cloud pentesting covers the AWS or Azure environment they run on.
Evidence for the accountable person
FAR requires accountable persons to take reasonable steps within their responsibilities. Continuous testing records give them a dated, factual basis for what was tested and fixed.
Test what a stolen credential could reach
See how NodeZero tests the controls behind CPS 234 in your environment