Why third-party cybersecurity assessments matter for iGaming operators, technology providers, and the partners connecting them
By Jamie Garcia, Director of Regulatory Security, Continent 8 Technologies
When we talk about cybersecurity in regulated iGaming, much of the conversation naturally focuses on the operator.
Are they performing required security testing? Are they meeting regulatory requirements? Are their systems secure? Are they protecting player information, transactions, and iGaming operations?
Those are absolutely the right questions.
But I think we need to ask another one: What about everyone the operator connects to?
Today’s iGaming and sports betting ecosystem depends on Remote Gaming Server (RGS) providers, game studios, content aggregators, Player Account Management (PAM) platforms, payment providers, geolocation services, identity-verification solutions, sportsbook technology, cloud services, and countless other technology partners.
Every connection can improve the iGaming experience. Every connection can also introduce risk.
Two recent cybersecurity incidents demonstrate why that matters.
Polymarket: risk through a trusted third party
On October 29, 2026, prediction market platform Polymarket temporarily suspended trading after what it described as the compromise of a third-party provider.
According to BleepingComputer, malicious JavaScript was distributed through infrastructure associated with website performance-monitoring provider DebugBear. Its analysis found that the code was designed to hijack authenticated Polymarket trading sessions and use existing platform functionality to conduct unauthorised transactions. Polymarket said the issue was fixed and affected traders would be reimbursed.
The lesson is important:
An organisation can inherit cybersecurity risk through technology it trusts.
Attackers do not necessarily have to compromise the operator’s network directly. A trusted script, application, integration, or service provider can introduce another path to the target.
Online poker: when cybersecurity becomes a iGaming-integrity ussue
The recent online poker malware investigation provides a different example.
Reporting described malware associated with third-party software used by high-stakes online poker players. Compromised software could reportedly provide an attacker with remote access to an infected player’s computer, potentially allowing information intended to remain private during gameplay, including hole cards, to be viewed.
What makes this example particularly relevant to iGaming is that the reported attack vector was third-party software used by players, rather than simply a compromise of the underlying poker platform.
That shifts the discussion from traditional data security to something potentially much broader: iGaming integrity itself can be affected by cybersecurity weaknesses elsewhere in the ecosystem.
The Polymarket and online-poker incidents are technically different, but they point toward the same larger issue: the security of the iGaming ecosystem depends on more than the security of the operator alone.
Compliance is essential, but scope matters
This is where cybersecurity and iGaming regulation begin to intersect.
Regulatory cybersecurity requirements are essential, because they establish expectations and accountability for protecting iGaming environments.
But an assessment has a defined scope.
An operator’s penetration test may include specified infrastructure, applications, APIs, and integrations without providing a complete cybersecurity assessment of every third-party environment behind those integrations.
Likewise, testing or certification of an iGaming product should not automatically be interpreted as evidence that the supplier’s entire cybersecurity environment has been independently assessed.
So instead of simply asking: “Did we complete our penetration test?”, I encourage organisations to ask: “What did we actually test?”
And: “What are we trusting that sits outside that scope?”
Regulation isn’t one-size-fits-all
Annual cybersecurity testing is common across regulated iGaming, but who must be tested, what must be tested, and what the assessment must cover can differ by jurisdiction.
That distinction matters because operators and technology providers may assume that completing an annual assessment automatically means the entire environment supporting the iGaming operation has been evaluated.
New Jersey: Remote Gaming Systems that provide game content to another Internet iGaming operator must perform an annual system integrity and security assessment conducted by an independent professional, with the report submitted annually to the Division of Gaming Enforcement.
Michigan: The requirement is more explicit about scope. Each Internet iGaming operator or platform provider must complete an independent platform integrity and security assessment within 90 days of commencing operations and annually thereafter. The minimum scope includes vulnerability assessments and penetration testing of internal, external, and wireless networks, covering devices, applications, and the Internet gaming platform.
Pennsylvania: The Pennsylvania framework establishes security requirements for interactive Gaming platforms, including security policies and technical controls.
Ontario: The Alcohol and Gaming Commission of Ontario takes a standards-based approach. Its Internet Gaming Standards require connections and interfaces between iGaming systems and other systems, including external third parties, to be monitored, hardened, and regularly assessed for integrity and security. Operators and platform providers are generally subject to the Internet Gaming Standards, while relevant requirements also extend to iGaming-related suppliers operating critical iGaming systems.
The important takeaway isn’t simply that these jurisdictions require security controls or assessments.
It’s that the requirements and assessment scope are not identical.
An operator or platform may satisfy its required annual or recurring security assessment while technology belonging to a connected supplier, application, API, or other third party sits outside that testing scope.
That’s why I believe the better question is: “We completed our required security testing, but how much of the ecosystem supporting our operation did that test actually cover?”
For organisations operating across multiple jurisdictions, understanding that distinction is critical. Regulatory testing establishes an important baseline, but the scope of that testing determines how much of the actual technology risk has been evaluated.
APIs are part of the ecosystem too
One area that deserves particular attention is API security.
Application Programming Interfaces connect many of the systems modern iGaming depends on, including authentication, player accounts, transactions, wagering, and other operational functionality.
They are more than technical integrations. They are often a critical part of an organisation’s attack surface.
That’s why testing needs to look beyond whether an API functions correctly.
Security teams should also be asking:
- Can authentication or authorisation be bypassed?
- Could one account access data or functionality belonging to another?
- Can requests or transactions be manipulated?
- Can legitimate functionality be abused in unintended ways?
- Are sensitive information or credentials unnecessarily exposed?
For interconnected iGaming environments, understanding these relationships is critical.
Technology providers have a role too
Third-party security isn’t solely an operator responsibility.
If you are an RGS provider, game studio, aggregator, PAM platform, payment provider, identity provider, sportsbook technology company, or another organisation delivering technology into an iGaming environment, customers are relying on your technology.
For organisations supporting multiple operators, that responsibility becomes particularly important.
Independent cybersecurity testing can help identify vulnerabilities, validate security controls, and provide a clearer understanding of technical exposure within the agreed assessment scope.
The better question isn’t: “Do we have a penetration-test report?”
It’s: “Do we understand the risks associated with the technology we’re delivering?”
Testing the ecosystem, not just checking the box
As part of Continent 8’s Secure8 solution portfolio, our security-testing approach is designed to help organisations identify and validate vulnerabilities across agreed technology environments.
Secure services from Continent 8 Technologies include vulnerability assessments and penetration testing across infrastructure, web applications, APIs, cloud environments, and AI/ML systems. Our approach combines AI-powered security tools, automated scanning, OSINT-driven reconnaissance, and expert-led manual testing to identify and validate vulnerabilities, assess real-world risks, and perform controlled exploitation where authorized and safe.
But the objective shouldn’t simply be another penetration test report. It should be answering a practical question:
Where could someone realistically compromise or abuse our technology, and what are we doing about it?
The Polymarket and online poker incidents reinforce why that question should extend beyond traditional organisational boundaries.
A vulnerability doesn’t care which company owns the affected technology. An attacker doesn’t care which vendor is responsible for maintaining it. And a player affected by an incident isn’t going to care where one organisation’s cybersecurity responsibility ended and another’s began.
Cybersecurity is a shared responsibility across gaming. Operators will continue to have important cybersecurity and regulatory obligations, but securing modern iGaming requires us to look beyond the operator’s four walls.
Operators need to understand the technology they connect to. Technology providers need to understand the risks within the products and services they deliver. Security teams need to understand where trust relationships create potential exposure.
And organisations operating across multiple jurisdictions need to recognise that regulatory expectations and assessment scopes can differ.
So, the next time your organisation reviews its cybersecurity or penetration-testing program, ask three questions: What did we test? What didn’t we test? What are we trusting that sits outside that scope?
That last question may be the most important.
Because securing modern iGaming isn’t just about protecting the operator. It’s about understanding and protecting the entire iGaming ecosystem possible.
Ready to look beyond your current testing scope?
Whether you’re an operator, RGS provider, game studio, aggregator, PAM provider, sportsbook technology supplier, payment provider, or another organisation supporting iGaming, understanding where your cybersecurity exposure begins and ends is an important part of managing risk.
Reach out to your Continent 8 representative now to learn more about Secure8 and how our team can help assess your environment and strengthen cybersecurity across your iGaming technology ecosystem.