Author

Martin Jakobsen

Published

25 June 2026

Estimated Read time

5Mins

Martin Jakobsen, Managing Director at Cybanetix, on why SOC training and progression will be vital to meet the challenge of AI-driven cyber attacks

The accepted wisdom in cybersecurity is that the Security Operations Centre (SOC) has become overwhelmed. There’s some truth in this. Yes, the time taken to detect and remediate has grown, with IBM stating this now stands at 241 days. Yes, alert fatigue remains an issue, with SOC analysts snowed under 10,000 alerts per day leading to confirmation bias whereby positive alerts are discounted. And yes, alert volumes are rocketing due to a thriving black-market economy in attack kits and services, not to mention the emergence of AI-enabled attacks. Yet the SOC can adjust to these challenges and move with a rising tide if it adopts a paranoid posture.

One of the key attack trends over the past year is for threat actors to gain and maintain access legitimately. It’s for this reason we’ve seen a rise in credential theft (with an 800% increase in 1H2025) and the use of living off the land techniques (LotL). The attacker can log-in and use legitimate, trusted tools to evade detection and move laterally across the network to escalate those privileges. But the very fact these attacks don’t leave telltale footprints can make them much harder to detect. The SOC needs to rely on tools such as endpoint detection and response (EDR) and monitor tool usage to look for anomalies and that means listening to the less noisy network activity and low-severity alerts.

SOC: Selective Hearing

However, most SOCs focus on the high-severity alerts to such an extent that they even measure their success against the resolution of these incidents. SOC service level agreements typically specify a mean time to detection (MTTD) of 30 minutes and a mean time to respond (MTTR) of 15 minutes but the small print will often reveal this only applies critical alerts. Medium level alerts will typically be responded to within 1-2 hours and those low-level alerts that could indicate a LotL attack? Those are relegated to a window of 12 hours or more.

To capture this range of alerts will require the SOC to process ten times the usual volume of events. This presents the SOC with a quandary. How do you increase the monitoring and the ingest of alerts without submerging a SOC team who may already be drowning? For that to happen, the SOC must stop being selective and instead become more efficient.

To begin with, automation must be extended. Many teams will already be using Security Orchestration Automation and Response (SOAR) which can be configured to automatically remediate and close cases. But there are numerous other processes that can also benefit from automation. These can see the application of threat intelligence, automatic threat hunting and telemetry gathering, artificial testing, correlation with other alerts, and entity mapping, all of which can be used to enrich cases to the point where the SOC analyst doesn’t need to gather any further information when picking up the case.

Recovering from Cybersecurity Incidents

If we take the pre-defined playbooks that contain the recipe for how to detect, contain, eradicate and recover from specific cybersecurity incidents, for example, these can be automated to respond in a cascading effect. This sees one playbook used to trigger another depending on what the first has discerned, so that sub-playbooks iterate through lists of entities for each part of the case. Assuming 4,000 alerts coming into the SOC, triggering 100 playbooks per alert, with each playbook performing around ten actions such as enrichment lookups, correlation queries and containment steps, that’s equivalent to over four million triggered automations being executed per day before these cases are passed to a human analyst.

AI and the Analyst

AI, too, has a role to play. It currently enables the translation of free text questions into syntactical queries of Security Incident and Event Management (SIEM) and EDR data and can also be used to explain alerts, investigations and findings using human-friendly language and to summarise cases. It also lends itself to detection engineering, facilitating the faster creation of playbooks through the creation of code and detection syntax. With many detections sharing the same remedial actions, using AI to recommend a course of action makes sense, reducing analyst workloads substantially. And looking to the future, we can expect it to be used to optimise SOC operations by building playbooks on the fly and through the use of predictive investigative outcomes.

Applying these methods of automation enables any alert to be dealt with much more efficiently. The alert will initially be put through a process of enrichment, with threat intelligence used to compare the alert with known threats. SIEM and EDR searches will then correlate information, after which any associated alerts pertaining to the same entities (i.e. IPs, users, accounts, devices etc.) are linked to the case for the analyst to review. Using these processes, it’s possible to automate 65-70% of all SOC activity, dramatically reducing case workloads and allowing the SOC to process those massive alert volumes.

Human in the Loop

Yet, while automation is critical to adopting a paranoid posture capable of responding to evolving threats, it’s no substitute for the skills of the SOC analyst. Human expertise is invaluable in evaluating, verifying and deciding upon the best course of action and the likelihood is that those skills will become even more pertinent as AI becomes more widely used. This is because the technology can become so goal-driven that it becomes blinkered and can make incorrect deductions. In one instance, an AI agent went on to misinterpret a threat and produce a fictitious kill chain and mitigation advice, revealing the need for a human in the loop (HITL) and traceability in AI.

Paranoid monitoring does require the generation of more alerts for investigation. But we do have the tools and automation capabilities to handle those volumes so that this uptick needn’t equate to a massive increase in alert fatigue. What it does mean is that the role of the analyst will subtly change. They will be augmented by these processes and need to develop additional skillsets associated with validating these outputs, so the SOC will need to continue to invest in continuous training and progression, particularly if they want to hang on to that talent which remains in short supply. But unless we make these changes, the SOC won’t be able to keep pace with emerging threat patterns and will almost certainly fail to meet the challenge of AI-driven attacks.

Learn more at cybanetix.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Infrastructure & Cloud

Author

Gareth Hewitt

Published

23 June 2026

Estimated Read time

5Mins

Gareth Hewitt, Founder of LemonEdge, on why the real lesson from DORA is that resilience has to run through the whole operating model, from the infrastructure underneath it to the controls and workflows used every day

The EU’s DORA regulation has exposed how firms operating in private markets face a set of risks that is not purely about IT.

Designed to reduce financial sector reliance on a small number of infrastructure vendors, the regulation came into force last year. Since implementation it continues to throw a spotlight on risks arising from continued use of manual methods and over-reliance on individual employees’ subject matter expertise.

The regulation is forcing firms to examine how their operating models work under pressure and where risk resides inside workflows. 

A private equity or private credit manager may sit on robust cloud infrastructure at one end of its technology stack, while still relying on spreadsheets, manual handoffs and offline approvals at the other. In that kind of environment, resilience is only as strong as the least controlled part of the workflow.

The real risk often sits inside the workflow

This is where risk accumulates in an organisation – in processes that are not properly systemised. This is amplified when they rely on manual intervention or a small number of people who know how to make them work.

A month-end close supported by spreadsheets and a sequence of offline steps may function well enough in normal conditions. However, it looks far less resilient when deadlines tighten, a key individual is unavailable or an investor query lands at exactly the wrong moment.

DORA, in effect, acts as a pressure test on whether resilience has been built into the operating model or simply assumed. Private markets firms have lived with this kind of exposure for years, often because experienced teams compensate for process weaknesses. Regulation leaves no room for that comfort. The question now is whether the workflow holds up under strain.

With DORA, accountability has moved to the top

One of the clearest shifts under DORA is the level at which accountability now sits. Historically, operational resilience could be treated as a technology matter and delegated accordingly. If a firm had a CTO, responsibility was often there. If it did not, it shifted into finance or operations. DORA has since changed that dynamic. Responsibility now sits with the management body, which is held accountable for the ICT risk management framework. It means resilience is now a governance issue with clear ownership at the top of the business.

That changes the conversation both inside firms and with suppliers. Firms increasingly want hard evidence from their providers. They want to understand incident processes, failover arrangements, access controls and recovery expectations in practical terms. They also want to know when documentation was last reviewed, whether controls have been tested – and what would happen if a system failed.

The weakest point is often internal

For many private markets firms, however, the central issue is not whether a major external provider is resilient in principle. It is whether the firm’s own workflows can withstand increased pressure.

Key-person risk is at the heart of this issue. Many firms have built effective processes around capable individuals who know every workaround and hidden dependency. That may keep the machine running, but it is not the same as resilience. If knowledge is not captured and supported by the underlying platform, the process is weaker than it appears, severely increasing dangers when individuals leave or are unavailable.

The same applies once essential work starts moving outside the core platform into spreadsheets, email chains or offline approvals. Control weakens, visibility drops, auditability becomes harder and recovery becomes more uncertain. In private markets, where reporting expectations are high and investor scrutiny remains intense, that is not a side issue. It goes to the heart of whether the operating model is fit for purpose.

That matters particularly in fund accounting, where complexity has only increased. Reporting expectations are higher, structures are more demanding, and firms need stronger control across workflows. A system built for a different era often pushes work outside the main platform at exactly the point where clarity and control matter most. Once reporting becomes a scramble and key numbers are being pieced together manually, the workflow has already become more fragile than it should be.

DORA is the prompt, not the end goal

Operational resilience has often been treated too narrowly as a compliance cost. In practice, stronger resilience usually brings clearer process ownership, better visibility across workflows and faster responses when investors, auditors or regulators ask harder questions. It also reduces key-person risk and makes growth easier to support because the process does not have to be rebuilt every time complexity increases.

DORA will not solve every vulnerability in private markets operations, nor was it meant to. What it does is raise the bar for accountability, testing and supplier oversight. It shines a harsher light on brittle processes that have survived largely through habit and human intervention. It also makes clear that operational resilience depends not just on policies and providers, but on whether the underlying systems and platforms are strong enough to support controlled, auditable workflows under pressure.

That is the real wake-up call. Resilience has to run through the whole operating model, from the infrastructure underneath it to the controls and workflows used every day. That’s the real underlying lesson of DORA that private markets firms need to heed.

Learn more at lemonedge.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • InsurTech

Author

Simon Pamplin

Published

19 June 2026

Estimated Read time

4Mins

Simon Pamplin, CTO at Certes, on how Quantum computing will eventually force a reckoning with the cryptographic assumptions on which the financial system is built.

Financial institutions hold some of the most sensitive and long-lived data of any sector. Customer identities, decades of transaction records, credit histories, and proprietary trading information must be kept confidential, not just today, but far into the future. The cryptographic systems guarding that data, however, were built for a different era; one in which quantum computing was purely theoretical. That era is ending.

Recent guidance from both the G7 Cyber Group and the UK’s National Cyber Security Centre has made the stakes explicit: financial organisations should complete their transition to post-quantum cryptography by 2035. For institutions managing sprawling, decades-old technology estates, that deadline is less reassuring than it might first appear. Ten years sounds like breathing room. In practice, for organisations of this complexity, it is barely enough.

Quantum Risk: The Threat Doesn’t Wait for the Technology

The most common mistake in discussions about quantum risk is treating it as a problem for tomorrow. The assumption is that until a quantum computer powerful enough to crack modern encryption actually exists, there is no immediate danger. That assumption is dangerously flawed.

Sophisticated adversaries are already operating on a longer time horizon. The strategy, widely referred to as “harvest now, decrypt later,” involves systematically collecting encrypted data today and storing it until quantum computing capabilities catch up. No quantum computer is needed to execute this phase of the attack, only patience and storage.

For the financial sector, the implications are particularly serious. The data being harvested now, customer records, transaction histories, and commercially sensitive communications, could have a useful life measured in decades. By the time it is decrypted, the individuals and organisations it concerns will still be very much affected by its exposure. This is not a theoretical future liability. It is a risk quietly accumulating in the background of every financial institution that has not yet begun to act on it.

Why Updating Financial Systems Is So Hard

The cryptographic methods underpinning most financial infrastructure today, primarily RSA and elliptic curve cryptography, derive their security from mathematical problems that are extraordinarily difficult for conventional computers to solve. Quantum computing threatens to render those problems tractable, potentially dismantling encryption that currently appears robust.

Responding to that threat, however, means working through some of the most technically complex environments in any industry. Core banking platforms were often built 20, 30, or 40 years ago. Cryptographic functions are frequently embedded deep within application logic, firmware, or hardware, in payment terminals, ATMs, and proprietary systems that were never designed with replaceability in mind.

Replacing or updating these components is not a software patch. It can mean recertifying devices, replacing physical infrastructure, or undertaking large-scale application rewrites, all while maintaining continuous service to customers and satisfying stringent regulatory requirements. Progress is possible, but it is measured in years, not quarters.

Rethinking Security from the Data Outward

The quantum threat is also accelerating a broader rethink of how financial institutions approach security architecture. Perimeter-based defences, firewalls, VPNs, and network segmentation have consistently shown their limitations when attackers can move laterally through systems using legitimate credentials or compromised access. Relying on the boundary to keep data safe has a poor track record.

A more resilient approach centres protection on the data itself. By applying strong controls directly to information as it moves across systems, organisations can maintain security even within legacy environments that cannot be immediately upgraded. Sensitive data remains protected regardless of where it travels or which network it traverses.

Alongside this, crypto agility, the ability to swap out cryptographic algorithms and rotate keys without overhauling entire systems, is becoming a fundamental requirement rather than a nice-to-have. The transition to post-quantum standards will not be a one-time event. Cryptographic best practice will continue to evolve, and institutions that have built flexibility into their architecture will be far better positioned to keep pace.

The Cost of Inaction

The financial sector has a well-established capacity to absorb and adapt to technological change. It has navigated the transition to digital banking, the rise of real-time payments, and successive waves of cybersecurity threats. The quantum challenge is different in one important respect: the timeline for harm is already running.

Regulatory expectations are being set now. Adversaries are collecting encrypted data now. And the internal processes required to modernise a major financial institution’s cryptographic infrastructure take years to complete. The gap between when action is needed and when it can realistically be delivered is not wide, and it is narrowing.

Preparation does not demand panic or the immediate replacement of every system. It demands a clear-eyed audit of where sensitive data lives, an honest assessment of which information carries long-term confidentiality requirements, and a commitment to building security architectures that can evolve as the threat landscape does.

Financial institutions that move early will not simply reduce their quantum exposure. They will emerge with stronger, more adaptable security postures and with the trust of customers, regulators, and partners intact.

Quantum computing will eventually force a reckoning with the cryptographic assumptions on which the financial system is built. The question is no longer whether that reckoning is coming. It is whether institutions will be ready when it arrives.

Learn more at certes.ai

  • Artificial Intelligence in FinTech
  • Blockchain & Crypto
  • Cybersecurity in FinTech
  • Data & AI
  • Digital Strategy
  • Fintech & Insurtech

Author

Rob Demain

Published

22 May 2026

Estimated Read time

5Mins

Rob Demain, CEO at e2e-assure, on why the clock is ticking when it comes to IT/OT convergence for Critical National Infrastructure (CNI) and associated organisations

Many critical national infrastructure (CNI) operators lack the ability to protect their infrastructure despite the UK being subjected to daily sub-threshold cybersecurity attacks, according to the Strategic Defence Review 2025. It’s a situation that the Network and Information Systems (NIS) regulations, introduced back in 2018, sought to prevent. But since its inception, just over half of the operators of essential services have updated or strengthened their existing policies and processes, leaving many woefully unprotected. 

In desperate need of reform, NIS is set to be superseded by the Cyber Security and Resilience Bill (CSRB), which is expected become law later this year, at which point a consultation on implementation proposals will commence followed by secondary legislation and an adjustment period for stakeholders. The bill will broaden the scope to include other organisations deemed critical to the national economy i.e. data centres, Managed Service Providers (MSPs) and critical suppliers. Plus, the government reserves the right to extend those categories still further as part of its ‘future proofing’, which will enable changes to be made to the act to accommodate emerging threats and potential targets. 

New Demands 

All of these new entities will need to comply with the Cyber Assessment Framework (CAF), which lays out expected cybersecurity and resilience outcomes. First published in 2018 to support NIS, it has undergone a number of revisions since, with v4.0 released in August 2025. This version places a far greater emphasis on proactive security and decision making based on real threat intelligence. As well as adding new contributing outcomes on understanding threats and secure software development and support, it also expands the sections on security monitoring and response and recovery, while an entirely new category has been added on threat hunting.   

All of this points to a far greater emphasis on being able to demonstrate assurance and proactively monitor all aspects of CNI infrastructure and that means more scrutiny of both IT and Operational Technology (OT). Until recently, securing OT wasn’t seen as a priority. These systems were chiefly concerned with maintaining system availability and minimising downtime. But their increased integration with IT systems to connect with the industrial Internet of Things (IIoT) and deliver real-time monitoring, for example, are exposing these systems to attack, with threat actors able to move laterally from one environment to the other.  

The threat posed by IT/OT convergence is well known, but it continues to be the Achilles heel of CNI, as revealed by the Volt Typhoon attack. This saw Chinese nation state actors maintain persistence across CNI in the USA since at least 2021 through the use of Living off the Land techniques, illustrating just how insidious and sustained these cybersecurity attacks can be. 

Securing IT/OT Systems 

It’s these types of threat the CAF addresses through its risk and asset management requirements. Organisations must risk assess systems with respect to their dependencies and interactions with other systems such as IT/OT, and document and understand those dependencies. But other complementary frameworks can also be used to map IT/OT system security, such as the ISMS within ISO27001 from an IT perspective and IEC 62443 from the OT side, in addition to ISO/IEC 27019 for process control systems. 

Being able to follow these frameworks will require organisations to increase their security monitoring of both IT and OT and the transparency of their processes. They will need to transition from being reactive to proactive, and become resilient and risk informed, which will mean many will have to change their approach. These are really the only options available to them in this respect if they are to move the resilience needle. 

The first is to decentralise and harden OT systems while keeping them segregated from IT. However, hardening alone can’t keep pace with digital transformation. Many OT assets cannot support multi-factor authentication (MFA) or accommodate rapid patching because they are downtime sensitive. So, surface hardening alone won’t confer the resilience needed long term.  

The second option is to manage IT and OT together by giving everything an identity in a converged environment, but to do that you need to move the monitoring of OT into the Security Operations Centre (SOC). Centralised monitoring allows threats to be detected across both IT and OT networks, for teams to monitor east-west traffic, and to correlate alerts that might otherwise appear unrelated. And it’s this centralised management that will provide the visibility and control needed to improve IT/OT resilience.  

Converged Cybersecurity 

Such a converged SOC doesn’t just offer continuous visibility over IT, industrial control systems (ICS), OT and cloud environs, but also the real-time triage of critical alerts. These might include unauthorised PLC logic changes, unsafe set-point writes, abnormal OT protocol behaviour, lateral movement in ICS DMZs, OT malware,or unauthorised remote access into OT environments. These alerts are then grouped by operational impact, such as whether they present a safety critical risk or could lead to service degradation, so that they can be prioritised. Weekly threat hunts and detection surface validation over distributed environments provide the threat hunting capabilities needed to meet the CAF requirements and the SOC evidences and provides that all important audit-ready compliance mapping to meet the demands of other frameworks too such as IEC 62443, and ISO/IEC 27019. 

Whether standing up a converged SOC internally or outsourcing, this capability is the most efficient way to adapt to the tightening regulations, particularly as we can expect ‘future proofing’ to lead to yet more demands. The emphasis is now firmly focused on the proactive monitoring of both IT and OT systems together, given their growing dependencies, so it makes sense for those organisations in scope – as well as those who could soon be – to begin to move their OT monitoring from the plant and into the all-seeing all-knowing enclave of the SOC.  

Learn more at e2e-assure.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Fintech & Insurtech

Author

Dan Brightmore

Published

29 April 2026

Estimated Read time

6Mins

Andrew Power, Head of UK&I at Tricentis, on why the right approach to AI can deliver the foundation for more resilient, predictable systems

Artificial intelligence is reshaping software delivery in financial services. Code that once took teams weeks to develop can now be generated and deployed in a matter of hours. This isn’t just about faster delivery; it changes the fundamentals of how software is built and how it behaves in production.

Financial institutions have moved quickly to integrate AI across core systems, from customer operations to anti-money laundering (AML) and software development to capture efficiency and innovation gains. UK parliamentary evidence shows adoption is already widespread, with the majority of firms using AI, and more planning to follow.

But as adoption spreads and becomes more embedded within key systems, so does exposure. Risk is no longer confined to individual defects, but shaped by how quickly those defects can spread across interconnected environments.

AI has removed the limits on how quickly software can be created, but not on how confidently it can be trusted, and financial institutions can now generate and deploy code faster than they can safely validate it.

This creates a new paradox: AI is both accelerating the pace of software change and increasing the speed and scale at which failures can materialise.

Machine-Speed Failure

AI-driven development shortens the distance between change and consequence. Software updates can move through the pipeline from creation to production with significantly less friction. However, this also reduces the time available to identify, flag and contain any issues before they have an impact.

AI-driven software changes don’t just move fast, they scale fast. Unlike traditional failures, these are systemic risks. A single misstep in an AI-generated update can propagate unpredictably.

For financial services, this is especially significant when key systems are deeply interconnected, spanning complex layers of infrastructure, integrations, and third-party services. Even a minor defect can propagate quickly across systems, amplifying its impact.

What would once have been contained can now escalate, cascading across systems and causing wider disruption that affects customers, operations and, in some cases, market activity. In financial services, this is not just a technical issue but a business risk with direct implications for customer trust, regulatory compliance and financial stability. The challenge is no longer simply identifying defects but maintaining confidence in what is being deployed.

This risk is already being felt across the sector. Institutions are accelerating delivery to meet customer expectations and competitive pressures, but often without corresponding advances in validation. Tricentis’ research shows 68% of financial services organisations anticipate outages or serious incidents due to poor software quality.

Regulatory Pressure for AI is Increasing

The issue is also drawing attention from regulators. Earlier this year, the UK Treasury Committee warned that current approaches to AI in financial services are inadequate and could expose customers and the wider system to “serious harm”, highlighting the need for stronger guardrails, clearer accountability and more robust oversight to deploy it safely.

Traditional resilience frameworks were never designed for systems evolving in real time, and AI can no longer be treated as a marginal technology risk. It must become central to how organisations manage and assess resilience.

This marks a shift from software quality being an engineering concern to a board-level issue of operational resilience. If machine-speed change is the new operational hazard, then failure to address it becomes a strategic issue rather than a technical one. With that in mind, financial leaders must acknowledge AI’s dual role as both a driver of risk and a mechanism for preventing it.

AI as Both a Safeguard & Source of Risk

AI also offers the most effective and scalable way to manage the risks it introduces. Advanced AI-driven validation, continuous monitoring and risk-prioritised testing can identify issues earlier than any manual process, helping reduce the likelihood they reach production.

In effect, the same AI that accelerates software creation must now be applied to validation and governance – operating at the same speed and scale.

The same capabilities that facilitate rapid software production can be applied to validation and governance, continuously evaluating system behaviour, detecting anomalies and prioritising testing based on potential business impact, rather than volume. This allows organisations to move beyond rigid approaches and towards more adaptive, responsive quality models that more accurately reflect the way AI behaves.

Instead of relying on standard periodic testing cycles, systems can be validated on an ongoing basis. This enables earlier intervention before issues escalate.

AI can also help organisations better understand the complexity of their own systems. By analysing dependencies across applications and infrastructure, it becomes possible to identify which processes are most critical and where failures would have the greatest impact.

From Acceleration to Control

There is a clear mismatch in how financial organisations approach AI. While many are leveraging AI to accelerate development, far fewer are evolving their validation and governance to keep pace, and it’s in this gap that risk emerges.

This is the “confidence gap”, where organisations can create software faster than they can safely deploy it.

To address this imbalance, firms must treat software quality as a core component of their AI strategy. Development and validation must move forward together. Governance must adapt to continuous, AI-driven change. This requires a move from static testing and coverage metrics to continuous, risk-based validation, where software is assessed in real time based on potential business impact.

If AI is the engine driving software creation, validation must act as the braking system – built in, not bolted on at the end. At machine speed, gaps in control become points of failure. The aim is not to slow innovation, but to ensure it progresses in a way that is sustainable and safe. When validation keeps pace with development, firms can move quickly and competitively, whilst maintaining control over how risk is introduced and managed.

This is a change we are seeing across large enterprises adopting AI-driven quality approaches, where validation, monitoring and governance are increasingly orchestrated together rather than treated as separate processes.

Preventing the Next Outage

The financial sector has already seen how quickly failures can escalate in complex, interconnected environments. In March, an IT error at Lloyds Banking Group exposed the private financial information of nearly half a million customers, prompting the bank to issue £139,000 in compensation.

Such incidents aren’t isolated: over the last two years, more than 33 days of unplanned banking outages have been reported to Parliament, underlining the scale of the issue.

As AI increases the velocity of change, it also raises the stakes for getting it wrong. But the irony is that it also provides the tools needed to prevent these failures from happening in the first place. AI is both contributing to the risk of outages and becoming the most effective way to prevent them.

By applying AI to continuous validation, monitoring and risk detection, organisations can spot issues earlier, understand their potential impact and intervene before disruption occurs. This shifts the focus from reacting to outages to preventing them, and it’s where the paradox becomes constructive. AI doesn’t have to be a source of instability.

With the right approach, it can become the foundation for more resilient, predictable systems. Those that fail risk trading innovation for instability. In the AI era, speed without confidence is simply another form of risk.

Learn more at tricentis.com

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Fintech & Insurtech

Author

Dan Brightmore

Published

24 April 2026

Estimated Read time

7Mins

The Innovate Finance Global Summit (IFGS) once again set the tone for London FinTech Week, transforming the historic Guildhall into…

The Innovate Finance Global Summit (IFGS) once again set the tone for London FinTech Week, transforming the historic Guildhall into the beating heart of global financial innovation on Tuesday April 21st 2026. As the flagship event of the week-long programme, IFGS brought together more than 1,500 senior leaders from over 70 countries. Cementing its reputation as one of the most influential gatherings in the FinTech calendar.

A mix of founders, regulators, policymakers, investors and financial institutions filled the venue’s grand halls, all drawn by a shared ambition: to shape the future of financial services. IFGS has long positioned itself as “where decision-makers meet,” and in 2026 that promise felt particularly tangible.

A Global Stage for a Rapidly Evolving Industry

The summit’s scale and structure reflected the complexity of today’s FinTech ecosystem. Across four stages and more than 100 sessions, attendees were immersed in a dense programme of keynote speeches, panel discussions and live demonstrations.

What distinguishes IFGS from many industry events is its ability to convene not just innovators, but the entire value chain. Fom early-stage startups to global banks, Big Tech firms and regulators. Companies such as Google Cloud, Amazon Web Services and Microsoft were prominent throughout the programme, reflecting the growing convergence of financial services and cloud infrastructure. Where policy meets practice and innovation meets implementation.

The agenda in 2026 was firmly aligned with the industry’s most pressing challenges and opportunities. Themes ranged from AI in financial services and open finance to stablecoins, fraud prevention and financial inclusion. Not juts abstract talking points, but the battlegrounds on which the future of finance will be decided.

Opening Momentum: Optimism with a Call for Action

The day began with a keynote from Innovate Finance CEO Janine Hirt, who set a confident yet pragmatic tone.

“We have built one of the most dynamic fintech ecosystems in the world here in the UK,” she said. “But leadership is not guaranteed. It requires constant innovation, investment and collaboration.”

Hirt highlighted the UK’s continued strength in areas such as open banking, while stressing the need to accelerate progress in digital assets, fraud prevention and global competitiveness.

A recorded address from Chancellor Rachel Reeves reinforced this narrative, positioning fintech as a cornerstone of the UK economy.

“Fintech is not just a success story—it is a strategic priority,” Reeves noted. “We will continue to back innovation, support digital assets development and ensure the UK remains a global hub for financial services.”

The political backing on display underlined fintech’s growing importance—not just as a sector, but as a driver of national economic growth.

AI, Data and the Next Wave of Innovation

Unsurprisingly, artificial intelligence dominated much of the conversation. Across multiple sessions, speakers from firms including NVIDIA, IBM and Accenture explored how AI is reshaping everything from customer onboarding to fraud detection and credit decisioning.

What stood out was the shift in tone. The discussion has moved beyond hype to implementation.

“We’re past the experimentation phase,” said a senior executive from Mastercard during a panel on AI in payments. “The focus now is on scaling responsibly. Embedding AI into core systems while maintaining trust and transparency.”

Similarly, Revolut’s leadership team pointed to AI-driven personalisation as a key differentiator in the next generation of digital banking. “Customers increasingly expect financial services to anticipate their needs. AI enables us to deliver that, but only if it’s built on strong data foundations.”

Closely linked to AI was the continued evolution of open banking into open finance and ‘smart data’. Speakers from the Financial Conduct Authority (FCA) and firms such as Plaid and TrueLayer emphasised the importance of interoperability and regulatory clarity.

“Open finance is the natural next step,” said an FCA representative. “The challenge is ensuring it delivers real value to consumers while maintaining robust safeguards.”

Meanwhile, stablecoins and tokenisation emerged as key themes in the context of global competition. Circle, Ripple and several UK-based digital asset firms contributed to discussions around the future of programmable money.

“The question is no longer if tokenisation will reshape markets, but how quickly,” said a Ripple executive during a digital assets panel.

The Exhibition Floor: Innovation in Action

Beyond the stages, the expo hall offered a tangible view of FinTech’s evolution. Established players such as Lloyds Banking Group, NatWest and Santander UK showcased innovation initiatives alongside emerging startups presenting solutions in regtech, embedded finance and payments.

Fintech scale-ups including Checkout.com and Adyen demonstrated new capabilities in cross-border payments and merchant services, while regtech firms, such as Entrust, highlighted advances in compliance automation and fraud detection.

This blend of established and emerging companies is one of IFGS’s defining strengths. It creates an environment where partnerships can form organically. Whether between a startup seeking scale or an incumbent looking to innovate.

The presence of regulators, notably the FCA, added another layer of value. Initiatives such as onsite ‘office hours’ enabled direct engagement between FinTech firms and regulators.

“Dialogue is essential,” one FCA official commented. “Events like IFGS give us the opportunity to hear directly from industry and shape regulation that supports innovation.”

Networking: Where Deals and Ideas Converge

If content is the backbone of IFGS, networking is its lifeblood. The summit’s design – from curated meetings to informal discussions in the Guildhall’s historic spaces – encouraged meaningful interaction.

With thousands of attendees and a high concentration of C-level executives, the event offered unparalleled access to decision-makers. Conversations between banks, FinTechs and investors were constant, with many attendees citing partnership discussions as a key outcome.

Even external challenges—such as a London Tube strike on the day—did little to dampen participation. If anything, it reinforced the determination of attendees to be part of the conversation.

“Nothing was going to keep people away,” remarked one venture investor. “IFGS is where the industry sets its agenda for the year.”

Key Takeaways: Collaboration, Competition and Confidence

Several clear themes emerged from IFGS 2026.

First, collaboration remains critical. The UK’s fintech success is built on strong relationships between startups, incumbents and regulators.

Second, global competition is intensifying. Whether in AI, digital assets or open finance, the race to lead the next phase of financial innovation is well underway.

Third, there is a growing sense of confidence in fintech’s role as an economic driver.

“Fintech is no longer a disruptor, it is the foundation of modern financial services,” said a senior executive from HSBC during a closing session.

Conclusion: A Catalyst for the Year Ahead

IFGS 2026 delivered on its promise as the centrepiece of London FinTech Week. By bringing together the full spectrum of the FinTech ecosystem in a single venue, it created a powerful platform for dialogue, collaboration and innovation.

More than just a conference, IFGS serves as a barometer for the industry’s direction. The conversations held within the Guildhall’s walls will shape strategies, partnerships and policies in the months and years ahead.

As FinTech continues to evolve at pace, events like IFGS are not just important; they are essential. They provide the space for ideas to collide, for relationships to form and for the future of financial services to be defined.

In 2026, IFGS once again proved why London remains at the forefront of global FinTech. And why the world continues to look to the UK for leadership in shaping what comes next.

  • Artificial Intelligence in FinTech
  • Blockchain & Crypto
  • Cybersecurity in FinTech
  • Events
  • Host Perspectives

Author

Vincent Guillevic

Published

16 April 2026

Estimated Read time

5Mins

Vincent Guillevic, Director of Fraud Labs at Entrust, argues companies that treat identity as a continuous thread rather than a single checkpoint will be better positioned to reduce losses and protect customers

Identity verification and tackling fraud began as a face-to-face process, built on human trust. Opening a bank account involved meeting a banker in person and from there, trust was established because both parties could see and interact with each other directly in branch.

Fast forward to the digital age and a lot of services have moved online. Identity verification has therefore shifted from in-person checks to remote identity verification. Today, we’re in an era where identity is now central to every interaction we have online.

Fraud has followed the same trajectory. Much like a burglar would test every possible entry point rather than just the front door, fraudsters probe every stage of the customer journey. They look for weaknesses at onboarding, during login, and throughout ongoing transactions and data requests.

That challenge has intensified in recent years. AI has given fraudsters faster, sophisticated and scalable tools. Deepfakes can bypass checks, AI‑generated documents can appear real, and phishing and impersonation attacks can now be automated at scale.

Once a fraudster gains access to a legitimate account, the damage escalates quickly. Global losses from account takeover (ATO) fraud were projected to reach $17 billion in 2025, up from $13 billion in 2024. While the underlying intent of fraudsters seeking the weakest point of entry, the breadth, speed and sophistication of modern attacks have.

Identity Fraud Patterns Across the Customer Lifecycle

Fraud can occur at any stage of the customer journey. From verifying identity at onboarding to securing connections and fighting fraud in everyday transactions. Each stage introduces its own risks, and attackers adapt their tactics based on where value can be extracted most efficiently.

In 2025, patterns showed a clear distinction between industries targeted for new account fraud and those targeted for account takeover fraud. Businesses that offer immediate incentives such as promotional offers or sign-up bonuses are primarily targeted for new account fraud. In contrast, businesses where accounts accumulate long-term financial or data value face higher levels of ATO.

Industries built around sign-up incentives or instance access experience most fraud at onboarding. For instance, in crypto, 67% of fraud attempts occur during account creation, largely driven by sign-up incentives. Vehicle rental follows a similar pattern, with 67% of fraud taking place at onboarding as attackers use fake identities to gain short-term access to high-value assets. In these sectors, low-friction onboarding creates opportunities to harvest incentives or establish accounts that later become avenues for future money laundering.

Account takeover fraud reflects a different strategy. Rather than creating fake accounts, attackers focus on compromising established accounts using tactics such as stolen credentials, phishing, malware, or social engineering. Entrust data shows this is most common in industries where accounts hold enduring value. In payments, 82% of fraud attempts occur after onboarding, while in professional services the figure is 62%. High-value, long-standing accounts are attractive because they enable fund transfers, loans, and access to identity-rich data, making them more valuable than newly created accounts.

These patterns highlight two critical realities. First, organisations can no longer optimise for one type of risk at the expense of another. Defending a single point in the journey inevitably leaves gaps elsewhere. Second, fraud has become highly professionalised. Modern fraud operations are organised, strategic, and adaptive, moving toward the highest rewards and the weakest controls.

Prevention Must Span the Entire Journey

If fraud can occur at any stage, prevention must operate at every stage. Organisations that implement robust, lifecycle-wide identity strategies save an average of $8 million per year in fraud-related costs. These savings come from detecting threats earlier, more accurately, and beyond a single checkpoint.

There are three areas where that lifecycle approach needs to be strongest.

Get onboarding right

Onboarding is the first opportunity to establish genuine trust. Strong Know Your Customer (KYC) or Know Your Employee (KYE) processes combine document verification with biometric checks such as face recognition or fingerprint scanning to confirm that the person applying is who they claim to be. Liveness detection adds a further layer by distinguishing real users from synthetic identities and deepfakes, which are linked to approximately one in five biometric fraud attempts.

With strong identity verification at onboarding not only reduces immediate fraud, but also limits the downstream damage caused with fraudulent accounts.

Secure existing accounts with continuous authentication

Verifying identity once is no longer sufficient. Continuous authentication, combining multi-factor authentication with biometric re-verification like facial recognition, allows businesses to protect established accounts without creating unnecessary friction for legitimate users.

Crucially, it enables authentication requirements to adapt dynamically as risk levels change, rather than applying the same static check regardless of context. In payments businesses, where most fraud targets the authentication process itself, this adaptability is key to mitigating attacks before losses occur.

Monitor behaviour in real time, not just identity

Device intelligence and behavioural signals make it possible to assess risk based on how users interact with services, flagging unusual login patterns, device anomalies, or out-of-character transactions.

As AI-driven fraud becomes more sophisticated and convincing, behavioural indicators provide another layer of ongoing fraud detection. Focusing monitoring on high-risk actions, rather than only high-risk identities closes a critical gap in traditional defences.

The Window of Opportunity

Fraud has always followed the customer journey. What has changed is the availability of advanced technology capable of tracking, analysing, and responding to threats at every stage. The key question for organisations is whether these capabilities are deployed as a connected strategy or left as isolated controls with gaps in between.

Companies that treat identity as a continuous thread rather than a single checkpoint will be better positioned to reduce losses and protect customers, and preserve the trust that underpins long-term digital relationships.

Learn more at entrust.com and meet the team at IFGS in London on April 21

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Fintech & Insurtech

Author

Dan Brightmore

Published

15 April 2026

Estimated Read time

4Mins

Read in brochure format

FinTech Strategy is back with more key insights from the industry experts and thought leaders shaping the future of financial…

FinTech Strategy is back with more key insights from the industry experts and thought leaders shaping the future of financial services.

Read the latest issue here

Vibrant Capital: Scaling AI on Main Street

Our cover star Shadman Zafar, Founder & CEO of Vibrant Capital, is building a CIO-led model for enterprise transformation. Vibrant Capital is an operator-led investment and company-building platform focused on scaling AI in the real economy. “We don’t spray investments across hundreds of AI startups. We curate a portfolio with purpose – selecting companies that solve the real mission-critical problems CIOs face in scaling AI adoption.”

FNB: Redefining Data Science in Commercial Banking

We also hear from Yudhvir Seetharam, Chief Analytics Officer at South Africa’s First National Bank (FNB) on a data science journey characterised by curiosity, culture and the drive for a competitive edge. “Ours is a holistic approach focusing on the customer,” he explains. “Understanding the context of each customer journey and then using that context so that when we interact with you, we’re able to drive the right conversation with the right customer, at the right time, through the right channel and for the right reason. These ‘five rights’ make our interactions with clients more impactful.”

Virginia Farm Bureau: An Enterprise CIO’s Journey

Shifting focus to the world of insurance at the Virginia Farm Bureau, we spoke withan Enterprise CIO at a complex mission-driven organisation. As he approaches retirement, Patrick (Pat) Caine reflects on his career as a CIO and the centennial of an organisation renowned for resiliency, collaboration, commitment to a greater cause, diversity and service to its members. “In my role as CIO, I’ve always been that person who connects the dots between business needs and technology execution. Virginia Farm Bureau is digitally relevant, collaborative, and well‑positioned for the future.”

Mastercard: Protecting Trust in the Digital Economy

Michele Centemero, EVP Services at Mastercard Europe explains why promoting awareness, stronger collaboration and data-sharing, and continued innovation of payments ecosystems, will be critical in reducing the impact of scams and protecting trust in the digital economy. “The combination of AI, robust identity controls and open banking can help protect consumers from scams, whether across card and account‑to‑account payments or in fraudulent account openings.”

Thales on AI Security: How FinServ’s Budget Priorities Signal a Boardroom Shift

Todd Moore, Global VP – Data Security Products at Thales, reveals why making AI security a boardroom priority today, will help firms position themselves to capture competitive advantage, safeguard customer confidence, and define the future of secure innovation. “Balancing AI’s opportunity and risk means embedding security at every stage, from design to deployment and ongoing monitoring.”

Paymentology: The First Live AI-Agent Payment Is a Test for Credit Infrastructure

Thomas Benjaminsen Normann, Product Director at Paymentology, dissects the future for agentic payments and the progress still to be made. “Agentic payments demand something more granular: a clearer account of who or what acted, under what limits, and with what right to create a liability on the customer’s behalf.”

Also in this issue, we hear from Publicis Sapient, on why asset managers must redesign their enterprise for AI-driven decision intelligence; learn from Bitpace why the most resilient payments infrastructure will be the one with the most adaptability; rank the AI maturity of 12 of the largest payments networks in the latest Evident AI Index; and round up the key FinTech events and conferences across the globe.

Enjoy the issue!

Read the latest issue here

  • Artificial Intelligence in FinTech
  • Blockchain & Crypto
  • Cybersecurity in FinTech
  • Data & AI
  • Digital Payments
  • Embedded Finance
  • Fintech & Insurtech
  • InsurTech
  • Neobanking

Author

Michele Centemero

Published

14 April 2026

Estimated Read time

5Mins

Michele Centemero, EVP Services, Mastercard Europe on why promoting awareness, stronger collaboration and data-sharing, and continued innovation of payments ecosystems, will be critical in reducing the impact of scams and protecting trust in the digital economy

As our world becomes faster, smarter and more interconnected, scammers are evolving in parallel, developing increasingly sophisticated ways to exploit people’s trust. By harnessing new technologies and behavioural insights, they are refining their methods to appear ever more credible and convincing.

While attacks on systems continue, today’s fraudsters are increasingly targeting people, often relying on psychological manipulation to achieve their goals.

Understanding Social Engineering

Many modern scams fall under the umbrella of social engineering,which isthe use of deception and emotional manipulation to influence a person’s behaviour.

In the digital world, cybercriminals use these tactics to build false trust, create urgency or fear, and ultimately trick people into sharing confidential information or taking actions that can cause financial harm to themselves or their employer.

Recent European industry data indicates that social engineering-related fraud and authorised push payments (APPs) – where victims are tricked into sending money to fraudsters posing as legitimate payees – now account for a growing share of overall scam losses[1].

This is directly impacting a growing number of consumers, with the majority of people saying they’ve experienced some form of scam or fraudulent attempt to capture their personal information highlighting why awareness and vigilance are critical for people of all ages.

Education is the First Line of Defence

Protecting consumers and businesses from malicious activity is a priority, and it starts with awareness. When people understand how scams work, they’re more likely to spot the warning signs before it’s too late and be empowered to protect themselves against fraudsters.

Three of the most common social engineering scams to watch out for are:

  • Imposter fraud – Criminals pose as trusted organisations (such as banks, retailers, or government bodies) to pressure victims into sharing personal or financial details. Research indicates over half (53%) of European consumers have been targeted via phone or voice call scams, with social media scams affecting around two in five people, and tech support impersonation tricking roughly one in three.*
  • Phishing – Fraudulent emails, texts, or messages that are designed to look legitimate, often urging immediate action like clicking a link or resetting a password, leading victims to disclose sensitive information or install malicious software. Nearly three in five (58%) have received phishing emails or fraudulent text messages (63%) and QR code scams are on the rise, impacting nearly a quarter of Europeans.*
  • Romance or honeypot scams – Scammers build emotional relationships over time, gaining trust before exploiting it for financial gain. These types of attacks are also widespread, with one in four people (24%) encountering fake profiles, requests for money, or online relationships that lead to financial exploitation. These scams hit younger generations hardest, with 40% of Gen Z and 35% of Millennials affected, compared with 21% of Gen X and 11% of Boomers.*

How Businesses Can Protect Consumers from Scams

With fraudsters increasingly using AI to commit more sophisticated, larger scale attacks, businesses and banks should also consider how they deploy technology to protect customers from bad actors.

The combination of AI, robust identity controls and open banking can help protect consumers from scams, whether across card and account‑to‑account payments or in fraudulent account openings.

Looking at identity controls specifically – take the example of continuous identity verification, a fraud prevention measure that verifies the user is who they claim to be throughout the entire lifecycle journey. This helps to prevent scammers from opening or taking over accounts to apply for credit, create ‘mule’ accounts or impersonate others.

Behavioural biometric data is often used as part of this and can be used to analyse how a user interacts with their device – from typing patterns to on‑screen movements – to flag unusual behaviour.

More in depth, AI powered transaction analysis can also help banks and financial institutions to stay ahead of payment threats. It provides banks with the intelligence needed to detect and stop payments to scammers, using AI and a network-level view of account‑to‑account transactions to enable intervention before funds leave an account.

Staying Ahead of an Ever-Evolving Threat

As social engineering tactics continue to evolve, staying ahead requires a combination of intelligent technology, consumer education, and proactive action from businesses and financial institutions.

While no single measure can eliminate risk entirely, greater awareness, stronger collaboration and data-sharing, and continued innovation of payments ecosystems will be critical in reducing the impact of scams and protecting trust in the digital economy.

*Source: This study was conducted by The Harris Poll on behalf of Mastercard from September 8 to September 25, 2025, among 5000+ consumers in the following European markets: EUR: France (n=1,005), Germany (n=1,002), Italy (n=1,016), Spain (n=1,005), UK (n=1,004)

Mastercard: Transforming the Fight Against Scams

Innovation – Our advanced AI-powered Identity insights examine digital footprints and assess unique patterns to detect risk and flag suspicious activity indicative of scams.

Collaboration – We collaborate across industries, partners and organizations worldwide to secure the digital ecosystem, ensuring payments are safe for all. Combating the growing threat of scams demands a collective effort.

Education – We work with and through our collaborators to provide knowledge and tools that help people protect themselves and their loved ones from scams, while also working to destigmatise the experience of being a victim.

  • $12.5bn in losses from U.S. consumer reported online scams in 2023
  • $486bn in global losses from scams and bank fraud schemes in 2023
  • 22% YoY growth in U.S. consumer scam losses suffered in 2023

From sender to recipient, we vigilantly monitor accounts and transactions for any elevated scam risk

Identity insights – Provides actionable identity insights and risk scores for businesses to improve identifying their good customers from the scammers creating “mule” accounts or impersonating someone else with a false identity.

Transaction patterns – Flags suspicious activity across the money movement flow to prevent payments to scammers before it is sent through the real-time analysis of transaction elements.

Account confirmation – Enables account validation to confirm account ownership and validate identity details in real-time through our open banking capability, which draws on the safe exchange of consumer-permissioned data to facilitate frictionless and secure payments.

Learn more at mastercard.com

[1] Joint EBA-ECB report on payment fraud: strong authentication remains effective, but fraudsters are adapting

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • InsurTech

Author

Lee Fredricks

Published

10 April 2026

Estimated Read time

6Mins

Lee Fredricks, Director – Solutions Consulting, EMEA at PagerDuty, on why technology leaders should see 2026 as a time for operational resilience to shift from ambition to accountability

Technology leaders should see 2026 as a time for operational resilience to shift from ambition to accountability. In 2025, too many cloud services outages and disruptions took place across the public and private sectors, and now regulatory, technological and cultural pressures are converging to say that enough is enough.

Outages often translate into broader repercussions for the organisation, including revenue impact, customer churn, share price pressure and potentially regulatory reporting obligations. Operational metrics must now be discussed alongside financial KPIs at the board level. C-suite leaders understand accountability, especially within the very regulated financial sector.

DORA’s First Birthday

It’s now been one year since the implementation of the Digital Operational Resilience Act, or DORA, introduced by the EU to strengthen the digital resilience of financial institutions. By now, organisations have had time to consider moving from mere compliance to creating a competitive edge from their investments.

Enterprise tech leaders are in the middle of a balancing act. They’re managing ongoing modernisation and transformation initiatives while navigating multi-jurisdictional regulatory scrutiny. At the same time, they face constant pressure from the board and must meet evolving customer needs—all competing for immediate attention. The stakes have never been higher. Operations teams are no longer viewed as a back-office IT function. Their success in keeping the organisation running and driving revenue is now a board-level concern.

For organisations today, IT is business delivery.

A year of DORA has seen organisations make the shift from focusing solely on mere compliance to setting meaningful demonstrable testing, third-party risk visibility and strictly mandated incident reporting timelines. Financial firms have lessened their exposure to risky situations. Payments providers aren’t only reliant on a single cloud region or SaaS supplier, or unable to provide evidence of real time incident response efforts and auditable logs after a disruption.

One benefit of these overall systemic improvements is enhanced supply chain accountability. Financial institutions and their technology partners are both liable for potential penalties and reputational risk, which makes it highly critical that they can prove their resilience capabilities.

Nevertheless, operational resilience is a continuous discipline. A fragmented incident response can expose firms to regulatory and reputational risk again and again if not addressed systemically. As such, many organisations are looking toward AI agents as part of a move towards ‘no-touch’ operations.

From Autonomy to Self-Healing

Under set policies, autonomous agents can handle incident response and operational tasks, such as detection, triage and remediation. AI agents deployed in operations may become the backbone of L1 (first contact) and L2 (more skilled) support. Contrast this with the traditional, reactive, ticket-driven model of IT. The industry can move much faster and with a higher successful close rate. Leveraging intelligent automation reduces mean time to detection/resolution and KPIs around lower incident volumes reaching L3. Additionally, it can lead to improved service availability percentages. Well integrated agents that actually support existing operations teams also help manage the issues around talent shortages faced by many organisations.

A typical incident lifecycle with agentic processes includes several stages depending on the model, but can be summarised as: Anomaly detected, correlated with recent deployment, a remediation script triggered and a human notified if set thresholds were breached. Such no-touch operations are golden in any sector, but particularly with industries such as digital banking and retail, where peak traffic periods demand near-instant response and poor customer experience is a powerful motivator for users to instantly change providers.

IT Standardisation

In addition, consider standardisation as part of strategic infrastructure best practices. There is a role for central operations clouds and operational ‘golden paths’ as solid foundations for reliable operational scale and dependability. Standardisation enables consistent, scalable operational excellence especially across large, distributed enterprises. ‘There is one way and it is the right way’ can be a great time and stress saver for operational teams – particularly if a regulatory notification and clear evidence is required.

For example, a global bank might define a single golden path for deploying customer-facing applications with pre-approved monitoring, incident response workflows, and regulatory reporting templates built in. In an outage, teams follow the same process and automatically capture the evidence required for regulators, avoiding confusion, delays, and compliance risk.

All of these possibilities take us to an exciting new place for an evolved set of developer and operational roles. When organisations enable AI to reshape daily engineering work away from manual firefighting and low-value work it frees headspace and time for developers and engineers to move into more architectural thinking and intelligent oversight of automated systems. These augmented teams will be empowered to manage simple situations instantly and devote more time and attention to the more difficult issues – the edge cases and the strategic necessities.

Enabling Agentic AI

Using another lens, businesses with agentic IT operations capabilities support their current talent, extending their reach and the speed of their response. The winning organisations will be those who deploy agents strategically, freeing up humans for that higher-value work – i.e. L3 expert support – and setting new standards for operational excellence that customers can rely on. Ideally this means making commensurate investment in existing people, training and organisational change management. A culture of continual upskilling and forecasting that points humans to where they make the best impact will be just as important as the autonomous tech tools working alongside them.

Autonomous agents allow many new services, and one of those can be described as self-healing operations. This evolution of the operations world is where predictive detection, automated remediation and embedded resilience all coalesce. With an autonomous process of testing, maintenance and remediation, organisations can focus on finely measuring improved customer trust. They can also enjoy the productivity and revenue benefits of high business continuity and availability.

AI is still a new technology, and many are legitimately concerned with the concept of autonomous agents. There is a need for clear guardrails, audit trails and explainability in automated remediation, and many technology partners have invested in their ability to support across these areas. Moreover, firms must maintain direction with policy-driven automation rather than uncontrolled autonomy, particularly in regulated industries.

Mandate Operational Excellence

This year is very likely to reward organisations that treat operational resilience as core to their business strategy. Those investing in automation, standardisation and governance will set the pace for their industries in an AI-enabled and increasingly autonomous world.

Regulators are already expanding their scrutiny and reliability expectations beyond financial services firms. Across the world, jurisdictions are increasingly looking to strengthen their economies and digital services in particular through resilience and cybersecurity measures. At the same time, agentic operations, and the organisational performance benefits they support, will rapidly become table stakes technology in all sectors. Inevitably, customers will judge brands on digital reliability as much as price or product features when evidence of outages are a click or a headline search away.

Start now. Audit internal incident response maturity, review the potentially complex web of third-party IT dependencies and identify where automation makes clear business sense. While resilience is an investment in compliance, it is also critical to ensure customer trust and future stability.

Learn more at pagerduty.com

  • Artificial Intelligence in FinTech
  • Cybersecurity in FinTech
  • Data & AI
  • Digital Strategy
  • Fintech & Insurtech
  • Infrastructure & Cloud

Author

Dan Brightmore

Published

31 March 2026

Estimated Read time

3Mins

Read in brochure format

Welcome to the latest issue of Interface magazine! Click here to read the latest edition! Sanofi: Supporting the World’s Health…

Welcome to the latest issue of Interface magazine!

Click here to read the latest edition!

Sanofi: Supporting the World’s Health Through Data

This month’s cover story spotlights Sanofi, one of the world’s largest pharmaceutical companies. For an organisation that puts the end-user – the patient – first, this requires an unwavering focus on R&D and continuous improvement. For the sake of the world’s health; every patient counts. So, when opportunities arose to improve services through data and advanced technology like AI, Sanofi brought in experts to steer and develop the journey.

Snehal Patel, Head of Global Data and AI Platform, takes a deep dive with Interface… “These innovations have fundamentally transformed Sanofi’s data and AI value chain,” says Patel. “It’s enabled scalable and efficient development across the organisation. We now have a far more agile development environment that supports the broader AI initiatives at Sanofi.”

Langham Hospitality Group: Cybersecurity Underpinning Guest Excellence

Anson Cho, Director of Information Security & Data Protection at Langham Hospitality Group, discusses the pandemic’s silver lining and the development of a proprietary matrix to embed security into the heart of operational excellence.

“Our strategy wasn’t about over-engineering our systems to match the spend of a global financial institution; it was about increasing our defensive maturity so we are never an easy mark,” says Cho. “In cybersecurity, you want to ensure your barriers are sophisticated enough that attackers move on. We focus on staying ahead of the curve and continuously evolving so that our security posture remains a formidable deterrent.”

FNB: Redefining Data Science in Commercial Banking

Yudhvir Seetharam, Chief Analytics Officer at South Africa’s First National Bank (FNB) on a data science journey characterised by curiosity, culture and the drive for a competitive edge.

“Ours is a holistic approach focusing on the customer,” he explains. “Understanding the context of each customer journey and then using that context so that when we interact with you, we’re able to drive the right conversation with the right customer, at the right time, through the right channel and for the right reason. These ‘five rights’ make our interactions with clients more impactful than a spray and pray approach.”

Click here to read the latest edition!

  • Cybersecurity in FinTech
  • Data & AI
  • Digital Strategy
  • Fintech & Insurtech
  • Infrastructure & Cloud

Author

Richard Ford

Published

20 March 2026

Estimated Read time

3Mins

Richard Ford, Chief Technology Officer at Integrity360, on why cybersecurity must move beyond control and embrace trust

Cybersecurity has long been focused on building walls, but the biggest threat is already inside. Today, insider risk accounts for nearly half of all data breaches. This isn’t just about malicious actors, it’s about regular employees and trusted contractors who make simple, costly mistakes.

Remote and hybrid working has only intensified the problem. With teams distributed and work happening across cloud platforms and collaboration tools, it’s harder than ever to track what’s happening, let alone why. Although AI tools promise efficiency, they also introduce new vulnerabilities. Employees pasting code into chatbots or bypassing corporate tools to meet deadlines. All seemingly innocent, but highly risky.

Insider Risk

Ransomware gangs know this and are now skipping the technical breach altogether and going straight to the source – a company’s insiders. Whether through bribery or social engineering, attackers are finding that humans can be the weakest link in even the most well-defended environments. Despite this, most security budgets still focus outward.

Traditional tools like data loss prevention (DLP) struggle to keep up with today’s dynamic and unpredictable user behaviour. Meanwhile, simulated phishing tests and punitive training schemes often breed resentment, not resilience. It’s time to rethink the model.

Human Error, Human Fix

We need to stop treating employees as the problem and start making them part of the solution. Enter Human Risk Management (HRM), a behavioural approach to cybersecurity that recognises the complexity of modern work. HRM tools monitor real-world user behaviour, detect anomalies in context, and deliver just-in-time nudges to prevent risky actions before they happen. Instead of punishing mistakes, they help users avoid them in the first place.

Of course, technology alone won’t fix the issue, culture is key. Leadership must champion security as a shared responsibility, not an IT rulebook. Success should be measured by how quickly employees improve, not how often they slip up. Awareness campaigns need to be practical and rooted in real-world behaviour.

Organisations also need to understand how digital transformation has changed the risk landscape. Shadow IT is no longer a fringe issue, it’s how work gets done. Whether it’s a developer using an AI plugin or a marketer sharing files via a personal drive, employees will always find the fastest path to productivity. Security must meet them there, not block the way.

Cybersecurity Built on Trust

The smartest businesses are those that treat identity like infrastructure, and behaviour like a vital data stream. They invest in tools that adapt to people, not the other way around. This means a move away from a surveillance approach and embracing the nuance of human error and design systems that support.

In a world where threats are increasingly internal and AI is both a risk and a tool, cybersecurity can no longer be about control. It must be about trust, and that starts with understanding the humans behind the keyboards.

Learn more at integrity360.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Infrastructure & Cloud

Author

Pierre Noel

Published

Estimated Read time

4Mins

Pierre Noel, Field Chief Information Security Officer at Expel, on why security with community-based governance is a key business pillar that better positions organisations to become more resilient and target growth

It’s been a particularly rocky start to 2026 for the global cybersecurity landscape. From the Substack data breach to PayPal credential-stuffing attacks in February, we are not looking at IT failures alone. These attacks are balance-sheet events: direct assaults on business value, triggering remediation costs and long-term impacts on financial health. Compounded with the conflict with Iran, leading to potential ramifications in the cyber realm, it’s more important than ever for the C-suite to be aligned on cybersecurity priorities.

Despite this, a glaring disconnect remains in planning and execution. Expel’s research found that while 85% of finance leaders view cybersecurity as a key component of business planning, only 40% express full confidence in security’s ability to align with business strategy. To bridge this gap, CISOs must move from reporting on activity and start reporting on resilience and unit cost.

Translating Alert Volume Into Unit Cost

CISOs must change how they present the value of their operations. CFOs are largely indifferent to technical metrics like the ‘millions of blocks pings’ or ‘SOC alert volume’ – to a finance leader, an alert is simply another form of disruption to daily operations.

To fix this, CISOs should introduce the ‘unit of cost protection’. By breaking down security spend into the cost required for a single transaction or business unit, CFOs can understand and manage it from experience. A tiered approach works best here: high-risk business units justify higher protection costs than low-risk ones. This allows CFOs to treat security as a scalable operational expense rather than a black hole of additional tooling – the kind of framing that also resonates in a boardroom.

Mapping Investment to Business Risk Exposure

Expel’s research shows that while 43% of finance decision-makers are confident that security can prioritise investments based on risk, only 46% are confident that security can deliver cost-efficient solutions. To move in the right direction, CISOs should shift from ‘vulnerability management’ to thinking about ‘business risk exposure’, requiring a different view of how threats unfold over time.

It’s all about asking the right questions. Instead of requesting more firewalls to protect a specific timeframe, start asking for the cost of securing diverse digital ecosystems across an extended risk window. The 2026 Winter Olympics is a good example: Russian-led cyber campaigns began raising concerns months before a single athlete arrived in Italy, proving that risk isn’t a one-day event but an ongoing operational cost.

For European organisations, this framing is increasingly non-negotiable. While NIS2 and DORA help make the cost of under-investment concrete and quantifiable, the upcoming Cyber Resilience Act (CRA), with key reporting requirements starting in September 2026, extends this pressure to anyone manufacturing or selling digital products in the EU. Even for purely domestic UK entities, the new UK Cyber Security and Resilience Bill is moving the goalposts toward these same high standards. Ultimately, CFOs must understand that cybersecurity isn’t just about preventing loss; it’s a prerequisite for safe and secure growth.

The Reputational Multiplier

So those are the questions to ask, but how do CISOs deal with the ‘unknown unknowns’, specifically long-term brand damage? While compliance fines under NIS2 or DORA may be straightforward (and important) to model, they rarely represent the full scope of the potential damage. In such scenarios, CISOs should propose a reputation multiplier: a framework for quantifying the financial fallout of brand damage in a language CFOs know and trust, looking past immediate recovery costs to factor in the long-term implications of re-establishing market trust.

The 2026 CarGurus breach illustrates this well. Impacting 12 million users, the cost wasn’t purely technical; it also came from the stock price dip and marketing spend required to repair the brand. For UK companies, where regulatory scrutiny is heightened, that multiplier effect is even more pronounced. This is the language of a CFO, and it helps CISOs better translate the urgency and relevance of a strong cybersecurity posture.

Standardising the Language of ROI

Closing the gap between CFOs and CISOs needs more than just better data; it needs a shared vocabulary. By standardising the language of ROI, CISOs transform cybersecurity from a vague insurance policy into a transparent value driver fully trusted by finance teams. Move away from complicated defensive jargon toward a unified framework of unit costs, and the gap between the CISO and CFO starts to close.

Security has become a key pillar of business operations, and in the current threat environment, it’s genuinely a community-based governance issue. The organisations that get this right aren’t just more resilient. They’re better positioned to grow.

Learn more at expel.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Infrastructure & Cloud

Author

Dr. Yvonne Bernard

Published

18 March 2026

Estimated Read time

5Mins

Dr. Yvonne Bernard, CTO at Hornetsecurity, on meeting the challenge of managing the speed of AI adoption and harnessing its defensive capabilities while mitigating the risk of uncontrolled adoption

The past year has been defined by acceleration. Threat actors rapidly embraced automation, AI, and social engineering. Scaling their tactics at unprecedented speed, while defenders raced to keep pace. Historically, defensive resilience evolves in step with attacker innovation, but in 2025 that balance began to falter.

In an analysis of over 6 billion monthly emails, Hornetsecurity’s Security Labs found that the volume of sophisticated threats grew faster than most security teams could adapt to. Malware-infected emails soared by 131%, scams increased by nearly 35%, and phishing attempts – powered by access to advanced AI – rose by 21% from the previous year.

Typically, attacks, even at volume, are easily filtered by good firewalls and secure email gateways. But the sophistication and AI-led nature of 2025’s boom made it even harder for organisations to defend themselves. The question now is: can security teams and businesses wrestle back control?

Evolving Cyberattack Landscape

​​AI enhances efficiency and precision. As such, cybercriminals use it to launch faster, more convincing and adaptive attacks, ranging from deepfakes to credential stuffing. As an example, there is a concerning trend of attackers increasingly using ‘MFA bypass kits’ to create deceptive login pages. These pages capture not only the user’s credentials but also have logic built in to handle MFA prompts as well. ​​The unsuspecting user is then passed to the real login page for the target service and meanwhile the ‘kit’ grabs a copy of the user’s session token. This allows the attacker to impersonate the person and access their data. ​​​​​

Examples of such kits include Evilginx (open source) and the W3LL panel. Protecting against these attacks can be challenging, as they are adept at bypassing MFA safeguards. Threat actors often use compromised LinkedIn accounts, for example, to gain access to substantial information and connections. This enables them to impersonate trusted business connections. Paired with the weaponisation of Agentic AI, this will magnify existing vulnerabilities within an organisation, while introducing new ones that defy traditional containment models.

As it stands, the lack of oversight within organisations on the extent of AI’s adoption by cybercriminals has enabled the emergence of ‘Ransomware 3.0.’ Ransomware has evolved past simple encryption and exfiltration, with this next phase focusing on LLM-driven orchestration and a shift to data integrity manipulation.

To counter AI-accelerated compromises and ‘Ransomware 3.0’ in 2026, organisations must adopt a Zero Trust-based cyber resiliency strategy. This requires businesses to implement strong, non-phishable machine authentication, strict least-privilege access, and constant monitoring to protect the integrity of the data that users and AI agents can access. It should become the baseline expectations rather than aspirational goals for this year.

The Secret Value of ‘Least Privilege’ Access

Another strategy to proactively improve cybersecurity defences in 2026 is to enforce the principle of ‘least privilege’ access. This tactic grants users access only to the data that’s needed for their role. Limiting excessive access is important for preventing the potential for widespread data exposure and damage in the case of an account compromise.

Businesses, however, must strike a balance over access; if it’s too strict, it can hinder productivity and lead to shadow IT issues. Getting this balance right when it comes to privileged access is where sophisticated permission managers are invaluable tools to work with. They streamline the process and remove the guessing game of who and what to grant access to, thereby ensuring, in the case of an attack, that the entire organisation won’t be brought to its knees.

How CISOs are Adopting ‘Resilience, not Perfection’

The rate at which AI is advancing means not every organisation will be equipped with the tools or the know-how to tackle every AI-inspired attack. But as the saying goes, ‘prevention is better than cure’. It’s better to create a strong security culture than to continually chase after the next best tool. 

Organisations can’t strengthen their resilience without involving every single person under their umbrella. That’s why CISOs must continue to invest in cybersecurity awareness programs.

These should include simulated AI-phishing attacks (phishing remains the number one attack vector) to test users and enable them to apply learnings from the modules.

If any user clicks on a phishing email, they should receive additional training at that very moment, to cement the learning. Over time, a good training system should automatically identify users who rarely fall for such attacks and reduce the training they receive while making the simulations they do receive more difficult. Conversely, giving persistent offenders additional bite-sized training and simulations can help improve security outcomes over time.

The key challenge for 2026 is managing the speed of AI adoption and harnessing its defensive capabilities while mitigating the risk of uncontrolled adoption. But with excellent training, cyberattack practice runs, and the adoption of Zero Trust principles, organisations will find themselves in a strong position.

About Dr. Yvonne Bernard

Dr. Yvonne Bernard is the CTO of Hornetsecurity by Proofpoint, Proofpoint’s business unit leveraging the Hornetsecurity product suite dedicated to managed service providers (MSPs) and small to mid-sized businesses (SMBs), providing next-generation cloud-based security, compliance, backup, and security awareness solutions that help companies and organisations of all sizes around the world.

Learn more at hornetsecurity.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Data & AI
  • Digital Strategy

Author

Chris Gunner

Published

4 March 2026

Estimated Read time

4Mins

Chris Gunner, vCSO at Thrive – a leading NextGen MSP/MSSP, delivering global AI, cybersecurity, cloud, compliance, and digital transformation managed services – on how CISOs can position their cyber strategy to to become part of how a business navigates uncertainty

Quantification of cyber risk is a growing trend. While this can be genuinely useful, in practice it is often misunderstood or over-applied by security leaders. It can range from an arbitrary figure to attempting to model every possible risk on the register in a Monte Carlo simulation. The focus can fall on the mechanics of quantification, rather than how financial decision-makers actually use the information.

Think of the CFO – they don’t walk through every penny in the budget. Instead, they usually focus on the board-level levers that can materially affect the business. These often include three key areas: strategic optionality, removing friction from capital events and avoiding shocks and smoothing operating costs. Security conversations should be anchored the same way.

The Importance of Strategic Optionality

If faced with a credible one-year growth plan, CFOs may recommend a one-year office lease despite a 20% premium. This is because it maintains the option later of moving or re-contracting once the growth trajectory becomes more visible. Like most strategic decisions, it is about preserving flexibility in the face of uncertainty, even if that flexibility comes at a short-term cost.

If we apply this to a cyber context, there are often businesses that have taken a calculated gamble with their existing business strategies. While the plan is sound, there is a chance it might not land as expected. When they require security services, the choice between a ‘standard’ and ‘premium’ SOC frames the decision as one of optionality rather than security spend. Paying more now to preserve the ability to adapt later down the line. A simple illustration is incident response. An on-call retainer with defined response times can look more expensive than ad hoc support. Until an incident occurs and procurement becomes the bottleneck. In those moments, flexibility is often far more valuable than marginal savings achieved earlier.

Removing Friction from Capital Events

For CFOs, especially those operating in the alternative investment space, the focus is on structuring capital events. As opposed to managing day-to-day operational costs. One of the most painful points in that process is due diligence. The careful exchange between acquirer and target that aims to provide enough information for each to price risk, without giving the entire game away.

CISOs can materially influence how smooth or painful that process becomes. The most effective support often comes from understanding upfront what the diligence process will look like and preparing accordingly.

For example, they might develop executive-level ‘Security at ACME’ overviews to sit alongside more detailed trust centre or technical reports. Being available to diligence teams for interviews, and for example clearly articulating which services are outsourced to an MSSP, and why, builds credibility between those executive teams.

Decision-makers often don’t look at penetration test reports at a deal level. They are assessing whether the organisation understands its own control environment. A well-prepared CISO who can clearly explain why certain controls exist acts as a trust amplifier during transactions.

It is often the difference between a diligence process that closes cleanly and one that drifts. Two organisations can have similar maturity. Yet the one that can respond within a day with clear, consistent evidence reduces follow-up questions, avoids uncertainty premiums in pricing discussions and prevents security from becoming a late-stage negotiation point.

Avoiding Shocks and Smoothing Operating Costs

For any individual who has worked with a finance partner to define a departmental budget will know that predictability often takes precedence over absolute cost. Contract value can be secondary to payment terms, renewal timing or the ability to forecast spend with confidence.

CISOs can align with this by looking to reduce unplanned operating expenditure. In addition to understanding the cost structure of their controls by communicating with the technical pre-sales engineer, procurement and account teams.

A good example is cyber insurance. While often purchased directly by finance teams, many policies are relatively off-the-shelf and provide access to services the security team already operates or has under contract. Other policies include notable exclusions for the events most likely to occur. Such as a ransomware incident without business interruption cover. In many cases, these gaps can be addressed in-policy with a flat fee or a more predictable cost model.

The value here extends beyond risk transfer and into more predictable costs: replacing reactive spend with planned expenditure.

Aligning Cyber Conversations to Board Priorities

Across all of the above examples, the common thread is that the board is rarely asking security to prove its value in isolation, and is surprisingly comfortable with uncertainty. But they are asking whether the cyber papers support better decisions, fewer constraints and more predictable outcomes for the business as a whole.

CISOs who frame their priorities in those terms will find their conversations move away from justifying individual controls and towards understanding how security choices shape the organisation’s ability to respond to change. In that context, cyber becomes part of how the business navigates uncertainty, rather than a specialist function defending its budget. Speaking the board’s language, ultimately, is less about converting cyber risk into pounds and pence. It is more about understanding which levers matter at that level and showing how security choices influence them.

Learn more at thrivenextgen.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy

Author

Dr. George Papamargaritis & Dr. Konstantia Barmpatsalou

Published

26 February 2026

Estimated Read time

4Mins

Obrela’s Dr. George Papamargaritis (EVP MSS) and Dr. Konstantia Barmpatsalou,  (Blue Team Support Manager) on why embracing a risk-led cybersecurity model will leave financial organisations better positioned not just to meet regulatory requirements but to strengthen resilience, protect customers and uphold the trust that is so essential to the future of financial systems

Cybersecurity in the financial sector was once viewed as a compliance-driven discipline. But as attackers have increasingly targeted institutions with sophisticated, persistent and often internally driven campaigns, it has become a strategic priority.

According to the Digital Universe Report H1 2025, financial services were the second most targeted industry globally, accounting for 19% of all observed cyberattacks. This reflects both the sector’s value to adversaries and the complexity of the digital ecosystems it now operates within.

Regulatory frameworks such as the FCA and PRA’s operational resilience rules, the EU’s Digital Operational Resilience Act (DORA) and NIS2 have strengthened baseline protections. However, the report’s findings demonstrate that regulation alone cannot deliver true cyber resilience. Institutions must adopt a strategic, risk-led approach that looks beyond compliance to understand real threats, behaviours and operational dependencies.

Tailored, Internal and Stealthier Threats

One of the most striking insights from the report is how targeted financial sector attacks have become. Industry-specific security risks now represent 32% of all incidents in the sector. This is an indication that adversaries are designing attacks using detailed knowledge of financial operations, from trading workflows to payment systems.

Internal activity is also a major concern. Suspicious internal activity accounts for 26% of detections across financial services, reflecting the frequency of compromised accounts, misused privileges and lateral movement. For a sector historically focused on defending the perimeter, this shift highlights the need for deeper visibility into user behaviour and identity-driven risks.

The wider threat landscape reveals adversaries are moving away from overt, signature-based attacks. In H1 2025, brute force activity made up 27% of global alerts, while vulnerability scanning accounted for 22% and known malicious indicators for 20%. Notably, direct malware payloads dropped to 0% of trending alerts, replaced by fileless techniques and living-off-the-land methods that bypass traditional defences.

For financial institutions, this is a challenge. Many compliance requirements still centre on endpoint protection, patching and malware controls. These will of course, remain important, but they cannot address threats that are increasingly behavioural, stealth-driven and identity-focused.

Operational Complexity

The financial sector’s cyber risk is intensified by its expanding operational footprint. Cloud adoption, open banking, digital identity models and extensive third-party ecosystems have all created new points of exposure. Financial services operate within a global digital infrastructure that is both vast and increasingly interconnected. This level of complexity cannot be effectively protected through compliance checklists alone.

Regulators are recognising these realities. DORA’s emphasis on ICT third-party risk, operational resilience testing and continuous oversight reflects the need for more proactive, intelligence-driven approaches. But DORA still only sets a minimum standard. True resilience requires institutions to move beyond regulatory expectations and embed cybersecurity into broader business strategy.

Strategic, Risk-Led Cybersecurity

A risk-led approach begins with understanding the threats that pose the greatest risk to operations and customers. Financial institutions remain priority targets for groups such as FIN7, TA505, Cobalt Group and various state-backed actors. Their tactics, such as credential harvesting, remote access tools, web-injection frameworks and lateral movement, are specifically designed to exploit the digital fabric of financial services.

This evolving threat profile puts identity and behaviour at the heart of cyber defence. With credential-driven and internal threats so prevalent, institutions must prioritise behavioural analytics, continuous authentication and zero-trust models that verify users and devices contextually rather than relying on static controls.

Strategic cyber resilience also needs to have continuous assurance. Traditional audits, annual testing and scheduled penetration exercises cannot keep pace with rapidly evolving threats. Leading institutions are shifting toward continuous control monitoring, automated attack simulation and persistent adversarial testing. These practices align with the Bank of England’s CBEST framework and demonstrate a sector-wide move toward ongoing, intelligence-led assurance.

Crucially, cyber risk must be treated as an operational issue, not just a technical one. Embedding cybersecurity into enterprise risk management, financial planning, product development and board oversight is essential. This integrated approach also mirrors the direction of FCA and PRA regulation, which increasingly emphasises governance, accountability, and resilience across the entire organisation.

Beyond Compliance

Financial services underpin national economies and public confidence. As digital ecosystems grow and adversaries become more sophisticated, the sector faces a dual challenge: meeting rising regulatory expectations while defending against complex, targeted attacks. It is clear that cybersecurity must evolve from compliance-driven activity to a strategic capability built on intelligence, continuous assurance and behavioural insight.

Institutions that embrace this risk-led model will be better positioned not just to meet regulatory requirements but to strengthen resilience, protect customers and uphold the trust that is so essential to the future of financial systems.

Learn more at obrela.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Fintech & Insurtech
  • InsurTech

Author

JP Cavanna

Published

11 February 2026

Estimated Read time

5Mins

JP Cavanna, Director of Cybersecurity at Six Degrees, on balancing the risks and benefits of AI in cyber defence strategies

Undeniably, AI is here to stay. Having become part of day-to-day life, it’s hard to remember what life was like without it. But when it comes to cybersecurity, is it causing more harm than good?

Recent research outlines that 73% of organisations have already integrated AI into their security posture. The technology is clearly becoming a cornerstone of modern cybersecurity. Organisations are turning to AI not just as a tool, but as a partner in security operations, leveraging its capabilities to identify malicious activity faster, guide investigations, and automate repetitive tasks.

For it to be truly effective, though, AI must be paired with human expertise – but this is where organisations are starting to become complacent. Given the growing sophistication of cyber-attacks, and even AI-powered attacks, many are removing the human element while expecting AI tools to do all the work for them, leaving them even more vulnerable to threats. This overreliance risks creating blind spots, where critical thinking, contextual understanding, and instinct are overlooked. Without the balance of human judgement, AI can amplify mistakes at scale, turning efficiency into exposure.

The Cybersecurity Paradox

This situation puts many organisations in a potentially difficult position. On the one hand, AI can significantly improve the efficiency of security operations. In the typical SOC, for example, AI technologies can process alerts in around 10-15 minutes. This represents a significant improvement over human analysts, who can easily require twice as long for the same task.

Aside from the obvious efficiency gains, applying AI to these repetitive, time-pressured processes can also significantly reduce the scope for human error. And in turn, take considerable pressure off security analysts. Going some way to battling alert fatigue, an increasingly well-documented and persistent problem. In these circumstances, valuable human experience and specialist expertise can instead be more effectively applied to complex investigations, strategic decision-making, and other higher-value priorities.

On the flipside, however, AI remains prone to generating inaccurate or misleading insights, and users may not realise they are applying the wrong information to potentially serious security issues. Similarly, habitual blind trust in AI outputs can easily erode performance levels and even introduce new vulnerabilities. There is also scope for sensitive data to enter public environments, with the potential to cause compliance issues. This kind of information can also reappear in future versions of the AI model in question, therefore resulting in further data exposure risks.

Parallels with IoT Adoption

The situation mirrors that seen in the early days of IoT adoption, where the rush to innovate would often override security considerations. In this current context, therefore, human oversight and vigilance are extremely important. Clear governance frameworks, defined accountability, and continuous monitoring must underpin any AI deployment. Therefore ensuring that innovation does not outpace risk management or compromise long-term resilience.

A Growing Arms Race

If that wasn’t challenging enough, threat actors are also in on the AI boom in what has already been described as an ‘arms race’. In practical terms, AI tools are already widely used to create more convincing phishing attacks free from some of the more obvious traditional tell-tale signs of criminal intent, such as imperfect grammar or a suspicious tone.

Deepfake technology has also raised the stakes. We’ve all seen how convincing AI-generated video has already become. This is now finding its way into real-world examples, with one fake video reportedly causing a CFO to authorise a large financial transfer as a result.

At the same time, technology infrastructure is constantly under attack by AI-powered tools. They can be used to analyse defensive systems and identify weaknesses faster than humans. The net result of these developments is that defenders constantly play catch-up, as they can only respond to new attack vectors once discovered. The underlying takeaway is that at present, AI cannot be trusted to operate autonomously. Instead, human intuition, scepticism and contextual understanding remain essential to spotting emerging tactics.

As attackers refine their methods at machine speed, organisations need to resist the temptation to match automation with automation alone. They must double down on strategic thinking and continuous skills development.

Balancing Benefits and Risk

So, where does this leave security leaders who are looking to balance the benefits and risks? Firstly, and to underline a fundamental point, while AI offers scale and speed, it cannot replace critical human oversight. Organisations should view AI as an enhancer, not a replacer. Success lies in promoting partnership, not substitution.

Strong governance is vital. This should start with clear AI usage policies that define what can and cannot be shared with AI tools, while proper data classification and access control ensure that sensitive information is protected. In addition, regular validation of AI outputs can help to prevent inaccurate or misleading results from being unnecessarily acted upon.

Then there are the perennial challenges associated with employee awareness training, which is vital for avoiding complacency and understanding the limitations of generative AI tools. Cyber leaders should also monitor how AI is being used inside and outside the corporate environment, as staff often experiment with tools on personal devices.

Get this all right, and security teams can put themselves in a very strong position to embrace AI, safe in the knowledge that they have the guardrails and processes in place to balance innovation and efficiency with effective human-led oversight. Ultimately, success will depend not on how much AI is deployed, but on how intelligently it is governed and refined alongside the people responsible for securing an organisation.

Learn more at Six Degrees

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Data & AI
  • Digital Strategy

Author

Dan Nichols

Published

23 January 2026

Estimated Read time

8Mins

Dan Nichols, Chief Technology Officer at virtualDCS, on why cloud resilience in the financial services sector hinges on shared accountability and an assume-breach philosophy

A powerful catalyst for transformation, the cloud is reshaping how organisations compete in the financial services sector. Beyond significant cost savings and flexibility, leaders are eager to unlock the potential of AI-driven insights, intelligent automation, and real-time business modelling. And, in a space governed so strictly by data sovereignty and privacy policies, the cloud’s ability to localise, encrypt, and control data has made it a key enabler of compliance and customer confidence.

But as threats become more frequent and sophisticated – with attackers now targeting shared platforms and partner supply chains – organisations can no longer rely on their own defences alone. For true digital resilience, shared accountability, collective readiness, and clear governance across every cloud touchpoint are equally non-negotiable.

All Eyes on the Money

The industry sits at a valuable intersection of data, technology, and finance. A combination that makes it uniquely attractive to attackers. It holds some of the world’s most sensitive data, directly underpins the flow of global capital, and operates through deeply complex and interconnected systems. With every integration increasing the risk of exposure. Ultimately, the attack motivation is as simple and relentless as it is in most sectors: monetary gain. Cybercriminals target institutions precisely because of the value at stake and the speed at which disruption translates to loss.

How the Threat Landscape is Evolving

Ransomware groups may see insurers and payment providers as high-yield targets. They understand even seconds of downtime can induce multi-million pound losses. Under pressure to protect customer trust and avoid regulatory penalties, some firms may choose to pay in order to restore their service quickly. This dangerous perception only encourages repeat targeting and paves the way for damage to spread even further. Yet it remains a common response tactic among many.

At the same time, the rise of supply chain and third-party attacks has made it possible for criminals to bypass even the most well-defended cloud environments. By exploiting shared platforms, managed service providers, and cloud-hosted applications, perpetrators can move laterally across multiple organisations at once, amplifying both the reach and impact of their attacks. In other words, infiltrating one vendor’s weakness can cripple an entire network in one carefully coordinated strike. And, since some firms may overlook the cloud’s shared responsibility model – presuming end-to-end security sits solely with their cloud provider – multiple blind spots can inevitably emerge, creating easy openings to exploit.

In an environment where boundaries blur and dependencies multiply, traditional perimeter-based defences are no longer enough. Hybrid and multi-cloud infrastructures demand continuous visibility, faster detection, and coordinated response across every partner and provider. The goal is not simply to prevent breaches, but to withstand and recover from them collectively. It’s about recognising that in today’s ecosystem, no financial institution is secure in isolation.

Inside the Ransomware Economy

Evolving beyond the scattergun attacks of the past, ransomware now operates as a professionalised, profit-driven ecosystem, where malicious actors collaborate, trade intelligence, and lease attack tools much like legitimate software vendors. The rise of ransomware-as-a-service (RaaS) has even lowered the barrier to entry, giving less skilled affiliates access to ready-made payloads and automated encryption kits in exchange for a percentage of the ransom.

What makes it especially destructive is the precision and psychology behind the attacks. Rather than randomly striking, attackers conduct weeks of reconnaissance – learning behaviours, studying employee hierarchies, and identifying systems most critical to operations. They often infiltrate through phishing emails or compromised credentials, quietly moving laterally through the network to gain elevated access. Once embedded, they disable defences, exfiltrate sensitive data, and target backup repositories before finally encrypting production systems.

At that point, the goal shifts from technical control to financial coercion. Victims are locked out of their systems and presented with a ransom note demanding payment, sometimes in cryptocurrency, in exchange for a decryption key. Increasingly, the threat includes public exposure of stolen data – a tactic designed to pressure leadership into paying to protect their reputation and customer trust. Even when ransoms are paid, recovery is rarely clean: data may be incomplete, corrupted, or resold on the dark web, and repeat targeting is common once an organisation is identified as a payer.

It’s this blend of stealth, strategy, and human manipulation that makes ransomware so difficult to defend against. By the time the encryption begins, attackers have already spent weeks ensuring recovery options are limited. This background isn’t designed to scaremonger, but to highlight why resilience must start long before an attack ever reaches the endpoint.

The Foundations of Ransomware Resilience

Ransomware resilience isn’t achieved through a single product or policy – it’s the outcome of strategic, technical, and cultural alignment. Financial institutions, in particular, must approach it as a continuous process of readiness: Anticipating compromise, containing impact, and restoring normality quickly and transparently:

Assume-Breach Philosophy

The first step is shifting from a defensive mindset to an assume-breach philosophy. In practice, this means recognising that even the most sophisticated systems can and will be breached – and building architectures and response strategies designed to limit damage when this happens. It’s a pragmatic approach, grounded in the reality that attackers are increasingly sector agnostic. No organisation is too small or too secure to be targeted, but the financial sector remains a favourite because it offers both high disruption value and potentially significant monetary reward.

Building meaningful resilience, therefore, demands layered defence and disciplined execution. The goal is to slow attackers down at every stage – detecting them early, limiting lateral movement, and ensuring business continuity when systems are disrupted. Behavioural analytics and continuous monitoring can surface and neutralise subtle anomalies that would otherwise go unnoticed – such as phishing, spear phishing, and malware, with email still the number one entry point for ransomware.

Zero Trust & MFA

Meanwhile, zero trust policies and multi-factor authentication methods add a second layer of protection, blocking unauthorised access even if credentials are compromised.

When incidents do occur, a well-practised response framework ensures action is fast and coordinated, minimising disruption across critical systems, with the ability to switch to secure replica environments to keep operations running while remediation takes place. Secure, immutable, air-gapped backups underpin it all, providing a safety net that guarantees recovery can begin from a clean and uncompromised state.

Human readiness is equally critical. Technology can contain an attack, but only people can recover from one effectively. Regular simulation exercises, incident rehearsals, and cybersecurity awareness training help teams respond calmly and cohesively, transforming response from reactive to instinctive. This operational maturity is reinforced by strong governance. Frameworks such as DORA, NIST, and ISO 27001 provide the structure to align technical teams, compliance leads, and executive decision-makers around shared resilience goals. When combined with skilled practitioners and clear accountability, they embed security into ‘business as usual’ – moving resilience from a strategy to a sustained organisational capability.

Why Multi-Layered Backup is Critical

When ransomware strikes, the speed and integrity of data recovery determine whether disruption lasts minutes or days – and whether the impact cascades through wider global markets. As the last and most decisive line of defence when every other control fails, it’s also fundamental to customer trust and compliance. Yet too often, backup is treated as a static safeguard rather than a dynamic resilience layer.

Since modern ransomware often seeks out and encrypts traditional backups first, a single backup copy or centralised repository is no longer sufficient. True resilience today depends on a multi-layered approach – combining offsite or cloud-diverse storage, immutable data copies that cannot be altered or deleted, and isolated environments to protect against lateral movement.

How frequently these backups are tested is equally important. Too often, financial institutions only discover weaknesses when recovery is already underway, at which point strategies can’t be magically strengthened, and it becomes a race against the clock to minimise downtime and reputational fallout. Regular, automated recovery testing changes that dynamic. It not only confirms that files can be restored, but provides verifiable assurance that systems come back online in the correct order, data dependencies remain intact, and teams have the muscle memory to act quickly and confidently when the worst happens.

The Power of Shared Accountability

In a digital economy so deeply interconnected, no organisation operates in isolation. This is especially true in financial services, where supply chains and service providers form the backbone of day-to-day operations. While this interdependence is a strength in many ways, it also means resilience is no longer defined by how well a single institution can defend itself, but by how effectively every partner in its ecosystem upholds their part of the security chain.

This is where shared accountability becomes critical. It recognises that cloud providers, managed service partners, and financial institutions each have distinct but complementary roles to play in securing data, systems, and infrastructure. When accountability is clearly defined – and when partners collaborate rather than operate in silos – visibility improves, incident response accelerates, and the risk of systemic failure decreases.

Shared accountability also extends beyond contractual obligation. It’s about building a culture of collective readiness: sharing intelligence, rehearsing joint incident scenarios, and supporting smaller or less-resourced partners to raise their security baseline. The result is a unified entity capable of anticipating, absorbing, and recovering from disruption together.

Looking Ahead

To view cyberattacks as inevitable might seem pessimistic to some, but it’s an unfortunate truth that no amount of investment can eliminate risk entirely. In an era where threats are growing in both scale and sophistication, readiness becomes the true differentiator – particularly in such a high-stakes sector. For financial institutions, that means embedding security into culture, strengthening connections across supply chains, and continually testing their ability to withstand and recover as a united ecosystem. Only then can resilience become a strategic advantage rather than a defensive necessity, and unlock the cloud’s transformative potential with absolute confidence.

Learn more at virtualcds.co.uk

  • Artificial Intelligence in FinTech
  • Cybersecurity
  • Cybersecurity in FinTech
  • Data & AI
  • InsurTech

Author

Dan Brightmore

Published

16 January 2026

Estimated Read time

5Mins

Ben Goldin, Founder and CEO of Plumery, explores the key banking trends for 2026 – from fraud and digital assets to stablecoins and AI applications

As we head into the second half of the decade, several emerging trends will come to the fore in 2026. The interconnectedness among these trends is also noteworthy. Artificial intelligence (AI) and progressive modernisation act as common threads.

A strong current throughout 2026 is the shift from customer-first banking to human-first banking. This relates to the concept of ethical banking. It focuses on creating financial services that have a positive social and environmental impact. 

Human-first banking aims to get even closer to the customer by understanding their actual human needs, rather than just consumer needs. For example, a bank should be acting as a coach to improve a customer’s financial health, not solely as an advisor on which products they should buy. Banks can build trust in a digital world through tailored and empathetic interactions, effectively simulating the experience customers formerly had with their personal banker.

To attain that level of hyper-personalisation, banks will need to be capable of processing vast amounts of transactional data, which can only be accomplished by deploying AI and big data tools. This requirement, in turn, will turbocharge progressive modernisation, another trend that has been bubbling under the surface for the past few years.

Traditional banks are using progressive modernisation to deal with legacy infrastructure that is not fit for purpose in a digital-first, AI-driven world. Instead of a big bang replacement of core banking systems, which is risky and can take years, banks are creating change from within existing architecture. Banking is leveraging technologies that support a multi-core strategy. With this approach, banks can add new cores for specific products that require greater agility and innovation. Modern cores are necessary for deploying the latest AI and big data tools because they provide a unified, real-time data foundation to deliver hyper-personalisation.

Fraud Threats

Fraud will remain a top concern throughout 2026. Adversaries use AI to expand the range of techniques, such as impersonation scams and identity theft, as well as accelerate and scale fraudulent activity.

According to the UK Finance Half Year Fraud Report 2025, £629.3 million was stolen by criminals in the first six months of this year, and there were 2.09 million confirmed cases across both authorised and unauthorised fraud. Card not present cases rose 22% to 1.65 million and accounted for 58% of all unauthorised fraud losses.

However, the good news is that there was a 21% increase in prevented card fraud in the first half of 2025. The £682 million which was stopped from being stolen is the highest-ever figure reported.

To combat fraud, new and improved tools to help banks identify, verify and onboard customers will come to market in 2026. The move away from paper-based identity (ID) and widespread adoption of digital ID will play a key role in the fight against fraud. Hence the UK government’s recently announced plans to roll out a new digital ID scheme.

In addition, I expect to see a fundamental shift in fraud detection using real-time behavioural analytics, data analytics for proactive risk identification, and other applications of AI and machine learning in this space.

Digital Assets and Stablecoins

Digital ID verification is also essential for fighting fraud in the digital assets and stablecoins space. Another hot topic at several banking and payments industry conferences last year.   

In 2026, digital assets and stablecoins will become much more mainstream. Banks have left the sidelines and are now actively engaged with running pilots. For example, in September a consortium of nine European banks, including CaixaBank, ING and UniCredit, announced an initiative to launch a euro-denominated stablecoin.

Central banks and regulators are developing a comprehensive agenda for digital assets. Banks will need to blend traditional fiat currencies and assets with their digital counterparts. This trend is also driving a progressive modernisation approach, as legacy core banking systems weren’t designed to manage digital assets, nor do they support moving money via blockchain-based rails. I expect to see more banks looking to deploy a multi-core strategy where digital assets are managed and stored elsewhere, but they can still provide a seamless and unified experience to customers.

AI

Last year, I predicted that the industry would adopt a ‘meet-in-the-middle’ approach to AI, with banks beginning to uncover the real value that the technology can deliver. I also predicted consolidation, recalibration and stabilisation in the market.

GenAI Banking Applications

My predictions held true, by and large. In 2025, institutions explored what is possible, relevant and achievable within the banking context, then specifically for each individual institution within its legacy architectures and technological environments.

This trend will evolve into more practical actions and initiatives over the next 12 months to provide greater clarity around where GenAI shines versus where it’s not applicable.

To gain clarity, it’s important to understand the difference between AI and GenAI. The latter is built on stochastic principles, which uses probability to model systems that appear to vary in a random manner. This means that the same input could potentially generate different outputs – this isn’t acceptable for automated financial operations, which requires much more determinism. Hence, I believe that GenAI will be used chiefly in scenarios where there’s human intervention.

One area where GenAI is applicable is in conversational applications. For example, banks will begin launching more interactive user interfaces. Customers will be able to interact with the bank as they would a human. Moving beyond simple, frequently asked questions to actual actions.

GenAI in the Back Office

Similarly in the back office, banks can leverage GenAI to provide guidance to their employees and accelerate certain tasks. Using the technology to improve efficiency and help staff do more will have a positive impact on customer experience. Processes will take much less time.

It will also help to bring unbanked segments or non-standard customers, which are difficult and costly to onboard because they require a bespoke assessment, into regulated financial services. Applying GenAI can make the bespoke process much more efficient by providing data-driven insights to support faster and smarter decision-making. This will make it much cheaper to serve these segments. Including smaller and medium-sized enterprises, which will drive financial inclusion and improve customers’ financial health.

Learn more at plumery.com

  • Artificial Intelligence in FinTech
  • Blockchain & Crypto
  • Cybersecurity in FinTech
  • Digital Strategy
  • Fintech & Insurtech
  • InsurTech

Author

Ben Francis

Published

9 January 2026

Estimated Read time

4Mins

Ben Francis, Insurance Lead at Risk Ledger, on navigating cyber threats by reinforcing security from the inside out

Cyber insurance has evolved from a straightforward risk transfer mechanism into an integral component of enterprise risk strategy. As a result, the conversation has shifted beyond simply securing coverage to embracing three foundational elements: transparency in risk exposure, accountability for security measures, and active collaboration throughout the digital ecosystem.

Rather than asking ‘are you covered?’, the more pertinent question has become ‘can you demonstrate measurable risk reduction?’. Insurers and insureds alike are recognising that what matters now is how well an organisation understands and manages its digital exposure, especially across its extended supply chain. Recent data reveals that 46% of organisations experienced at least two separate supply chain-related cyber incidents in the past year, a clear sign that exposure often lies beyond direct control. 

From Risk Transfer to Risk Visibility 

In recent years, the cyber insurance market has matured significantly. Once viewed as a reactive safety net to cushion the financial impact of attacks, it is now becoming a proactive tool for managing and mitigating risk. This shift is partly driven by insurers, who increasingly expect and work with organisations to demonstrate strong security practices and a nuanced understanding of their threat landscape, including risks deep within their digital supply chains; an area where many businesses still fall short.

At the same time, the industry faces a growing challenge from systemic cyber risk within their portfolios, as many businesses rely on the same cloud providers, payment systems and digital platforms, increasing the chance of a single point of failure. Insurers must gain visibility into how policyholders are connected, not only to suppliers but to each other. Tools and frameworks that map and monitor these interconnections will be essential to avoid underestimating the wider impact of seemingly isolated cyber events.

Mapping Beyond Third Parties

It is no secret that cyber attackers often target the weakest link in a supply chain. These are not always direct suppliers, but fourth, fifth or even sixth-tier vendors that have indirect but critical access to systems and data. Unfortunately, many organisations lack visibility beyond their first tier, creating blind spots that attackers can easily exploit. From an insurance perspective, this presents a clear challenge. If an organisation cannot account for who it is connected to, it cannot adequately quantify its risk and neither can its insurer. Mapping these extended connections is more than just a technical exercise; it means actively practiced risk governance and responsibility. Insurers increasingly want to know how their policyholders are identifying and managing indirect dependencies, particularly in sectors like financial services and retail where disruption can ripple across entire markets.

Collaboration as a Risk Strategy 

One of the more underappreciated aspects of cyber resilience is the role of peer collaboration. Unlike physical incidents, cyber threats rarely exist in isolation. A single compromised vendor can impact multiple organisations simultaneously, a fact that has been highlighted by high-profile supply chain attacks such as SolarWinds and MOVEit. 

As a result, businesses need to think beyond their own perimeters and adopt a more collective mindset. This includes building relationships with industry peers, sharing threat intelligence and participating in sector-wide initiatives aimed at improving visibility and preparedness. 

In highly regulated sectors, such as insurance, this collaboration is increasingly being encouraged by oversight bodies. Frameworks like the Digital Operational Resilience Act (DORA) in the EU and initiatives from the Prudential Regulation Authority (PRA) and the Financial Conduct Authority (FCA) in the UK are pushing for more transparency around third-party risk. In this context, openness is no longer optional; it will be a regulatory expectation. 

For insurance providers, greater collaboration between policyholders also means better data on emerging threats and more accurate portfolio management. For businesses, it offers a chance to anticipate vulnerabilities that may not yet have hit their own networks but are affecting others in their industry. 

Proactive Transparency Builds Trust 

Organisations that take a proactive, transparent approach to cyber risk management are more likely to secure cover and potentially favourable terms, not just in terms of premiums, but also in access to additional services such as forensic support, incident response sources and legal counsel. 

Demonstrating a mature cyber posture is not about claiming perfection. No organisation is immune to breaches. What insurers are looking for is evidence of a structured approach: the existence of incident response plans, robust governance, effective supply chain risk management, and above all, an honest view of risk. 

A Shift in Mindset 

Ultimately, our understanding of cyber insurance must keep evolving. It should not be treated as a simple checkbox exercise, but as a collaborative relationship between insurers and the organisations they support – one built on shared insight, clear communication, and a drive for continuous improvement.

The organisations best equipped to navigate today’s threats will be those that prioritise transparency. Not only does it lead to stronger protection, but it also builds a culture of accountability that reinforces security from the inside out.

Learn more at riskledger.com

  • Cybersecurity
  • Cybersecurity in FinTech
  • Digital Strategy
  • Fintech & Insurtech
  • InsurTech

Author

Andy Swift

Published

8 September 2025

Estimated Read time

4Mins

Andy Swift, Cyber Security Assurance Technical Director at Six Degrees on

According to AV-TEST, the independent IT security institute, every day sees at least 450,000 new malware variants added to its database. In June this year, for example, cybercriminals are thought to have used malware to steal over 16 billion login credentials across various major platforms in what is thought to have been the largest breach of its kind in history. For security teams, this represents a relentless challenge that demands constant attention and consumes significant resources.

Malware-Free Attacks

As if that wasn’t enough, malware-free attacks are increasingly favoured by cybercriminals as a way to circumvent organisational security. Typically using legitimate programs and tools, these stealth attacks are particularly complex to detect. And they are invisible to most automated security protection options that are available to buy.

With no obvious malware signatures to detect, automated defences are often powerless to respond. And without robust security foundations, even advanced detection tools offer limited protection once an attacker gains a foothold. When that happens, the consequences can be significant.

At the heart of the matter are the limitations of many traditional security tools, which are simply not designed to stop what they cannot see. Malware-free attacks do not rely on external payloads or binaries with known malicious signatures. This renders many automated detection systems, including standard antivirus solutions, effectively useless. As a result, the burden falls elsewhere.

For most organisations, that means having the right expertise in place to recognise unusual behaviour, supported by technologies that can identify behavioural anomalies quickly. Endpoint detection and response (EDR) platforms offer some of these capabilities. But even the most advanced solutions rely on proper configuration and human oversight to be effective. In an ideal world, every business would have round-the-clock monitoring in place, but in reality, very few do.

Challenging Assumptions Around Risk

So, how can organisations fill the gap? When assessing how to protect against malware-free attacks, many organisations begin with the assumption that they will need to buy new tools or licenses. This can form part of a rounded solution. However, leading with this mindset often overlooks a more fundamental and cost-effective question: What can be improved with the tools already in place?

Reviewing existing capabilities should be the first step. For example, most environments already have some level of EDR, behavioural monitoring or identity protection deployed. Yet these are often underutilised or misconfigured. This can result from a lack of understanding around tool capabilities (and limitations), paying for the wrong level of license coverage, and failing to ensure configurations support behavioural analysis rather than just malware scanning. In many cases, even minor adjustments can significantly increase effectiveness without any additional spend.

Cost vs Risk

Organisations should also reconsider how they approach the question of investment. The cost vs risk conversation needs to shift from what they should buy to what they should fix. Even the most expensive detection tools can be rendered ineffective if attackers can exploit basic oversights such as poor configuration, excessive access rights or the absence of multi-factor authentication. In contrast, identifying and addressing these gaps in existing systems is not only more cost-effective but also more impactful in stopping attacks before they gain momentum.

This kind of review process is also an opportunity to identify gaps and prioritise actions that reduce risk without escalating costs. For example, many organisations find that network segmentation, strict privilege controls and enforcing least-access policies can help prevent lateral movement and minimise credential misuse – two of the most common techniques used in malware-free attacks. Putting these capabilities in place are security fundamentals that often determine whether an attack is stopped early or is able to spread.

In this context, a best practice approach matters more than ever. Not as a one-off initiative, but as a continuous effort to close the windows of opportunity that attackers rely on. This includes reducing privilege levels, adopting MFA by default, limiting binary access and educating users on social engineering techniques. All of which are good examples of cost-effective steps that can limit the opportunity for malware-free attacks to take hold. These are not headline-grabbing technologies, but they remain the strongest defence against attacks that thrive on poor hygiene and overlooked gaps.

So, rather than investing in yet another layer of detection, organisations should focus on strengthening what they already have. This approach not only helps avoid unnecessary expense but also delivers a stronger, more sustainable defence posture in an environment where threat actors continue to be extremely effective.

  • Cybersecurity
  • Cybersecurity in FinTech
  • Infrastructure & Cloud

Author

Dan Brightmore

Published

5 June 2025

Estimated Read time

3Mins

The final day at Money20/20 Europe 2025 was packed with more insights on the future of FinTech, from banks to borderless innovation.

Money20/20 Conference Themes & Tracks

Money20/20 Europe 2025 is structured around four thematic content tracks:

  • Digital DNA – Exploring core infrastructure, platform strategies, and foundational technologies.
  • Embedded Intelligence – AI, machine learning, data strategies, and real-time analytics.
  • Beyond Fintech – Partnerships between fintechs and other sectors like retail, health, and climate.
  • Governance 2.0 – Regulation, digital identity, privacy, and ESG compliance.

Day three featured more impactful sessions across all four pillars, offering attendees more valuable insights and strategies for innovation.

Highlights from Key Sessions at Money20/20 Europe:

How to Create and Leverage FinBank Partnerships

The discussion focused on the evolution and success of FinTech partnerships with banks. Key points included the shift from transactional partnerships to more collaborative, value-driven relationships, emphasizing joint KPIs and product creation. 

Alex Johnson, Chief Payments Officer, Nium

“You really have to differentiate. You really have to stand out for a bank to say, ‘Yeah, I like what you offer enough to go through, six months of onboarding.’ Dare I say, maybe more.”

John Power, SVP, Head of JVs & AQaaS, Fiserv

“The legacy system, it’s a fact of life. They’re there. They’re pervasive. They’re going to be here for a long time, and banks historically have made huge investments in those platforms and systems. So I think both the challenge for the for the bank and the opportunity for the FinTech is, how do you at the front end of those legacy systems develop new products that can scale and that you can bring cross border easily and readily.”

Cecilia Tamez, Chief Strategy Officer, Dandelion Payments

 “It really is cutting the line to be able to deliver opportunity for customers and to be able to expand propositions for new customers.”

“The economic development supply chains shifting to low to middle income countries are incredibly important right now, and cross border payment rails have not been good in low middle income countries.”

Where Fintech goes Next: Tapping into Platforms and Verticals 

The discussion centred on the democratisation of financial services through embedded finance. The panel emphasised the importance of data quality, personalisation, and strategic partnerships in delivering seamless financial experiences – ultimately enhancing customer satisfaction and improving business efficiency.

Hiba Chamas, Growth Strategy Consultant – Independent

“Embedded finance is going to be defined by region and use cases.”

Amy Loh, Chief Marketing Officer – Pipe

“Small businesses don’t want to manage their business through a bunch of different tools that are stitched together. They’re looking to platforms to do everything for them and keep high end services.”

Zack Powers, VP Commercial & Operations – Mangopay

“Most platforms or merchants out there trying to diversify revenue, and they will get auxiliary revenue, or maybe get primary revenue through FinTech activity.”

The Neobanks Strike Back

​​In a dynamic exploration of neobanking’s evolution, Ali Niknam revealed bunq’s remarkable journey from a tech-driven startup to a sustainably profitable digital bank. By leveraging AI across every aspect of their operations, bunq has transformed traditional banking, reducing support times to mere seconds and creating a hyper-personalised user experience. Niknam emphasised the power of user-centricity, showing how innovative features like simple stock trading and multi-language support can democratise financial services.

The bank’s strategic approach – focusing on user needs rather than investor expectations – has enabled them to expand thoughtfully, with plans to enter the UK and US markets. By embracing technological change and maintaining a relentless commitment to solving real customer problems, bunq exemplifies the next generation of banking.

Ali Niknam, Founder & CEO, bunq


“Somewhere in the 70s, we let go of the gold standard, and now currencies are basically floating. The only reason why a dollar or a euro is worth what it’s worth is because of trust and perception. Philosophically, it’s very logical that we have found another abstraction layer by introducing stablecoin, which is not much else than a byte number that has a denomination currency as a backing asset that itself doesn’t have anything as a backing asset. A lot of people might ask, ‘Why would you need a stablecoin? We have euros. I go get a coffee, pay with Apple Pay or cash.’ But there are many countries on this planet where the local currency is not stable. If your country has an inflation rate of 30,000% like Zimbabwe, you would really love to use a different currency. The US dollar has been the currency of choice, but as a normal person, you cannot access the US dollar. A US dollar stablecoin that you can access by simply having a mobile phone – that’s going to be transformational for large groups of people.”

Innovating When Regulation Can’t Keep Up: Lessons from NASA 

Lisa Valencia covered an array of topics, from her 35 year career at NASA and Guinness World Record to the rise of private entities like SpaceX, which has launched 180 missions this year, and the increasing role of public-private partnerships in space exploration. The speaker also touched on international collaborations, particularly with the European Space Agency and the Italian Space Agency, and the potential for space tourism and colonization of the moon.

Lisa Valencia, Programme Manager/Electrical Engineer – Pioneering Space, LC (ex NASA)

“Back in the day, NASA got 4% of the national budget. Now it’s down to just 0.1%, so we’ve had to get creative with private partnerships. SpaceX is the perfect success story. They came to us in 2007 needing money after some rocket mishaps, and look at them now! From my balcony, I see their launches every other day. They’re planning 180 launches this year alone.Talk about a return on investment!” 

“We’re planning to colonise the South Pole on the moon. The idea is to extract water and hydrogen from the regolith—both for living there and for fuel.”

Scaling Internationally in 2025: Funding, Innovating, and Breaking into New Markets

The conversation focused on the growth and strategy of fintech companies, particularly those with a strong presence in Europe and the US. The panel featured Ingo Uytdehaage, CEO and co-founder of Adyen, and Alexandre Prot, CEO of Qonto. Both leaders expressed a preference for organic growth over acquisitions, emphasizing the importance of scaling efficiently before pursuing an IPO.

Ingo Uytdehaage, CEO and co-founder of Adyen

“I think an important part of scaling a company is not just thinking about your product, but also considering the markets you want to address, and how you ensure you become local in each country.”

“We realised over time that if we really want to bring the customers, we need to have the best licenses to operate. A banking license gives you a lot of flexibility.” 

“Being independent from other companies, other financial institutions, that gives you flexibility to build what your customers really want.”

“I think it’s very important, also in Europe, that we continue to be competitive. If you think about regulations and AI, we shouldn’t try to do things completely differently compared to the US.”

Alexandre Prot, CEO of Qonto

“We need to be very strict about tech integration and avoiding legacy which slows us down.”

“We still need to scale a lot before we have a successful IPO. A few team members are working on it and getting the company ready for it. But, the most important thing is just scaling efficiently in the business, and maybe an IPO would be welcome in a couple of years.”

Putting The F in Fintech

The panel discussion focused on the role of women in FinTech based on personal experiences.

Iana Dimitrova, CEO, OpenPayd

“At times, being underestimated is helpful, because if you’re seen as the competition, driving an agenda is becoming more difficult. So what I found, actually, over a period, is that bringing your emotional intelligence, leaving the ego outside of the outside of the room, and just focusing on execution is is incredibly helpful.” 

Megan Cooper, CEO & Founder, Caywood

“The moment we start defining ourselves as like a female leader or a female entrepreneur, you almost kind of put yourself in a bit of a box. And so I think just seeing yourself on an equal playing field and then operating it on an equal playing field and interacting in that way is quite advantageous.”

“We can’t just want diversity and hope it happens. We actually have to be intentional about creating it.”

Valerie Kontor, Founder, Black in Fintech

“Black women make up 1.6% over the FinTech workforce, but when we look at the financial reality of black women by the age of 60, only 53% of black women have enough money in their bank account to retire. We need to start marrying people in FinTech and the people that we need to serve.”

Money20/20 Europe 2025 closed its doors but the next edition of the conference will return to Amsterdam from June 2–4, 2026, promising to continue the tradition of shaping the future of financial services…

  • Artificial Intelligence in FinTech
  • Blockchain & Crypto
  • Cybersecurity in FinTech
  • Digital Payments
  • Embedded Finance
  • Host Perspectives
  • InsurTech
  • Neobanking