Bluebank went to the discovery of vulnerabilities with 1.7 billion Tomans

The second Bluebank Bug Bunty event ended with the presence of cyber security researchers and the introduction of selected teams. At the closing ceremony, Blue managers talked about the group's plans to develop security assessments and strengthen digital banking infrastructure.

According to Ambassador Arjan, the second round of "blu Deep Dive 2026" event ended with the participation of 80 cyber security researchers in the main stage. During this period, among the 132 reports registered about the vulnerabilities of the Blue application, 19 reports were confirmed and three teams were also announced as the main winners. Before the start of the main stage, 1465 people had participated in the online Conquest of the Flag (CTF) competition.

Mohammadpur: Bagbanti was held this year with an invitation-based model

At the closing ceremony, Primah Mohammadpour, Chief Audit Manager of Blue Bank Saman, spoke about the difference in the structure of the second edition of Bagbanti Blue with last year's event. In this regard, Mohammadpour said: The first round of Bagbanti was held in public, but in this year's round, the participants entered the main stage after going through the initial selection and evaluation process.

He continued: This year's program was held in two parts. The first stage was dedicated to the CTF online competition or "conquering the flag"; A specialized competition in which participants must solve predefined security challenges within a specified time. Mohammadpour announced that 1,465 cyber security experts participated in this stage.

According to Bluebank's Chief Audit Officer, the main stage participants were selected from three groups: the winners of the CTF competition, influential researchers in the previous Bugbunty cycle and recognized experts in the cyber security community.

Finally, 80 researchers in the form of 25 teams made it to the bug bunting stage and reviewed the Blue application in two days. The result of these evaluations was the registration of 19 valid reports about application vulnerabilities; Reports confirmed after review by organizers.

Mohammadpour also announced the introduction of three selected teams due to the presentation of the most important security findings. Other eligible participants will also receive their prizes.

Referring to the change in the structure of the awards compared to the previous period, he said: The awards of the CTF department this year were considered to be gold.

Heydari: Security cannot be added after product development

At the closing ceremony, Reza Heidari, CEO of Bluebank Saman, emphasized the role of users' trust in the operation of a digital bank and said: Protecting customers' property is a responsibility beyond providing quick and easy services.

Referring to Blue's announcement about winning the trust of 28 million people, he considered this trust as an investment that requires continuous security measures to maintain it.

From the point of view of Blue's CEO, security should not become a limited step after product design and development. The continuous change of technology and the increasing complexity of cyber threats require that security considerations be taken into account from the beginning of the design and the reviews continue after the product is released.

Referring to the role of the responsible discovery of vulnerabilities in this process, Heydari emphasized: the researchers' reports gain practical value when they lead to a detailed investigation and elimination of the identified weaknesses.

He also pointed to the economic capacity of Bugbant programs and, citing the 2025 report of the HackerOne platform, put forward the figure of 81 million dollars for this field.

CEO of Blue pointed out: Users do not necessarily see technical reports and details of vulnerabilities, but the result of handling these reports should be reflected in the quality of information protection and their confidence when using banking services.

Heydari also emphasized on the continuation of the bugbanti program and said: this approach means accepting the identification of security weaknesses as part of the product development process; Instead of the discovery of a vulnerability being seen only as a costly issue or a threat to the credibility of the collection.

Ghazanfari: The scope of Bugbunty Blue goes beyond the application

Jamal Ghazanfari, the vice-chairman of Bluebank Saman's board of directors, spoke about the necessity of accompanying the development of banking technologies with the strengthening of security infrastructure during the closing ceremony of the Bagbanti event. He considered the development of technology as an opportunity to increase the agility of banking operations and improve the customer experience, but maintained the trust of users as the basic condition for continuing this path.

Ghazanfari explained, referring to the programs proposed after the first round of Bugbunty: Blue plans to expand the scope of this program to more parts of the platform. Public and non-public APIs are among the parts that are included in the security assessment development program of this collection.

API or application programming interface provides the possibility of communication between software and data exchange between different services. In digital financial services, access control, request management and protection of exchanged information are among the important security considerations of these interfaces. Therefore, extending assessments to APIs can expose more parts of the infrastructure to independent review by experts.

Ghazanfari also pointed to developments in the field of quantum computing and post-quantum technologies and said: progress in this field can affect some common encryption methods in the future and increase the necessity of planning to maintain the security of systems against new threats.

Finally, Blue's announced program moves away from an application-only focus toward a broader evaluation of platform components. Achieving this goal depends on the continuous execution of tests, careful review of reports and timely fixing of valid vulnerabilities.

cyber security panel; From artificial intelligence agents to bank resilience

After the words of the managers of Blue, the specialized panel "security risks of using artificial intelligence; From data protection to control of autonomous agents" was held. In this meeting, Esmail Molla Ahmadi, Chief Security Officer of Blue, Saeed Kazemi, Chief Security Officer of Tapsi, and Vahid Khodabakhshi, CEO of Kashif, discussed the changing pattern of cyber threats and digital service protection solutions.

Referring to the experience of two Bugbunty Blue courses, Mulla Ahmadi considered this program as one of the tools for identifying vulnerabilities and strengthening the performance of the security team.

He emphasized: The implementation of Bagbanti alone is not enough to eliminate all security weaknesses and it should be placed alongside a series of continuous measures.

Blue's chief security manager talked about the idea of holding security competitions with the participation of artificial intelligence agents and said: This idea was proposed at the design stage of this year's competition, and Blue plans to investigate the possibility of holding such a competition in the future.

Mulla Ahmadi also announced the preparation of a page for receiving vulnerability reports, which has not yet been published due to the recent conditions of the country.

Agents of artificial intelligence and the necessity of restricting access

In this panel, Saeed Kazemi, Chief Security Officer of Topsy, pointed out the change in the way users interact with applications and said: With the development of smart agents, users can leave a specific task to the system instead of performing a set of steps manually. In addition to facilitating the provision of services, such a feature creates new security considerations; Especially when the intelligent agent has access to personal information or different capabilities of a service.

He considered restricting the access of chatbots and intelligent agents as one of the security requirements of these tools. Based on this, the access of each agent should be limited to the required information and operations and it should be possible to control its activity.

Also, in response to a question about the possibility of jailbreaking of the chatbots of this collection, the chief security manager of Tapsi said: No report has been received in this regard so far.

Khodabakhshi: Intrusion detection and service restoration are important

In another part of the panel, Vahid Khodabakhshi, the CEO of Kashif, emphasized the importance of increasing the resilience of organizations against cyber attacks. From Khodabakhshi's point of view, security defense is not only limited to preventing intrusion; Organizations must be able to detect an attack, mitigate the scope of damage, and restore services to normal in the shortest possible time.

Referring to the experience of some cyber incidents, Khodabakhshi said: In some cases, the intrusion happened several months before the final identification. Such a gap between the occurrence of an intrusion and its discovery can provide more opportunity to expand the attacker's access and increase the damage.

He also explained: The attack on the banking infrastructure is not done only with the aim of directly withdrawing money. Disrupting services that users depend on can also be a target for attackers. For this reason, service continuity and the ability to recover after an incident are important, along with the prevention and detection of threats.

Cancellation of international certificates; The challenge of trust in banking services

Another axis of the panel was dedicated to the limitations of international security certificates. Khodabakhshi explained in this regard: Some foreign exporters of security certificates have limited the provision of services to parts of Iran's banking network, citing sanctions related to the US Office of Foreign Assets Control (OFAC) and the European Union.

According to Khodabakhshi, in some cases security certificates have been invalidated before the end of validity, and the groups involved have turned to exporters from other countries to replace them. However, it is not just about providing a replacement certificate; Acceptance of the certificate by browsers and users' confidence in its validity is also important.

Kashif CEO explained: SSL/TLS certificates play a role in encrypted communication and authentication of websites. When the browser cannot verify the validity of the certificate, it may show the user a security warning. These warnings can make access to services difficult and affect customer confidence.