Author

Wayne Scott

Published

2 September 2026

Estimated Read time

7Mins

Wayne Scott, Governance, Risk & Compliance Solutions Lead, Escode on meeting the challenge now regulation has pushed resilience up the agenda

When it comes to resilience, many firms are still making the same mistake: focusing heavily on cyber risk while overlooking supplier, service and concentration risks that are just as likely to disrupt critical services. At the same time, regulatory pressure has increased significantly.

Frameworks such as DORA and the UK’s operational resilience regime have pushed firms to think more seriously about their dependencies, their critical services and their ability to withstand disruption. The risks are not limited to cyber events. Supplier failure, service deterioration and concentration risk all have the potential to disrupt critical services. This applies to both FinTech providers and the financial institutions that rely on them.

That’s all positive, and most firms have adapted well. However, a more subtle misconception is emerging. Being cyber secure is often taken as a sign that an organisation is resilient. In practice, it rarely works like that.

Organisations everywhere have been required to document their processes by mapping important business services, identifying suppliers and putting policies in place. On paper, it often looks robust – but when you start to delve into the detail and test what happens if a key supplier fails, things can look very different.

That gap between what’s written down and what actually works is where the real risk sits.

The problem with ‘on paper’ resilience

Most resilience frameworks rely heavily on documentation and firms are rightly asked to demonstrate that they understand their dependencies. Their contingency plans are checked – as are their abilities to exit from critical suppliers if needed. The issue is that much of this is built on assumption, not evidence.

Supplier contracts often include continuity clauses. Due diligence processes gather assurances from vendors about how resilient they are. Internal teams record that an exit is ‘possible’. Possible it may be, but very few organisations actually test whether those things hold up under pressure. There is a significant difference between an exit being theoretically possible and a stressed exit that has been tested and proven to work under disruption.

If a supplier fails, it’s not enough to just have a clause sitting in a contract. You need to know whether you can access the underlying software, rebuild it, move it, replace it – and how long that will take. That’s a very different question. Regulated entities now need to focus on whether their plans actually work.

The hidden risk in third- and fourth-party dependencies

One of the biggest blind spots in FinTech is the dependency chain. Most firms have a reasonable or good understanding of their direct suppliers, but what’s much less visible are the suppliers behind those suppliers – platforms, libraries, cloud services and infrastructure that everything ultimately sits on. That’s where concentration risk starts to build.

Too many FinTech platforms rely on the same hyperscale cloud providers. Many also depend on a relatively small number of specialist software vendors. When everything works, that concentration drives up efficiency and drives down cost. But when something goes wrong, it creates a shared point of failure.

You only really discover that exposure when something goes wrong. At that point, it’s too late to map the dependencies or negotiate alternative arrangements. You’re dealing with the consequences of decisions that were made months or years earlier, and it’s those decisions that can start as operational contagion, but rapidly move to financial contagion.

That’s why regulators are increasingly focused on sub-outsourcing and fourth-party risk. It’s also why firms need to move beyond a surface-level view of their supply chain.

Why supplier failure is not a theoretical risk

Supplier failure is often treated as an edge case, but in practice it’s far more common than many organisations assume. Most organisations have already had to deal with a supplier failing at some point. Across both fintechs and established providers, disruption and service deterioration are regular features of the market, and as the number of software providers grows – particularly with the rise of AI-driven services – that risk only increases.

Supplier insolvency, service deterioration and withdrawal of support are all real scenarios that firms are dealing with today. When they happen, the impact is immediate. In many cases, there is little time to react once a failure occurs. Systems stop working as expected, updates aren’t delivered, and the organisation is left trying to work out how to maintain continuity.

The challenge is that many of the controls needed to respond to those situations have to be put in place in advance. You can’t build a stressed exit strategy in the middle of a failure. Just like you can’t negotiate access to critical software once the supplier has disappeared. And you can’t quickly untangle complex dependencies when everything is already under pressure.

Moving from assumption to evidence

Currently, what we’re seeing in the sector is a shift towards evidence. Historically, firms have relied on supplier statements, certifications and contractual commitments. But that’s no longer enough. Regulators are now starting to test whether services can actually be maintained and whether exits can be executed in practice. They’re also looking at whether contingency plans have been thought through in detail. For FinTechs and the financial institutions that rely on them, that changes the conversation quite quickly.

It’s no longer sufficient to say ‘we have a plan’. The question becomes: can you demonstrate that your most critical services will continue to operate if a key supplier fails?

That involves testing stressed exit scenarios, validating that software can be rebuilt, and ensuring that there are clear, enforceable rights over the assets needed to maintain a service. These are practical steps that determine whether a business can continue to function under stress.

The role of leadership in resilience

One of the more interesting shifts is where these conversations are happening. Resilience has traditionally sat with IT or risk teams, but regulatory expectations have now pushed accountability firmly into the boardroom. CFOs are becoming more aware of the financial impact of downtime and supplier failure, and CIOs are balancing the need for agility with the risk of long-term lock-in. But there is still a gap between where decisions are made and where accountability sits. In practice, many of those decisions are being made across IT, procurement and legal teams, often without clear oversight at board level. That creates a clear challenge for leadership: decisions on risk are being made across the organisation, but accountability still sits at the top.

Much of the focus remains on cyber risk, which is understandable. What’s often less clearly owned are the non-cyber risks, such as supplier insolvency, service degradation, concentration risk and the practical ability to exit or replace a vendor.

Delegating responsibility for these risks is tricky, as they don’t sit neatly in one function. They cut across technology, procurement, legal, finance and operations. They also sit within vendor management, business continuity and disaster recovery functions, with different teams making decisions on risk that ultimately sits with senior leadership. That makes them harder to manage, but also harder to ignore.

The organisations that are getting ahead of this are the ones treating resilience as a shared responsibility, rather than something that sits in a single team. They are also recognising escrow as a key control and embedding it into their control frameworks as a key control.

What FinTech leaders should be doing now

None of this means tearing up existing strategies or abandoning the cloud. It starts with understanding where key risks sit, including supplier failure, service deterioration and concentration risk.

That means mapping where critical services actually sit, including the layers beneath direct suppliers. It also means identifying where concentration risk exists and where no credible, tested exit is in place.

From there, it’s about putting in place the controls that allow you to respond if something goes wrong. That includes ensuring access to the underlying source code that runs critical services and validating that the underlying source code and supporting components can be rebuilt into a working system.

One way organisations are addressing this is by introducing independent controls such as escrow. This ensures that source code, dependencies and supporting materials are securely held, verified and accessible, allowing systems to be rebuilt and operated if a supplier can no longer support a service.

Closing the gap

Regulation has pushed resilience up the agenda, which is a good thing. But compliance is only part of the picture. The real test is what happens when something actually fails.

Suppliers that focus solely on meeting regulatory requirements risk missing that point. Those that examine whether their systems, suppliers and services can actually withstand disruption will be in a much stronger position, because when a critical supplier fails, the difference between compliance and resilience becomes very clear, very quickly.

Learn more at escode.com

  • Cybersecurity
  • Digital Payments

Author

Diederik Wirtz

Published

31 July 2026

Estimated Read time

4Mins

Diederik Wirtz, Director of Business Development at Aryza, explains why your RCSA data contains far more intelligence than any quarterly heatmap conveys

Every organisation running a Risk and Control Self-Assessment programme is sitting on a goldmine of intelligence. Most treat it like a compliance filing cabinet. Updated periodically, reviewed by committee, archived until the next cycle. Heatmaps get produced, RAG statuses get refreshed, and everyone moves on.

Meanwhile, the COO is trying to understand operational fragility, the CFO is modelling downside scenarios, and the CEO is preparing for a board challenge on risk appetite. All receive dashboards that tell them what happened, but almost nothing about what is likely to happen next.

This is the gap between compliance-grade GRC and enterprise-grade GRC. The difference is whether your risk and control data produces outputs executives can use to make decisions or simply confirms that an assessment process took place. The signals are already in your RCSA data, the question is whether your tools are designed to extract them.

The Problem with Snapshots

Traditional RCSA programmes produce point-in-time snapshots. A risk is assessed, a control evaluated, a residual score assigned. But snapshots tell you almost nothing about trajectory, volatility, or the compounding effects of interconnected control weaknesses.

Consider a risk assessed as “medium” with controls rated “effective” for four consecutive cycles while three of its five mitigating controls have seen their effectiveness scores decline marginally each time. No single assessment raises an alarm. But the trend line tells a different story: gradual erosion that will eventually result in a control environment that can no longer hold.

This is the slow drift, the first and most fundamental signal organisations miss. It doesn’t show up on a heatmap. But it is visible the moment you analyse RCSA data longitudinally. The executive insight is simple: “This process area has looked stable for two years, but the controls underpinning it are weakening at a rate that will become material within 12 months.” That is enterprise-grade intelligence. A static heatmap is not.

Correlation Patterns Hiding in Plain Sight

Most RCSA frameworks assess risks individually within assigned business areas. A control weakness in procurement is evaluated separately from a similar weakness in vendor management. Each looks manageable in isolation.

But when you map data across domains, clusters emerge. Control effectiveness scores for anything related to manual data handling might have declined across four different business units simultaneously, a pattern revealing a systemic issue invisible to siloed programmes. These cross-domain correlations are precisely what a COO needs when deciding where to invest in process improvement, or a CRO needs when presenting enterprise-wide exposure to the board.

The Overconfidence Indicator

When a business unit consistently rates it controls as highly effective while simultaneously reporting rising operational incidents or audit findings in the same risk category, that disconnect is one of the clearest indicators of assessment bias and it is remarkably common.

The data to identify this gap already exists. RCSA scores sit in the GRC platform. Incident data sits in the loss event database. Audit findings sit in the internal audit tracker. The challenge has always been bringing these datasets together. When you do, the mismatches become immediately apparent and points directly to the areas of your control environment most likely to fail under stress. For an executive, this is not a technical finding. It is a credibility issue.

RCSA: From Assessment to Simulation

The real step change comes when you move from descriptive analysis to predictive modelling. Monte Carlo simulation transforms RCSA utility by running thousands of scenarios against your actual assessment data, applying random variation within defined probability distributions to produce a range of probable outcomes rather than a single point estimate.

The practical applications are directly executive-relevant. In merger and integration planning, simulation allows executives to see the impact of colliding control environments before they materialise. For capital allocation, it reveals which control improvements deliver the greatest reduction in probable exposure, enabling resource decisions based on quantified impact rather than qualitative judgment. For regulatory stress testing, it provides evidence that controls have been tested against plausible scenarios, grounded in operational data.

Signals Most Organisations Miss

Several patterns consistently emerge when RCSA data is examined with greater rigour:

  • Concentration risk in control ownership — a small number of individuals responsible for a disproportionate share of highest-rated controls, creating single points of failure invisible to traditional reporting.
  • Assessment fatigue — scoring clustering around previous assessments as cycles progress, indicating the programme may be generating the appearance of oversight rather than reliable information.
  • Phantom controls — controls receiving regular effectiveness ratings that have never been independently tested or are linked to processes that have fundamentally changed since the control was designed.
  • Velocity mismatches — risk categories (cyber, regulatory change) evolving faster than the assessment cycle, monitoring them, signalling where continuous monitoring should replace periodic review.

Your RCSA data contains far more intelligence than any quarterly heatmap conveys. Monte Carlo simulation, longitudinal trend analysis, and cross-domain correlation mapping turn RCSA from a compliance exercise into genuine executive decision-support. The signals are already in your data. Analysis is what locates them.

Learn more at aryza.com

  • Cybersecurity
  • Cybersecurity in FinTech

Author

Martin Jakobsen

Published

25 June 2026

Estimated Read time

5Mins

Martin Jakobsen, Managing Director at Cybanetix, on why SOC training and progression will be vital to meet the challenge of AI-driven cyber attacks

The accepted wisdom in cybersecurity is that the Security Operations Centre (SOC) has become overwhelmed. There’s some truth in this. Yes, the time taken to detect and remediate has grown, with IBM stating this now stands at 241 days. Yes, alert fatigue remains an issue, with SOC analysts snowed under 10,000 alerts per day leading to confirmation bias whereby positive alerts are discounted. And yes, alert volumes are rocketing due to a thriving black-market economy in attack kits and services, not to mention the emergence of AI-enabled attacks. Yet the SOC can adjust to these challenges and move with a rising tide if it adopts a paranoid posture.

One of the key attack trends over the past year is for threat actors to gain and maintain access legitimately. It’s for this reason we’ve seen a rise in credential theft (with an 800% increase in 1H2025) and the use of living off the land techniques (LotL). The attacker can log-in and use legitimate, trusted tools to evade detection and move laterally across the network to escalate those privileges. But the very fact these attacks don’t leave telltale footprints can make them much harder to detect. The SOC needs to rely on tools such as endpoint detection and response (EDR) and monitor tool usage to look for anomalies and that means listening to the less noisy network activity and low-severity alerts.

SOC: Selective Hearing

However, most SOCs focus on the high-severity alerts to such an extent that they even measure their success against the resolution of these incidents. SOC service level agreements typically specify a mean time to detection (MTTD) of 30 minutes and a mean time to respond (MTTR) of 15 minutes but the small print will often reveal this only applies critical alerts. Medium level alerts will typically be responded to within 1-2 hours and those low-level alerts that could indicate a LotL attack? Those are relegated to a window of 12 hours or more.

To capture this range of alerts will require the SOC to process ten times the usual volume of events. This presents the SOC with a quandary. How do you increase the monitoring and the ingest of alerts without submerging a SOC team who may already be drowning? For that to happen, the SOC must stop being selective and instead become more efficient.

To begin with, automation must be extended. Many teams will already be using Security Orchestration Automation and Response (SOAR) which can be configured to automatically remediate and close cases. But there are numerous other processes that can also benefit from automation. These can see the application of threat intelligence, automatic threat hunting and telemetry gathering, artificial testing, correlation with other alerts, and entity mapping, all of which can be used to enrich cases to the point where the SOC analyst doesn’t need to gather any further information when picking up the case.

Recovering from Cybersecurity Incidents

If we take the pre-defined playbooks that contain the recipe for how to detect, contain, eradicate and recover from specific cybersecurity incidents, for example, these can be automated to respond in a cascading effect. This sees one playbook used to trigger another depending on what the first has discerned, so that sub-playbooks iterate through lists of entities for each part of the case. Assuming 4,000 alerts coming into the SOC, triggering 100 playbooks per alert, with each playbook performing around ten actions such as enrichment lookups, correlation queries and containment steps, that’s equivalent to over four million triggered automations being executed per day before these cases are passed to a human analyst.

AI and the Analyst

AI, too, has a role to play. It currently enables the translation of free text questions into syntactical queries of Security Incident and Event Management (SIEM) and EDR data and can also be used to explain alerts, investigations and findings using human-friendly language and to summarise cases. It also lends itself to detection engineering, facilitating the faster creation of playbooks through the creation of code and detection syntax. With many detections sharing the same remedial actions, using AI to recommend a course of action makes sense, reducing analyst workloads substantially. And looking to the future, we can expect it to be used to optimise SOC operations by building playbooks on the fly and through the use of predictive investigative outcomes.

Applying these methods of automation enables any alert to be dealt with much more efficiently. The alert will initially be put through a process of enrichment, with threat intelligence used to compare the alert with known threats. SIEM and EDR searches will then correlate information, after which any associated alerts pertaining to the same entities (i.e. IPs, users, accounts, devices etc.) are linked to the case for the analyst to review. Using these processes, it’s possible to automate 65-70% of all SOC activity, dramatically reducing case workloads and allowing the SOC to process those massive alert volumes.

Human in the Loop

Yet, while automation is critical to adopting a paranoid posture capable of responding to evolving threats, it’s no substitute for the skills of the SOC analyst. Human expertise is invaluable in evaluating, verifying and deciding upon the best course of action and the likelihood is that those skills will become even more pertinent as AI becomes more widely used. This is because the technology can become so goal-driven that it becomes blinkered and can make incorrect deductions. In one instance, an AI agent went on to misinterpret a threat and produce a fictitious kill chain and mitigation advice, revealing the need for a human in the loop (HITL) and traceability in AI.

Paranoid monitoring does require the generation of more alerts for investigation. But we do have the tools and automation capabilities to handle those volumes so that this uptick needn’t equate to a massive increase in alert fatigue. What it does mean is that the role of the analyst will subtly change. They will be augmented by these processes and need to develop additional skillsets associated with validating these outputs, so the SOC will need to continue to invest in continuous training and progression, particularly if they want to hang on to that talent which remains in short supply. But unless we make these changes, the SOC won’t be able to keep pace with emerging threat patterns and will almost certainly fail to meet the challenge of AI-driven attacks.

Learn more at cybanetix.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Infrastructure & Cloud

Author

Gareth Hewitt

Published

23 June 2026

Estimated Read time

5Mins

Gareth Hewitt, Founder of LemonEdge, on why the real lesson from DORA is that resilience has to run through the whole operating model, from the infrastructure underneath it to the controls and workflows used every day

The EU’s DORA regulation has exposed how firms operating in private markets face a set of risks that is not purely about IT.

Designed to reduce financial sector reliance on a small number of infrastructure vendors, the regulation came into force last year. Since implementation it continues to throw a spotlight on risks arising from continued use of manual methods and over-reliance on individual employees’ subject matter expertise.

The regulation is forcing firms to examine how their operating models work under pressure and where risk resides inside workflows. 

A private equity or private credit manager may sit on robust cloud infrastructure at one end of its technology stack, while still relying on spreadsheets, manual handoffs and offline approvals at the other. In that kind of environment, resilience is only as strong as the least controlled part of the workflow.

The real risk often sits inside the workflow

This is where risk accumulates in an organisation – in processes that are not properly systemised. This is amplified when they rely on manual intervention or a small number of people who know how to make them work.

A month-end close supported by spreadsheets and a sequence of offline steps may function well enough in normal conditions. However, it looks far less resilient when deadlines tighten, a key individual is unavailable or an investor query lands at exactly the wrong moment.

DORA, in effect, acts as a pressure test on whether resilience has been built into the operating model or simply assumed. Private markets firms have lived with this kind of exposure for years, often because experienced teams compensate for process weaknesses. Regulation leaves no room for that comfort. The question now is whether the workflow holds up under strain.

With DORA, accountability has moved to the top

One of the clearest shifts under DORA is the level at which accountability now sits. Historically, operational resilience could be treated as a technology matter and delegated accordingly. If a firm had a CTO, responsibility was often there. If it did not, it shifted into finance or operations. DORA has since changed that dynamic. Responsibility now sits with the management body, which is held accountable for the ICT risk management framework. It means resilience is now a governance issue with clear ownership at the top of the business.

That changes the conversation both inside firms and with suppliers. Firms increasingly want hard evidence from their providers. They want to understand incident processes, failover arrangements, access controls and recovery expectations in practical terms. They also want to know when documentation was last reviewed, whether controls have been tested – and what would happen if a system failed.

The weakest point is often internal

For many private markets firms, however, the central issue is not whether a major external provider is resilient in principle. It is whether the firm’s own workflows can withstand increased pressure.

Key-person risk is at the heart of this issue. Many firms have built effective processes around capable individuals who know every workaround and hidden dependency. That may keep the machine running, but it is not the same as resilience. If knowledge is not captured and supported by the underlying platform, the process is weaker than it appears, severely increasing dangers when individuals leave or are unavailable.

The same applies once essential work starts moving outside the core platform into spreadsheets, email chains or offline approvals. Control weakens, visibility drops, auditability becomes harder and recovery becomes more uncertain. In private markets, where reporting expectations are high and investor scrutiny remains intense, that is not a side issue. It goes to the heart of whether the operating model is fit for purpose.

That matters particularly in fund accounting, where complexity has only increased. Reporting expectations are higher, structures are more demanding, and firms need stronger control across workflows. A system built for a different era often pushes work outside the main platform at exactly the point where clarity and control matter most. Once reporting becomes a scramble and key numbers are being pieced together manually, the workflow has already become more fragile than it should be.

DORA is the prompt, not the end goal

Operational resilience has often been treated too narrowly as a compliance cost. In practice, stronger resilience usually brings clearer process ownership, better visibility across workflows and faster responses when investors, auditors or regulators ask harder questions. It also reduces key-person risk and makes growth easier to support because the process does not have to be rebuilt every time complexity increases.

DORA will not solve every vulnerability in private markets operations, nor was it meant to. What it does is raise the bar for accountability, testing and supplier oversight. It shines a harsher light on brittle processes that have survived largely through habit and human intervention. It also makes clear that operational resilience depends not just on policies and providers, but on whether the underlying systems and platforms are strong enough to support controlled, auditable workflows under pressure.

That is the real wake-up call. Resilience has to run through the whole operating model, from the infrastructure underneath it to the controls and workflows used every day. That’s the real underlying lesson of DORA that private markets firms need to heed.

Learn more at lemonedge.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • InsurTech

Author

Rob Demain

Published

22 May 2026

Estimated Read time

5Mins

Rob Demain, CEO at e2e-assure, on why the clock is ticking when it comes to IT/OT convergence for Critical National Infrastructure (CNI) and associated organisations

Many critical national infrastructure (CNI) operators lack the ability to protect their infrastructure despite the UK being subjected to daily sub-threshold cybersecurity attacks, according to the Strategic Defence Review 2025. It’s a situation that the Network and Information Systems (NIS) regulations, introduced back in 2018, sought to prevent. But since its inception, just over half of the operators of essential services have updated or strengthened their existing policies and processes, leaving many woefully unprotected. 

In desperate need of reform, NIS is set to be superseded by the Cyber Security and Resilience Bill (CSRB), which is expected become law later this year, at which point a consultation on implementation proposals will commence followed by secondary legislation and an adjustment period for stakeholders. The bill will broaden the scope to include other organisations deemed critical to the national economy i.e. data centres, Managed Service Providers (MSPs) and critical suppliers. Plus, the government reserves the right to extend those categories still further as part of its ‘future proofing’, which will enable changes to be made to the act to accommodate emerging threats and potential targets. 

New Demands 

All of these new entities will need to comply with the Cyber Assessment Framework (CAF), which lays out expected cybersecurity and resilience outcomes. First published in 2018 to support NIS, it has undergone a number of revisions since, with v4.0 released in August 2025. This version places a far greater emphasis on proactive security and decision making based on real threat intelligence. As well as adding new contributing outcomes on understanding threats and secure software development and support, it also expands the sections on security monitoring and response and recovery, while an entirely new category has been added on threat hunting.   

All of this points to a far greater emphasis on being able to demonstrate assurance and proactively monitor all aspects of CNI infrastructure and that means more scrutiny of both IT and Operational Technology (OT). Until recently, securing OT wasn’t seen as a priority. These systems were chiefly concerned with maintaining system availability and minimising downtime. But their increased integration with IT systems to connect with the industrial Internet of Things (IIoT) and deliver real-time monitoring, for example, are exposing these systems to attack, with threat actors able to move laterally from one environment to the other.  

The threat posed by IT/OT convergence is well known, but it continues to be the Achilles heel of CNI, as revealed by the Volt Typhoon attack. This saw Chinese nation state actors maintain persistence across CNI in the USA since at least 2021 through the use of Living off the Land techniques, illustrating just how insidious and sustained these cybersecurity attacks can be. 

Securing IT/OT Systems 

It’s these types of threat the CAF addresses through its risk and asset management requirements. Organisations must risk assess systems with respect to their dependencies and interactions with other systems such as IT/OT, and document and understand those dependencies. But other complementary frameworks can also be used to map IT/OT system security, such as the ISMS within ISO27001 from an IT perspective and IEC 62443 from the OT side, in addition to ISO/IEC 27019 for process control systems. 

Being able to follow these frameworks will require organisations to increase their security monitoring of both IT and OT and the transparency of their processes. They will need to transition from being reactive to proactive, and become resilient and risk informed, which will mean many will have to change their approach. These are really the only options available to them in this respect if they are to move the resilience needle. 

The first is to decentralise and harden OT systems while keeping them segregated from IT. However, hardening alone can’t keep pace with digital transformation. Many OT assets cannot support multi-factor authentication (MFA) or accommodate rapid patching because they are downtime sensitive. So, surface hardening alone won’t confer the resilience needed long term.  

The second option is to manage IT and OT together by giving everything an identity in a converged environment, but to do that you need to move the monitoring of OT into the Security Operations Centre (SOC). Centralised monitoring allows threats to be detected across both IT and OT networks, for teams to monitor east-west traffic, and to correlate alerts that might otherwise appear unrelated. And it’s this centralised management that will provide the visibility and control needed to improve IT/OT resilience.  

Converged Cybersecurity 

Such a converged SOC doesn’t just offer continuous visibility over IT, industrial control systems (ICS), OT and cloud environs, but also the real-time triage of critical alerts. These might include unauthorised PLC logic changes, unsafe set-point writes, abnormal OT protocol behaviour, lateral movement in ICS DMZs, OT malware,or unauthorised remote access into OT environments. These alerts are then grouped by operational impact, such as whether they present a safety critical risk or could lead to service degradation, so that they can be prioritised. Weekly threat hunts and detection surface validation over distributed environments provide the threat hunting capabilities needed to meet the CAF requirements and the SOC evidences and provides that all important audit-ready compliance mapping to meet the demands of other frameworks too such as IEC 62443, and ISO/IEC 27019. 

Whether standing up a converged SOC internally or outsourcing, this capability is the most efficient way to adapt to the tightening regulations, particularly as we can expect ‘future proofing’ to lead to yet more demands. The emphasis is now firmly focused on the proactive monitoring of both IT and OT systems together, given their growing dependencies, so it makes sense for those organisations in scope – as well as those who could soon be – to begin to move their OT monitoring from the plant and into the all-seeing all-knowing enclave of the SOC.  

Learn more at e2e-assure.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Fintech & Insurtech

Author

Dan Brightmore

Published

29 April 2026

Estimated Read time

6Mins

Andrew Power, Head of UK&I at Tricentis, on why the right approach to AI can deliver the foundation for more resilient, predictable systems

Artificial intelligence is reshaping software delivery in financial services. Code that once took teams weeks to develop can now be generated and deployed in a matter of hours. This isn’t just about faster delivery; it changes the fundamentals of how software is built and how it behaves in production.

Financial institutions have moved quickly to integrate AI across core systems, from customer operations to anti-money laundering (AML) and software development to capture efficiency and innovation gains. UK parliamentary evidence shows adoption is already widespread, with the majority of firms using AI, and more planning to follow.

But as adoption spreads and becomes more embedded within key systems, so does exposure. Risk is no longer confined to individual defects, but shaped by how quickly those defects can spread across interconnected environments.

AI has removed the limits on how quickly software can be created, but not on how confidently it can be trusted, and financial institutions can now generate and deploy code faster than they can safely validate it.

This creates a new paradox: AI is both accelerating the pace of software change and increasing the speed and scale at which failures can materialise.

Machine-Speed Failure

AI-driven development shortens the distance between change and consequence. Software updates can move through the pipeline from creation to production with significantly less friction. However, this also reduces the time available to identify, flag and contain any issues before they have an impact.

AI-driven software changes don’t just move fast, they scale fast. Unlike traditional failures, these are systemic risks. A single misstep in an AI-generated update can propagate unpredictably.

For financial services, this is especially significant when key systems are deeply interconnected, spanning complex layers of infrastructure, integrations, and third-party services. Even a minor defect can propagate quickly across systems, amplifying its impact.

What would once have been contained can now escalate, cascading across systems and causing wider disruption that affects customers, operations and, in some cases, market activity. In financial services, this is not just a technical issue but a business risk with direct implications for customer trust, regulatory compliance and financial stability. The challenge is no longer simply identifying defects but maintaining confidence in what is being deployed.

This risk is already being felt across the sector. Institutions are accelerating delivery to meet customer expectations and competitive pressures, but often without corresponding advances in validation. Tricentis’ research shows 68% of financial services organisations anticipate outages or serious incidents due to poor software quality.

Regulatory Pressure for AI is Increasing

The issue is also drawing attention from regulators. Earlier this year, the UK Treasury Committee warned that current approaches to AI in financial services are inadequate and could expose customers and the wider system to “serious harm”, highlighting the need for stronger guardrails, clearer accountability and more robust oversight to deploy it safely.

Traditional resilience frameworks were never designed for systems evolving in real time, and AI can no longer be treated as a marginal technology risk. It must become central to how organisations manage and assess resilience.

This marks a shift from software quality being an engineering concern to a board-level issue of operational resilience. If machine-speed change is the new operational hazard, then failure to address it becomes a strategic issue rather than a technical one. With that in mind, financial leaders must acknowledge AI’s dual role as both a driver of risk and a mechanism for preventing it.

AI as Both a Safeguard & Source of Risk

AI also offers the most effective and scalable way to manage the risks it introduces. Advanced AI-driven validation, continuous monitoring and risk-prioritised testing can identify issues earlier than any manual process, helping reduce the likelihood they reach production.

In effect, the same AI that accelerates software creation must now be applied to validation and governance – operating at the same speed and scale.

The same capabilities that facilitate rapid software production can be applied to validation and governance, continuously evaluating system behaviour, detecting anomalies and prioritising testing based on potential business impact, rather than volume. This allows organisations to move beyond rigid approaches and towards more adaptive, responsive quality models that more accurately reflect the way AI behaves.

Instead of relying on standard periodic testing cycles, systems can be validated on an ongoing basis. This enables earlier intervention before issues escalate.

AI can also help organisations better understand the complexity of their own systems. By analysing dependencies across applications and infrastructure, it becomes possible to identify which processes are most critical and where failures would have the greatest impact.

From Acceleration to Control

There is a clear mismatch in how financial organisations approach AI. While many are leveraging AI to accelerate development, far fewer are evolving their validation and governance to keep pace, and it’s in this gap that risk emerges.

This is the “confidence gap”, where organisations can create software faster than they can safely deploy it.

To address this imbalance, firms must treat software quality as a core component of their AI strategy. Development and validation must move forward together. Governance must adapt to continuous, AI-driven change. This requires a move from static testing and coverage metrics to continuous, risk-based validation, where software is assessed in real time based on potential business impact.

If AI is the engine driving software creation, validation must act as the braking system – built in, not bolted on at the end. At machine speed, gaps in control become points of failure. The aim is not to slow innovation, but to ensure it progresses in a way that is sustainable and safe. When validation keeps pace with development, firms can move quickly and competitively, whilst maintaining control over how risk is introduced and managed.

This is a change we are seeing across large enterprises adopting AI-driven quality approaches, where validation, monitoring and governance are increasingly orchestrated together rather than treated as separate processes.

Preventing the Next Outage

The financial sector has already seen how quickly failures can escalate in complex, interconnected environments. In March, an IT error at Lloyds Banking Group exposed the private financial information of nearly half a million customers, prompting the bank to issue £139,000 in compensation.

Such incidents aren’t isolated: over the last two years, more than 33 days of unplanned banking outages have been reported to Parliament, underlining the scale of the issue.

As AI increases the velocity of change, it also raises the stakes for getting it wrong. But the irony is that it also provides the tools needed to prevent these failures from happening in the first place. AI is both contributing to the risk of outages and becoming the most effective way to prevent them.

By applying AI to continuous validation, monitoring and risk detection, organisations can spot issues earlier, understand their potential impact and intervene before disruption occurs. This shifts the focus from reacting to outages to preventing them, and it’s where the paradox becomes constructive. AI doesn’t have to be a source of instability.

With the right approach, it can become the foundation for more resilient, predictable systems. Those that fail risk trading innovation for instability. In the AI era, speed without confidence is simply another form of risk.

Learn more at tricentis.com

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Fintech & Insurtech

Author

Vincent Guillevic

Published

16 April 2026

Estimated Read time

5Mins

Vincent Guillevic, Director of Fraud Labs at Entrust, argues companies that treat identity as a continuous thread rather than a single checkpoint will be better positioned to reduce losses and protect customers

Identity verification and tackling fraud began as a face-to-face process, built on human trust. Opening a bank account involved meeting a banker in person and from there, trust was established because both parties could see and interact with each other directly in branch.

Fast forward to the digital age and a lot of services have moved online. Identity verification has therefore shifted from in-person checks to remote identity verification. Today, we’re in an era where identity is now central to every interaction we have online.

Fraud has followed the same trajectory. Much like a burglar would test every possible entry point rather than just the front door, fraudsters probe every stage of the customer journey. They look for weaknesses at onboarding, during login, and throughout ongoing transactions and data requests.

That challenge has intensified in recent years. AI has given fraudsters faster, sophisticated and scalable tools. Deepfakes can bypass checks, AI‑generated documents can appear real, and phishing and impersonation attacks can now be automated at scale.

Once a fraudster gains access to a legitimate account, the damage escalates quickly. Global losses from account takeover (ATO) fraud were projected to reach $17 billion in 2025, up from $13 billion in 2024. While the underlying intent of fraudsters seeking the weakest point of entry, the breadth, speed and sophistication of modern attacks have.

Identity Fraud Patterns Across the Customer Lifecycle

Fraud can occur at any stage of the customer journey. From verifying identity at onboarding to securing connections and fighting fraud in everyday transactions. Each stage introduces its own risks, and attackers adapt their tactics based on where value can be extracted most efficiently.

In 2025, patterns showed a clear distinction between industries targeted for new account fraud and those targeted for account takeover fraud. Businesses that offer immediate incentives such as promotional offers or sign-up bonuses are primarily targeted for new account fraud. In contrast, businesses where accounts accumulate long-term financial or data value face higher levels of ATO.

Industries built around sign-up incentives or instance access experience most fraud at onboarding. For instance, in crypto, 67% of fraud attempts occur during account creation, largely driven by sign-up incentives. Vehicle rental follows a similar pattern, with 67% of fraud taking place at onboarding as attackers use fake identities to gain short-term access to high-value assets. In these sectors, low-friction onboarding creates opportunities to harvest incentives or establish accounts that later become avenues for future money laundering.

Account takeover fraud reflects a different strategy. Rather than creating fake accounts, attackers focus on compromising established accounts using tactics such as stolen credentials, phishing, malware, or social engineering. Entrust data shows this is most common in industries where accounts hold enduring value. In payments, 82% of fraud attempts occur after onboarding, while in professional services the figure is 62%. High-value, long-standing accounts are attractive because they enable fund transfers, loans, and access to identity-rich data, making them more valuable than newly created accounts.

These patterns highlight two critical realities. First, organisations can no longer optimise for one type of risk at the expense of another. Defending a single point in the journey inevitably leaves gaps elsewhere. Second, fraud has become highly professionalised. Modern fraud operations are organised, strategic, and adaptive, moving toward the highest rewards and the weakest controls.

Prevention Must Span the Entire Journey

If fraud can occur at any stage, prevention must operate at every stage. Organisations that implement robust, lifecycle-wide identity strategies save an average of $8 million per year in fraud-related costs. These savings come from detecting threats earlier, more accurately, and beyond a single checkpoint.

There are three areas where that lifecycle approach needs to be strongest.

Get onboarding right

Onboarding is the first opportunity to establish genuine trust. Strong Know Your Customer (KYC) or Know Your Employee (KYE) processes combine document verification with biometric checks such as face recognition or fingerprint scanning to confirm that the person applying is who they claim to be. Liveness detection adds a further layer by distinguishing real users from synthetic identities and deepfakes, which are linked to approximately one in five biometric fraud attempts.

With strong identity verification at onboarding not only reduces immediate fraud, but also limits the downstream damage caused with fraudulent accounts.

Secure existing accounts with continuous authentication

Verifying identity once is no longer sufficient. Continuous authentication, combining multi-factor authentication with biometric re-verification like facial recognition, allows businesses to protect established accounts without creating unnecessary friction for legitimate users.

Crucially, it enables authentication requirements to adapt dynamically as risk levels change, rather than applying the same static check regardless of context. In payments businesses, where most fraud targets the authentication process itself, this adaptability is key to mitigating attacks before losses occur.

Monitor behaviour in real time, not just identity

Device intelligence and behavioural signals make it possible to assess risk based on how users interact with services, flagging unusual login patterns, device anomalies, or out-of-character transactions.

As AI-driven fraud becomes more sophisticated and convincing, behavioural indicators provide another layer of ongoing fraud detection. Focusing monitoring on high-risk actions, rather than only high-risk identities closes a critical gap in traditional defences.

The Window of Opportunity

Fraud has always followed the customer journey. What has changed is the availability of advanced technology capable of tracking, analysing, and responding to threats at every stage. The key question for organisations is whether these capabilities are deployed as a connected strategy or left as isolated controls with gaps in between.

Companies that treat identity as a continuous thread rather than a single checkpoint will be better positioned to reduce losses and protect customers, and preserve the trust that underpins long-term digital relationships.

Learn more at entrust.com and meet the team at IFGS in London on April 21

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Fintech & Insurtech

Author

Michele Centemero

Published

14 April 2026

Estimated Read time

5Mins

Michele Centemero, EVP Services, Mastercard Europe on why promoting awareness, stronger collaboration and data-sharing, and continued innovation of payments ecosystems, will be critical in reducing the impact of scams and protecting trust in the digital economy

As our world becomes faster, smarter and more interconnected, scammers are evolving in parallel, developing increasingly sophisticated ways to exploit people’s trust. By harnessing new technologies and behavioural insights, they are refining their methods to appear ever more credible and convincing.

While attacks on systems continue, today’s fraudsters are increasingly targeting people, often relying on psychological manipulation to achieve their goals.

Understanding Social Engineering

Many modern scams fall under the umbrella of social engineering,which isthe use of deception and emotional manipulation to influence a person’s behaviour.

In the digital world, cybercriminals use these tactics to build false trust, create urgency or fear, and ultimately trick people into sharing confidential information or taking actions that can cause financial harm to themselves or their employer.

Recent European industry data indicates that social engineering-related fraud and authorised push payments (APPs) – where victims are tricked into sending money to fraudsters posing as legitimate payees – now account for a growing share of overall scam losses[1].

This is directly impacting a growing number of consumers, with the majority of people saying they’ve experienced some form of scam or fraudulent attempt to capture their personal information highlighting why awareness and vigilance are critical for people of all ages.

Education is the First Line of Defence

Protecting consumers and businesses from malicious activity is a priority, and it starts with awareness. When people understand how scams work, they’re more likely to spot the warning signs before it’s too late and be empowered to protect themselves against fraudsters.

Three of the most common social engineering scams to watch out for are:

  • Imposter fraud – Criminals pose as trusted organisations (such as banks, retailers, or government bodies) to pressure victims into sharing personal or financial details. Research indicates over half (53%) of European consumers have been targeted via phone or voice call scams, with social media scams affecting around two in five people, and tech support impersonation tricking roughly one in three.*
  • Phishing – Fraudulent emails, texts, or messages that are designed to look legitimate, often urging immediate action like clicking a link or resetting a password, leading victims to disclose sensitive information or install malicious software. Nearly three in five (58%) have received phishing emails or fraudulent text messages (63%) and QR code scams are on the rise, impacting nearly a quarter of Europeans.*
  • Romance or honeypot scams – Scammers build emotional relationships over time, gaining trust before exploiting it for financial gain. These types of attacks are also widespread, with one in four people (24%) encountering fake profiles, requests for money, or online relationships that lead to financial exploitation. These scams hit younger generations hardest, with 40% of Gen Z and 35% of Millennials affected, compared with 21% of Gen X and 11% of Boomers.*

How Businesses Can Protect Consumers from Scams

With fraudsters increasingly using AI to commit more sophisticated, larger scale attacks, businesses and banks should also consider how they deploy technology to protect customers from bad actors.

The combination of AI, robust identity controls and open banking can help protect consumers from scams, whether across card and account‑to‑account payments or in fraudulent account openings.

Looking at identity controls specifically – take the example of continuous identity verification, a fraud prevention measure that verifies the user is who they claim to be throughout the entire lifecycle journey. This helps to prevent scammers from opening or taking over accounts to apply for credit, create ‘mule’ accounts or impersonate others.

Behavioural biometric data is often used as part of this and can be used to analyse how a user interacts with their device – from typing patterns to on‑screen movements – to flag unusual behaviour.

More in depth, AI powered transaction analysis can also help banks and financial institutions to stay ahead of payment threats. It provides banks with the intelligence needed to detect and stop payments to scammers, using AI and a network-level view of account‑to‑account transactions to enable intervention before funds leave an account.

Staying Ahead of an Ever-Evolving Threat

As social engineering tactics continue to evolve, staying ahead requires a combination of intelligent technology, consumer education, and proactive action from businesses and financial institutions.

While no single measure can eliminate risk entirely, greater awareness, stronger collaboration and data-sharing, and continued innovation of payments ecosystems will be critical in reducing the impact of scams and protecting trust in the digital economy.

*Source: This study was conducted by The Harris Poll on behalf of Mastercard from September 8 to September 25, 2025, among 5000+ consumers in the following European markets: EUR: France (n=1,005), Germany (n=1,002), Italy (n=1,016), Spain (n=1,005), UK (n=1,004)

Mastercard: Transforming the Fight Against Scams

Innovation – Our advanced AI-powered Identity insights examine digital footprints and assess unique patterns to detect risk and flag suspicious activity indicative of scams.

Collaboration – We collaborate across industries, partners and organizations worldwide to secure the digital ecosystem, ensuring payments are safe for all. Combating the growing threat of scams demands a collective effort.

Education – We work with and through our collaborators to provide knowledge and tools that help people protect themselves and their loved ones from scams, while also working to destigmatise the experience of being a victim.

  • $12.5bn in losses from U.S. consumer reported online scams in 2023
  • $486bn in global losses from scams and bank fraud schemes in 2023
  • 22% YoY growth in U.S. consumer scam losses suffered in 2023

From sender to recipient, we vigilantly monitor accounts and transactions for any elevated scam risk

Identity insights – Provides actionable identity insights and risk scores for businesses to improve identifying their good customers from the scammers creating “mule” accounts or impersonating someone else with a false identity.

Transaction patterns – Flags suspicious activity across the money movement flow to prevent payments to scammers before it is sent through the real-time analysis of transaction elements.

Account confirmation – Enables account validation to confirm account ownership and validate identity details in real-time through our open banking capability, which draws on the safe exchange of consumer-permissioned data to facilitate frictionless and secure payments.

Learn more at mastercard.com

[1] Joint EBA-ECB report on payment fraud: strong authentication remains effective, but fraudsters are adapting

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • InsurTech

Author

Richard Ford

Published

20 March 2026

Estimated Read time

3Mins

Richard Ford, Chief Technology Officer at Integrity360, on why cybersecurity must move beyond control and embrace trust

Cybersecurity has long been focused on building walls, but the biggest threat is already inside. Today, insider risk accounts for nearly half of all data breaches. This isn’t just about malicious actors, it’s about regular employees and trusted contractors who make simple, costly mistakes.

Remote and hybrid working has only intensified the problem. With teams distributed and work happening across cloud platforms and collaboration tools, it’s harder than ever to track what’s happening, let alone why. Although AI tools promise efficiency, they also introduce new vulnerabilities. Employees pasting code into chatbots or bypassing corporate tools to meet deadlines. All seemingly innocent, but highly risky.

Insider Risk

Ransomware gangs know this and are now skipping the technical breach altogether and going straight to the source – a company’s insiders. Whether through bribery or social engineering, attackers are finding that humans can be the weakest link in even the most well-defended environments. Despite this, most security budgets still focus outward.

Traditional tools like data loss prevention (DLP) struggle to keep up with today’s dynamic and unpredictable user behaviour. Meanwhile, simulated phishing tests and punitive training schemes often breed resentment, not resilience. It’s time to rethink the model.

Human Error, Human Fix

We need to stop treating employees as the problem and start making them part of the solution. Enter Human Risk Management (HRM), a behavioural approach to cybersecurity that recognises the complexity of modern work. HRM tools monitor real-world user behaviour, detect anomalies in context, and deliver just-in-time nudges to prevent risky actions before they happen. Instead of punishing mistakes, they help users avoid them in the first place.

Of course, technology alone won’t fix the issue, culture is key. Leadership must champion security as a shared responsibility, not an IT rulebook. Success should be measured by how quickly employees improve, not how often they slip up. Awareness campaigns need to be practical and rooted in real-world behaviour.

Organisations also need to understand how digital transformation has changed the risk landscape. Shadow IT is no longer a fringe issue, it’s how work gets done. Whether it’s a developer using an AI plugin or a marketer sharing files via a personal drive, employees will always find the fastest path to productivity. Security must meet them there, not block the way.

Cybersecurity Built on Trust

The smartest businesses are those that treat identity like infrastructure, and behaviour like a vital data stream. They invest in tools that adapt to people, not the other way around. This means a move away from a surveillance approach and embracing the nuance of human error and design systems that support.

In a world where threats are increasingly internal and AI is both a risk and a tool, cybersecurity can no longer be about control. It must be about trust, and that starts with understanding the humans behind the keyboards.

Learn more at integrity360.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Infrastructure & Cloud

Author

Pierre Noel

Published

Estimated Read time

4Mins

Pierre Noel, Field Chief Information Security Officer at Expel, on why security with community-based governance is a key business pillar that better positions organisations to become more resilient and target growth

It’s been a particularly rocky start to 2026 for the global cybersecurity landscape. From the Substack data breach to PayPal credential-stuffing attacks in February, we are not looking at IT failures alone. These attacks are balance-sheet events: direct assaults on business value, triggering remediation costs and long-term impacts on financial health. Compounded with the conflict with Iran, leading to potential ramifications in the cyber realm, it’s more important than ever for the C-suite to be aligned on cybersecurity priorities.

Despite this, a glaring disconnect remains in planning and execution. Expel’s research found that while 85% of finance leaders view cybersecurity as a key component of business planning, only 40% express full confidence in security’s ability to align with business strategy. To bridge this gap, CISOs must move from reporting on activity and start reporting on resilience and unit cost.

Translating Alert Volume Into Unit Cost

CISOs must change how they present the value of their operations. CFOs are largely indifferent to technical metrics like the ‘millions of blocks pings’ or ‘SOC alert volume’ – to a finance leader, an alert is simply another form of disruption to daily operations.

To fix this, CISOs should introduce the ‘unit of cost protection’. By breaking down security spend into the cost required for a single transaction or business unit, CFOs can understand and manage it from experience. A tiered approach works best here: high-risk business units justify higher protection costs than low-risk ones. This allows CFOs to treat security as a scalable operational expense rather than a black hole of additional tooling – the kind of framing that also resonates in a boardroom.

Mapping Investment to Business Risk Exposure

Expel’s research shows that while 43% of finance decision-makers are confident that security can prioritise investments based on risk, only 46% are confident that security can deliver cost-efficient solutions. To move in the right direction, CISOs should shift from ‘vulnerability management’ to thinking about ‘business risk exposure’, requiring a different view of how threats unfold over time.

It’s all about asking the right questions. Instead of requesting more firewalls to protect a specific timeframe, start asking for the cost of securing diverse digital ecosystems across an extended risk window. The 2026 Winter Olympics is a good example: Russian-led cyber campaigns began raising concerns months before a single athlete arrived in Italy, proving that risk isn’t a one-day event but an ongoing operational cost.

For European organisations, this framing is increasingly non-negotiable. While NIS2 and DORA help make the cost of under-investment concrete and quantifiable, the upcoming Cyber Resilience Act (CRA), with key reporting requirements starting in September 2026, extends this pressure to anyone manufacturing or selling digital products in the EU. Even for purely domestic UK entities, the new UK Cyber Security and Resilience Bill is moving the goalposts toward these same high standards. Ultimately, CFOs must understand that cybersecurity isn’t just about preventing loss; it’s a prerequisite for safe and secure growth.

The Reputational Multiplier

So those are the questions to ask, but how do CISOs deal with the ‘unknown unknowns’, specifically long-term brand damage? While compliance fines under NIS2 or DORA may be straightforward (and important) to model, they rarely represent the full scope of the potential damage. In such scenarios, CISOs should propose a reputation multiplier: a framework for quantifying the financial fallout of brand damage in a language CFOs know and trust, looking past immediate recovery costs to factor in the long-term implications of re-establishing market trust.

The 2026 CarGurus breach illustrates this well. Impacting 12 million users, the cost wasn’t purely technical; it also came from the stock price dip and marketing spend required to repair the brand. For UK companies, where regulatory scrutiny is heightened, that multiplier effect is even more pronounced. This is the language of a CFO, and it helps CISOs better translate the urgency and relevance of a strong cybersecurity posture.

Standardising the Language of ROI

Closing the gap between CFOs and CISOs needs more than just better data; it needs a shared vocabulary. By standardising the language of ROI, CISOs transform cybersecurity from a vague insurance policy into a transparent value driver fully trusted by finance teams. Move away from complicated defensive jargon toward a unified framework of unit costs, and the gap between the CISO and CFO starts to close.

Security has become a key pillar of business operations, and in the current threat environment, it’s genuinely a community-based governance issue. The organisations that get this right aren’t just more resilient. They’re better positioned to grow.

Learn more at expel.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Infrastructure & Cloud

Author

Dr. Yvonne Bernard

Published

18 March 2026

Estimated Read time

5Mins

Dr. Yvonne Bernard, CTO at Hornetsecurity, on meeting the challenge of managing the speed of AI adoption and harnessing its defensive capabilities while mitigating the risk of uncontrolled adoption

The past year has been defined by acceleration. Threat actors rapidly embraced automation, AI, and social engineering. Scaling their tactics at unprecedented speed, while defenders raced to keep pace. Historically, defensive resilience evolves in step with attacker innovation, but in 2025 that balance began to falter.

In an analysis of over 6 billion monthly emails, Hornetsecurity’s Security Labs found that the volume of sophisticated threats grew faster than most security teams could adapt to. Malware-infected emails soared by 131%, scams increased by nearly 35%, and phishing attempts – powered by access to advanced AI – rose by 21% from the previous year.

Typically, attacks, even at volume, are easily filtered by good firewalls and secure email gateways. But the sophistication and AI-led nature of 2025’s boom made it even harder for organisations to defend themselves. The question now is: can security teams and businesses wrestle back control?

Evolving Cyberattack Landscape

​​AI enhances efficiency and precision. As such, cybercriminals use it to launch faster, more convincing and adaptive attacks, ranging from deepfakes to credential stuffing. As an example, there is a concerning trend of attackers increasingly using ‘MFA bypass kits’ to create deceptive login pages. These pages capture not only the user’s credentials but also have logic built in to handle MFA prompts as well. ​​The unsuspecting user is then passed to the real login page for the target service and meanwhile the ‘kit’ grabs a copy of the user’s session token. This allows the attacker to impersonate the person and access their data. ​​​​​

Examples of such kits include Evilginx (open source) and the W3LL panel. Protecting against these attacks can be challenging, as they are adept at bypassing MFA safeguards. Threat actors often use compromised LinkedIn accounts, for example, to gain access to substantial information and connections. This enables them to impersonate trusted business connections. Paired with the weaponisation of Agentic AI, this will magnify existing vulnerabilities within an organisation, while introducing new ones that defy traditional containment models.

As it stands, the lack of oversight within organisations on the extent of AI’s adoption by cybercriminals has enabled the emergence of ‘Ransomware 3.0.’ Ransomware has evolved past simple encryption and exfiltration, with this next phase focusing on LLM-driven orchestration and a shift to data integrity manipulation.

To counter AI-accelerated compromises and ‘Ransomware 3.0’ in 2026, organisations must adopt a Zero Trust-based cyber resiliency strategy. This requires businesses to implement strong, non-phishable machine authentication, strict least-privilege access, and constant monitoring to protect the integrity of the data that users and AI agents can access. It should become the baseline expectations rather than aspirational goals for this year.

The Secret Value of ‘Least Privilege’ Access

Another strategy to proactively improve cybersecurity defences in 2026 is to enforce the principle of ‘least privilege’ access. This tactic grants users access only to the data that’s needed for their role. Limiting excessive access is important for preventing the potential for widespread data exposure and damage in the case of an account compromise.

Businesses, however, must strike a balance over access; if it’s too strict, it can hinder productivity and lead to shadow IT issues. Getting this balance right when it comes to privileged access is where sophisticated permission managers are invaluable tools to work with. They streamline the process and remove the guessing game of who and what to grant access to, thereby ensuring, in the case of an attack, that the entire organisation won’t be brought to its knees.

How CISOs are Adopting ‘Resilience, not Perfection’

The rate at which AI is advancing means not every organisation will be equipped with the tools or the know-how to tackle every AI-inspired attack. But as the saying goes, ‘prevention is better than cure’. It’s better to create a strong security culture than to continually chase after the next best tool. 

Organisations can’t strengthen their resilience without involving every single person under their umbrella. That’s why CISOs must continue to invest in cybersecurity awareness programs.

These should include simulated AI-phishing attacks (phishing remains the number one attack vector) to test users and enable them to apply learnings from the modules.

If any user clicks on a phishing email, they should receive additional training at that very moment, to cement the learning. Over time, a good training system should automatically identify users who rarely fall for such attacks and reduce the training they receive while making the simulations they do receive more difficult. Conversely, giving persistent offenders additional bite-sized training and simulations can help improve security outcomes over time.

The key challenge for 2026 is managing the speed of AI adoption and harnessing its defensive capabilities while mitigating the risk of uncontrolled adoption. But with excellent training, cyberattack practice runs, and the adoption of Zero Trust principles, organisations will find themselves in a strong position.

About Dr. Yvonne Bernard

Dr. Yvonne Bernard is the CTO of Hornetsecurity by Proofpoint, Proofpoint’s business unit leveraging the Hornetsecurity product suite dedicated to managed service providers (MSPs) and small to mid-sized businesses (SMBs), providing next-generation cloud-based security, compliance, backup, and security awareness solutions that help companies and organisations of all sizes around the world.

Learn more at hornetsecurity.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Data & AI
  • Digital Strategy

Author

Chris Gunner

Published

4 March 2026

Estimated Read time

4Mins

Chris Gunner, vCSO at Thrive – a leading NextGen MSP/MSSP, delivering global AI, cybersecurity, cloud, compliance, and digital transformation managed services – on how CISOs can position their cyber strategy to to become part of how a business navigates uncertainty

Quantification of cyber risk is a growing trend. While this can be genuinely useful, in practice it is often misunderstood or over-applied by security leaders. It can range from an arbitrary figure to attempting to model every possible risk on the register in a Monte Carlo simulation. The focus can fall on the mechanics of quantification, rather than how financial decision-makers actually use the information.

Think of the CFO – they don’t walk through every penny in the budget. Instead, they usually focus on the board-level levers that can materially affect the business. These often include three key areas: strategic optionality, removing friction from capital events and avoiding shocks and smoothing operating costs. Security conversations should be anchored the same way.

The Importance of Strategic Optionality

If faced with a credible one-year growth plan, CFOs may recommend a one-year office lease despite a 20% premium. This is because it maintains the option later of moving or re-contracting once the growth trajectory becomes more visible. Like most strategic decisions, it is about preserving flexibility in the face of uncertainty, even if that flexibility comes at a short-term cost.

If we apply this to a cyber context, there are often businesses that have taken a calculated gamble with their existing business strategies. While the plan is sound, there is a chance it might not land as expected. When they require security services, the choice between a ‘standard’ and ‘premium’ SOC frames the decision as one of optionality rather than security spend. Paying more now to preserve the ability to adapt later down the line. A simple illustration is incident response. An on-call retainer with defined response times can look more expensive than ad hoc support. Until an incident occurs and procurement becomes the bottleneck. In those moments, flexibility is often far more valuable than marginal savings achieved earlier.

Removing Friction from Capital Events

For CFOs, especially those operating in the alternative investment space, the focus is on structuring capital events. As opposed to managing day-to-day operational costs. One of the most painful points in that process is due diligence. The careful exchange between acquirer and target that aims to provide enough information for each to price risk, without giving the entire game away.

CISOs can materially influence how smooth or painful that process becomes. The most effective support often comes from understanding upfront what the diligence process will look like and preparing accordingly.

For example, they might develop executive-level ‘Security at ACME’ overviews to sit alongside more detailed trust centre or technical reports. Being available to diligence teams for interviews, and for example clearly articulating which services are outsourced to an MSSP, and why, builds credibility between those executive teams.

Decision-makers often don’t look at penetration test reports at a deal level. They are assessing whether the organisation understands its own control environment. A well-prepared CISO who can clearly explain why certain controls exist acts as a trust amplifier during transactions.

It is often the difference between a diligence process that closes cleanly and one that drifts. Two organisations can have similar maturity. Yet the one that can respond within a day with clear, consistent evidence reduces follow-up questions, avoids uncertainty premiums in pricing discussions and prevents security from becoming a late-stage negotiation point.

Avoiding Shocks and Smoothing Operating Costs

For any individual who has worked with a finance partner to define a departmental budget will know that predictability often takes precedence over absolute cost. Contract value can be secondary to payment terms, renewal timing or the ability to forecast spend with confidence.

CISOs can align with this by looking to reduce unplanned operating expenditure. In addition to understanding the cost structure of their controls by communicating with the technical pre-sales engineer, procurement and account teams.

A good example is cyber insurance. While often purchased directly by finance teams, many policies are relatively off-the-shelf and provide access to services the security team already operates or has under contract. Other policies include notable exclusions for the events most likely to occur. Such as a ransomware incident without business interruption cover. In many cases, these gaps can be addressed in-policy with a flat fee or a more predictable cost model.

The value here extends beyond risk transfer and into more predictable costs: replacing reactive spend with planned expenditure.

Aligning Cyber Conversations to Board Priorities

Across all of the above examples, the common thread is that the board is rarely asking security to prove its value in isolation, and is surprisingly comfortable with uncertainty. But they are asking whether the cyber papers support better decisions, fewer constraints and more predictable outcomes for the business as a whole.

CISOs who frame their priorities in those terms will find their conversations move away from justifying individual controls and towards understanding how security choices shape the organisation’s ability to respond to change. In that context, cyber becomes part of how the business navigates uncertainty, rather than a specialist function defending its budget. Speaking the board’s language, ultimately, is less about converting cyber risk into pounds and pence. It is more about understanding which levers matter at that level and showing how security choices influence them.

Learn more at thrivenextgen.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy

Author

Dr. George Papamargaritis & Dr. Konstantia Barmpatsalou

Published

26 February 2026

Estimated Read time

4Mins

Obrela’s Dr. George Papamargaritis (EVP MSS) and Dr. Konstantia Barmpatsalou,  (Blue Team Support Manager) on why embracing a risk-led cybersecurity model will leave financial organisations better positioned not just to meet regulatory requirements but to strengthen resilience, protect customers and uphold the trust that is so essential to the future of financial systems

Cybersecurity in the financial sector was once viewed as a compliance-driven discipline. But as attackers have increasingly targeted institutions with sophisticated, persistent and often internally driven campaigns, it has become a strategic priority.

According to the Digital Universe Report H1 2025, financial services were the second most targeted industry globally, accounting for 19% of all observed cyberattacks. This reflects both the sector’s value to adversaries and the complexity of the digital ecosystems it now operates within.

Regulatory frameworks such as the FCA and PRA’s operational resilience rules, the EU’s Digital Operational Resilience Act (DORA) and NIS2 have strengthened baseline protections. However, the report’s findings demonstrate that regulation alone cannot deliver true cyber resilience. Institutions must adopt a strategic, risk-led approach that looks beyond compliance to understand real threats, behaviours and operational dependencies.

Tailored, Internal and Stealthier Threats

One of the most striking insights from the report is how targeted financial sector attacks have become. Industry-specific security risks now represent 32% of all incidents in the sector. This is an indication that adversaries are designing attacks using detailed knowledge of financial operations, from trading workflows to payment systems.

Internal activity is also a major concern. Suspicious internal activity accounts for 26% of detections across financial services, reflecting the frequency of compromised accounts, misused privileges and lateral movement. For a sector historically focused on defending the perimeter, this shift highlights the need for deeper visibility into user behaviour and identity-driven risks.

The wider threat landscape reveals adversaries are moving away from overt, signature-based attacks. In H1 2025, brute force activity made up 27% of global alerts, while vulnerability scanning accounted for 22% and known malicious indicators for 20%. Notably, direct malware payloads dropped to 0% of trending alerts, replaced by fileless techniques and living-off-the-land methods that bypass traditional defences.

For financial institutions, this is a challenge. Many compliance requirements still centre on endpoint protection, patching and malware controls. These will of course, remain important, but they cannot address threats that are increasingly behavioural, stealth-driven and identity-focused.

Operational Complexity

The financial sector’s cyber risk is intensified by its expanding operational footprint. Cloud adoption, open banking, digital identity models and extensive third-party ecosystems have all created new points of exposure. Financial services operate within a global digital infrastructure that is both vast and increasingly interconnected. This level of complexity cannot be effectively protected through compliance checklists alone.

Regulators are recognising these realities. DORA’s emphasis on ICT third-party risk, operational resilience testing and continuous oversight reflects the need for more proactive, intelligence-driven approaches. But DORA still only sets a minimum standard. True resilience requires institutions to move beyond regulatory expectations and embed cybersecurity into broader business strategy.

Strategic, Risk-Led Cybersecurity

A risk-led approach begins with understanding the threats that pose the greatest risk to operations and customers. Financial institutions remain priority targets for groups such as FIN7, TA505, Cobalt Group and various state-backed actors. Their tactics, such as credential harvesting, remote access tools, web-injection frameworks and lateral movement, are specifically designed to exploit the digital fabric of financial services.

This evolving threat profile puts identity and behaviour at the heart of cyber defence. With credential-driven and internal threats so prevalent, institutions must prioritise behavioural analytics, continuous authentication and zero-trust models that verify users and devices contextually rather than relying on static controls.

Strategic cyber resilience also needs to have continuous assurance. Traditional audits, annual testing and scheduled penetration exercises cannot keep pace with rapidly evolving threats. Leading institutions are shifting toward continuous control monitoring, automated attack simulation and persistent adversarial testing. These practices align with the Bank of England’s CBEST framework and demonstrate a sector-wide move toward ongoing, intelligence-led assurance.

Crucially, cyber risk must be treated as an operational issue, not just a technical one. Embedding cybersecurity into enterprise risk management, financial planning, product development and board oversight is essential. This integrated approach also mirrors the direction of FCA and PRA regulation, which increasingly emphasises governance, accountability, and resilience across the entire organisation.

Beyond Compliance

Financial services underpin national economies and public confidence. As digital ecosystems grow and adversaries become more sophisticated, the sector faces a dual challenge: meeting rising regulatory expectations while defending against complex, targeted attacks. It is clear that cybersecurity must evolve from compliance-driven activity to a strategic capability built on intelligence, continuous assurance and behavioural insight.

Institutions that embrace this risk-led model will be better positioned not just to meet regulatory requirements but to strengthen resilience, protect customers and uphold the trust that is so essential to the future of financial systems.

Learn more at obrela.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Fintech & Insurtech
  • InsurTech

Author

Dan Nichols

Published

23 January 2026

Estimated Read time

8Mins

Dan Nichols, Chief Technology Officer at virtualDCS, on why cloud resilience in the financial services sector hinges on shared accountability and an assume-breach philosophy

A powerful catalyst for transformation, the cloud is reshaping how organisations compete in the financial services sector. Beyond significant cost savings and flexibility, leaders are eager to unlock the potential of AI-driven insights, intelligent automation, and real-time business modelling. And, in a space governed so strictly by data sovereignty and privacy policies, the cloud’s ability to localise, encrypt, and control data has made it a key enabler of compliance and customer confidence.

But as threats become more frequent and sophisticated – with attackers now targeting shared platforms and partner supply chains – organisations can no longer rely on their own defences alone. For true digital resilience, shared accountability, collective readiness, and clear governance across every cloud touchpoint are equally non-negotiable.

All Eyes on the Money

The industry sits at a valuable intersection of data, technology, and finance. A combination that makes it uniquely attractive to attackers. It holds some of the world’s most sensitive data, directly underpins the flow of global capital, and operates through deeply complex and interconnected systems. With every integration increasing the risk of exposure. Ultimately, the attack motivation is as simple and relentless as it is in most sectors: monetary gain. Cybercriminals target institutions precisely because of the value at stake and the speed at which disruption translates to loss.

How the Threat Landscape is Evolving

Ransomware groups may see insurers and payment providers as high-yield targets. They understand even seconds of downtime can induce multi-million pound losses. Under pressure to protect customer trust and avoid regulatory penalties, some firms may choose to pay in order to restore their service quickly. This dangerous perception only encourages repeat targeting and paves the way for damage to spread even further. Yet it remains a common response tactic among many.

At the same time, the rise of supply chain and third-party attacks has made it possible for criminals to bypass even the most well-defended cloud environments. By exploiting shared platforms, managed service providers, and cloud-hosted applications, perpetrators can move laterally across multiple organisations at once, amplifying both the reach and impact of their attacks. In other words, infiltrating one vendor’s weakness can cripple an entire network in one carefully coordinated strike. And, since some firms may overlook the cloud’s shared responsibility model – presuming end-to-end security sits solely with their cloud provider – multiple blind spots can inevitably emerge, creating easy openings to exploit.

In an environment where boundaries blur and dependencies multiply, traditional perimeter-based defences are no longer enough. Hybrid and multi-cloud infrastructures demand continuous visibility, faster detection, and coordinated response across every partner and provider. The goal is not simply to prevent breaches, but to withstand and recover from them collectively. It’s about recognising that in today’s ecosystem, no financial institution is secure in isolation.

Inside the Ransomware Economy

Evolving beyond the scattergun attacks of the past, ransomware now operates as a professionalised, profit-driven ecosystem, where malicious actors collaborate, trade intelligence, and lease attack tools much like legitimate software vendors. The rise of ransomware-as-a-service (RaaS) has even lowered the barrier to entry, giving less skilled affiliates access to ready-made payloads and automated encryption kits in exchange for a percentage of the ransom.

What makes it especially destructive is the precision and psychology behind the attacks. Rather than randomly striking, attackers conduct weeks of reconnaissance – learning behaviours, studying employee hierarchies, and identifying systems most critical to operations. They often infiltrate through phishing emails or compromised credentials, quietly moving laterally through the network to gain elevated access. Once embedded, they disable defences, exfiltrate sensitive data, and target backup repositories before finally encrypting production systems.

At that point, the goal shifts from technical control to financial coercion. Victims are locked out of their systems and presented with a ransom note demanding payment, sometimes in cryptocurrency, in exchange for a decryption key. Increasingly, the threat includes public exposure of stolen data – a tactic designed to pressure leadership into paying to protect their reputation and customer trust. Even when ransoms are paid, recovery is rarely clean: data may be incomplete, corrupted, or resold on the dark web, and repeat targeting is common once an organisation is identified as a payer.

It’s this blend of stealth, strategy, and human manipulation that makes ransomware so difficult to defend against. By the time the encryption begins, attackers have already spent weeks ensuring recovery options are limited. This background isn’t designed to scaremonger, but to highlight why resilience must start long before an attack ever reaches the endpoint.

The Foundations of Ransomware Resilience

Ransomware resilience isn’t achieved through a single product or policy – it’s the outcome of strategic, technical, and cultural alignment. Financial institutions, in particular, must approach it as a continuous process of readiness: Anticipating compromise, containing impact, and restoring normality quickly and transparently:

Assume-Breach Philosophy

The first step is shifting from a defensive mindset to an assume-breach philosophy. In practice, this means recognising that even the most sophisticated systems can and will be breached – and building architectures and response strategies designed to limit damage when this happens. It’s a pragmatic approach, grounded in the reality that attackers are increasingly sector agnostic. No organisation is too small or too secure to be targeted, but the financial sector remains a favourite because it offers both high disruption value and potentially significant monetary reward.

Building meaningful resilience, therefore, demands layered defence and disciplined execution. The goal is to slow attackers down at every stage – detecting them early, limiting lateral movement, and ensuring business continuity when systems are disrupted. Behavioural analytics and continuous monitoring can surface and neutralise subtle anomalies that would otherwise go unnoticed – such as phishing, spear phishing, and malware, with email still the number one entry point for ransomware.

Zero Trust & MFA

Meanwhile, zero trust policies and multi-factor authentication methods add a second layer of protection, blocking unauthorised access even if credentials are compromised.

When incidents do occur, a well-practised response framework ensures action is fast and coordinated, minimising disruption across critical systems, with the ability to switch to secure replica environments to keep operations running while remediation takes place. Secure, immutable, air-gapped backups underpin it all, providing a safety net that guarantees recovery can begin from a clean and uncompromised state.

Human readiness is equally critical. Technology can contain an attack, but only people can recover from one effectively. Regular simulation exercises, incident rehearsals, and cybersecurity awareness training help teams respond calmly and cohesively, transforming response from reactive to instinctive. This operational maturity is reinforced by strong governance. Frameworks such as DORA, NIST, and ISO 27001 provide the structure to align technical teams, compliance leads, and executive decision-makers around shared resilience goals. When combined with skilled practitioners and clear accountability, they embed security into ‘business as usual’ – moving resilience from a strategy to a sustained organisational capability.

Why Multi-Layered Backup is Critical

When ransomware strikes, the speed and integrity of data recovery determine whether disruption lasts minutes or days – and whether the impact cascades through wider global markets. As the last and most decisive line of defence when every other control fails, it’s also fundamental to customer trust and compliance. Yet too often, backup is treated as a static safeguard rather than a dynamic resilience layer.

Since modern ransomware often seeks out and encrypts traditional backups first, a single backup copy or centralised repository is no longer sufficient. True resilience today depends on a multi-layered approach – combining offsite or cloud-diverse storage, immutable data copies that cannot be altered or deleted, and isolated environments to protect against lateral movement.

How frequently these backups are tested is equally important. Too often, financial institutions only discover weaknesses when recovery is already underway, at which point strategies can’t be magically strengthened, and it becomes a race against the clock to minimise downtime and reputational fallout. Regular, automated recovery testing changes that dynamic. It not only confirms that files can be restored, but provides verifiable assurance that systems come back online in the correct order, data dependencies remain intact, and teams have the muscle memory to act quickly and confidently when the worst happens.

The Power of Shared Accountability

In a digital economy so deeply interconnected, no organisation operates in isolation. This is especially true in financial services, where supply chains and service providers form the backbone of day-to-day operations. While this interdependence is a strength in many ways, it also means resilience is no longer defined by how well a single institution can defend itself, but by how effectively every partner in its ecosystem upholds their part of the security chain.

This is where shared accountability becomes critical. It recognises that cloud providers, managed service partners, and financial institutions each have distinct but complementary roles to play in securing data, systems, and infrastructure. When accountability is clearly defined – and when partners collaborate rather than operate in silos – visibility improves, incident response accelerates, and the risk of systemic failure decreases.

Shared accountability also extends beyond contractual obligation. It’s about building a culture of collective readiness: sharing intelligence, rehearsing joint incident scenarios, and supporting smaller or less-resourced partners to raise their security baseline. The result is a unified entity capable of anticipating, absorbing, and recovering from disruption together.

Looking Ahead

To view cyberattacks as inevitable might seem pessimistic to some, but it’s an unfortunate truth that no amount of investment can eliminate risk entirely. In an era where threats are growing in both scale and sophistication, readiness becomes the true differentiator – particularly in such a high-stakes sector. For financial institutions, that means embedding security into culture, strengthening connections across supply chains, and continually testing their ability to withstand and recover as a united ecosystem. Only then can resilience become a strategic advantage rather than a defensive necessity, and unlock the cloud’s transformative potential with absolute confidence.

Learn more at virtualcds.co.uk

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Data & AI
  • InsurTech

Author

Ben Francis

Published

9 January 2026

Estimated Read time

4Mins

Ben Francis, Insurance Lead at Risk Ledger, on navigating cyber threats by reinforcing security from the inside out

Cyber insurance has evolved from a straightforward risk transfer mechanism into an integral component of enterprise risk strategy. As a result, the conversation has shifted beyond simply securing coverage to embracing three foundational elements: transparency in risk exposure, accountability for security measures, and active collaboration throughout the digital ecosystem.

Rather than asking ‘are you covered?’, the more pertinent question has become ‘can you demonstrate measurable risk reduction?’. Insurers and insureds alike are recognising that what matters now is how well an organisation understands and manages its digital exposure, especially across its extended supply chain. Recent data reveals that 46% of organisations experienced at least two separate supply chain-related cyber incidents in the past year, a clear sign that exposure often lies beyond direct control. 

From Risk Transfer to Risk Visibility 

In recent years, the cyber insurance market has matured significantly. Once viewed as a reactive safety net to cushion the financial impact of attacks, it is now becoming a proactive tool for managing and mitigating risk. This shift is partly driven by insurers, who increasingly expect and work with organisations to demonstrate strong security practices and a nuanced understanding of their threat landscape, including risks deep within their digital supply chains; an area where many businesses still fall short.

At the same time, the industry faces a growing challenge from systemic cyber risk within their portfolios, as many businesses rely on the same cloud providers, payment systems and digital platforms, increasing the chance of a single point of failure. Insurers must gain visibility into how policyholders are connected, not only to suppliers but to each other. Tools and frameworks that map and monitor these interconnections will be essential to avoid underestimating the wider impact of seemingly isolated cyber events.

Mapping Beyond Third Parties

It is no secret that cyber attackers often target the weakest link in a supply chain. These are not always direct suppliers, but fourth, fifth or even sixth-tier vendors that have indirect but critical access to systems and data. Unfortunately, many organisations lack visibility beyond their first tier, creating blind spots that attackers can easily exploit. From an insurance perspective, this presents a clear challenge. If an organisation cannot account for who it is connected to, it cannot adequately quantify its risk and neither can its insurer. Mapping these extended connections is more than just a technical exercise; it means actively practiced risk governance and responsibility. Insurers increasingly want to know how their policyholders are identifying and managing indirect dependencies, particularly in sectors like financial services and retail where disruption can ripple across entire markets.

Collaboration as a Risk Strategy 

One of the more underappreciated aspects of cyber resilience is the role of peer collaboration. Unlike physical incidents, cyber threats rarely exist in isolation. A single compromised vendor can impact multiple organisations simultaneously, a fact that has been highlighted by high-profile supply chain attacks such as SolarWinds and MOVEit. 

As a result, businesses need to think beyond their own perimeters and adopt a more collective mindset. This includes building relationships with industry peers, sharing threat intelligence and participating in sector-wide initiatives aimed at improving visibility and preparedness. 

In highly regulated sectors, such as insurance, this collaboration is increasingly being encouraged by oversight bodies. Frameworks like the Digital Operational Resilience Act (DORA) in the EU and initiatives from the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) in the UK are pushing for more transparency around third-party risk. In this context, openness is no longer optional; it will be a regulatory expectation. 

For insurance providers, greater collaboration between policyholders also means better data on emerging threats and more accurate portfolio management. For businesses, it offers a chance to anticipate vulnerabilities that may not yet have hit their own networks but are affecting others in their industry. 

Proactive Transparency Builds Trust 

Organisations that take a proactive, transparent approach to cyber risk management are more likely to secure cover and potentially favourable terms, not just in terms of premiums, but also in access to additional services such as forensic support, incident response sources and legal counsel. 

Demonstrating a mature cyber posture is not about claiming perfection. No organisation is immune to breaches. What insurers are looking for is evidence of a structured approach: the existence of incident response plans, robust governance, effective supply chain risk management, and above all, an honest view of risk. 

A Shift in Mindset 

Ultimately, our understanding of cyber insurance must keep evolving. It should not be treated as a simple checkbox exercise, but as a collaborative relationship between insurers and the organisations they support – one built on shared insight, clear communication, and a drive for continuous improvement.

The organisations best equipped to navigate today’s threats will be those that prioritise transparency. Not only does it lead to stronger protection, but it also builds a culture of accountability that reinforces security from the inside out.

Learn more at riskledger.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Fintech & Insurtech
  • InsurTech