Great Britain: RTS security and annual audits
RTS section 4 built on ISO/IEC 27001:2022, the annual independent security audit, and the five-working-day duty to report security breaches.
Independent iGaming security research
See the threats. Strengthen the defenses.
What gambling regulators in Great Britain, Canada, the United States and Europe require of operators' information security, and how to defend against account takeover, bots, API abuse and incidents. Every requirement names its official source, and copies from legal publishers are labeled.
Compare security requirements →◈ ThreatLens / Research overviewReference model
Coverage areaSecurity rules
Coverage areaDefense guides
UK annual security auditReview →Breach notification deadlinesCompare →Account takeover controlsDefend →Incident response readinessPrepare →
Research navigation, not a live monitoring feed or incident statistics.
Security rules
What regulators require
All security rules →License conditions, technical standards and statutes, each with its official source and the date we checked it.
| Market | Independent testing | Breach notice to gambling regulator |
|---|---|---|
| Great Britain | Annual security audit against ISO/IEC 27001:2022-based controls | Within 5 working days |
| Ontario | Regular independent assessments | Immediate |
| Michigan | Within 90 days of launch, then annual, with penetration tests | Not found in the rule |
| Nevada | Annual review for Group I licensees | Within 24 hours |
Ontario: AGCO security standards
What the AGCO Registrar's Standards require on IT frameworks, monitoring and independent assessments, and the immediate notification rule for breaches.
US states: security audits and incident notice
Annual independent security assessments in New Jersey, Pennsylvania and Michigan, and Nevada's 24-hour cyber incident notice rule.
Europe: GDPR and NIS2 for gambling
GDPR's 72-hour breach notification, NIS2's sector lists (gambling is not one), and where national gambling regulators add technical rules.
Breach notification deadlines compared
One table of who to tell and how fast after a security incident: gambling regulators and data protection authorities in GB, Ontario, the US and the EU.
PCI DSS v4.0.1 for gambling operators
Where PCI DSS stands in 2026, the dates that matter, and how card data security fits with gambling regulators' audits.
Defense guides
Latest research and analysis
All defense guides →Evergreen defensive guidance mapped to OWASP, NIST and the UK NCSC. No fabricated breaking-news alerts.
Account Takeover: Detection and Response
Layered defenses against account takeover, the signals worth combining, and a response sequence that protects player funds.
Credential Stuffing Defense for iGaming Accounts
Why reused passwords are the main route into gambling accounts, and the layered controls OWASP, NIST and the ICO recommend.
Session Security and Account Recovery
Session identifiers, cookie flags, timeouts and recovery flows that resist hijacking without locking out real players.
Bot Abuse and Automated Traffic Defense
Which OWASP automated threats hit gambling platforms, from fake account creation to odds scraping, and how to separate bots from real players.
API Security for iGaming Integrations
The OWASP API Security Top 10 applied to gambling platforms: wallets, game aggregators, payment providers and odds feeds.
Security Incident Response Playbook for iGaming Teams
A practical playbook built on NIST SP 800-61 Rev 3 and CSF 2.0, with the reporting deadlines gambling operators face.
Third-Party Security and Vendor Risk
How to assess game, payment, identity and hosting suppliers using the NCSC's 12 supply chain principles and NIST guidance.
Threat Intelligence for iGaming Platforms
Turning threat information into decisions: which sources to trust, how to map threats to controls, and why unverified alerts do harm.
Platform Security Baseline
A baseline built from OWASP Top 10:2025, the ISO/IEC 27001:2022 controls behind regulators' audits, and UK Cyber Essentials.
Identity Verification and Data Security
How to protect identity documents and verification data, and what Pennsylvania's 2026 fines show about weak KYC controls.
Payment Security and Fraud Signals
Keeping card data out of scope, defending against card testing, securing payment pages and protecting payouts.
Fraud Signal Governance and Human Review
How to run fraud rules and risk scores that stop abuse without unfair friction: ownership, human review, testing and documentation.
Fraud Investigation Evidence and Privacy Controls
Collecting evidence that holds up, from logs to account history, while respecting data protection limits.
A practical defensive workflow
From signals to safer decisions
Map exposure
Inventory player journeys, systems and suppliers, and the rules that apply to each.
Evaluate risk
Assess impact, control gaps and detection coverage against OWASP and your regulator's audit.
Prepare teams
Document escalation, reporting deadlines, evidence preservation and player communication.
Test controls
Review outcomes, run exercises and fix what audits and incidents reveal.
Read our method, learn who publishes iGamingThreatLens, or see the corrections log.
What does iGamingThreatLens cover?
Information security requirements that gambling regulators set in Great Britain, Ontario, US states and Europe, breach notification deadlines, PCI DSS, and defensive guides for threats such as account takeover, credential stuffing, bots and API abuse.
Is iGamingThreatLens a security vendor?
No. It is an independent research publication. It does not sell security services, certify systems, rank vendors or publish attack tooling.