Stronger together: finance sector needs a unified approach to cybersecurity 

The popular image of the cybercriminal of a lone figure in a hoodie, belongs to the same era as dial-up internet, fax machines and believing that ‘Password123’ was probably good enough. Since those times, cybercrime has professionalised.

And, naturally, criminals are following the money, so that puts financial services firmly in their sights. Banks and other financial institutions hold enormous quantities of valuable data while running complex digital infrastructures through which millions of files, messages and transactions travel.

The problem is that while attackers have become increasingly joined-up, the teams defending organisations against them can still be surprisingly fragmented.

Security maturity in financial services is no longer about adding more controls. It is about integrating people, processes and technology into a cohesive detection ecosystem with file security at its core.

How are attackers exploiting financial services? 

Today’s criminal gangs operate with structure, focus and a ruthless eye on profitability. They have business models, specialist suppliers and even something resembling franchises. Sophisticated malware kits are available to relatively low-skilled operators, while AI is making attacks faster, cheaper and considerably easier to scale.

In other words, cybercrime has acquired many of the characteristics of a successful multinational, albeit without the annual ESG report.

The delivery mechanisms for this malware also continues to evolve, but one of the biggest gaps that we see is file security. The finance sector relies heavily on file uploads for KYC and other processes with files of every type crossing the perimeter every few seconds from email attachments to software updates, file transfers or cloud uploads. 

All of this creates another route in for attackers.  They can embed macros, hyperlinks, scripts and password-protected content or malicious links or scripts that won’t be picked up by traditional antivirus tools. 

The odds are not stacked in the defenders’ favour: missing just one single malicious file transfer can lead to an incident or a serious operational disruption. Consider then, that we have found that one in fourteen files initially categorised as safe by reputation sources was later proven malicious, and we can see the scale of the issue facing security teams. 

What types of threats are posing challenges? 

Security teams are facing a battle on several fronts and one of the biggest risk areas is AI- enabled fraud. Generative AI tools are increasingly capable of producing highly convincing fake identity documents, which can evade detection when customers are account onboarding. The days of spotting a fake documents by its wonky logo and dodgy spelling have gone.

We’re also seeing the tried and tested techniques of phishing attacks and social engineering being used to carry out highly effective campaigns. Phishing remains a primary route for stealing credentials, which can then provide direct access to cloud platforms.  

Criminals know who the ‘high-value’ privileged users are, and target them accordingly. It’s the criminal version of account-based marketing: identify the target, personalise the approach and make the conversion – except here, the prize is the not-so-legal access to an organisation.

Certain users - such as Security Operations Centre (SOC) analysts - are also targeted directly or approached on professional networking platforms and offered financial incentives in exchange for credentials. In a hybrid working world, it’s increasingly difficult to assess intent through trusted platforms. Not every unsolicited LinkedIn message, it turns out, is offering an exciting new career opportunity.

One of the biggest risks facing the sector may not come from within its own perimeter. More than 40% of all cyber incidents reported to the FCA in 2025 involved a third‑party provider. In cybersecurity, somebody else’s problem has an unfortunate habit of becoming yours, and this  was seen following the high-profile retail and manufacturing attacks in 2025. Supply chain attacks can affect many organisations simultaneously and lay bare how the interconnected nature of systems can leave even the largest organisations highly vulnerable. 

How does team structure impact this? 

Financial Services organisations have spent years developing some of the most sophisticated and resilient cyber infrastructures and, overall, the sector is generally strong at collaboration once a trusted system exists. 

The challenges can lie in the way that the security teams are structured. Traditionally, financial institutions’ security teams have been structured around specialist silos.  

SOC teams are on the front-lines of cyber defence, responsible for continuous monitoring, handling alerts and operating as the ‘first responders’ if malicious activity is identified. 

Alongside them, threat intelligence teams monitor the external landscape and provide early warnings of emerging campaigns, while security engineers build and maintain the infrastructure and controls designed to prevent incidents in the first place.

On paper, it is a neat division of labour. Unfortunately, cybercriminals have little respect for organisational charts. As organisations grow, they accumulate more tools and data, making fragmentation between teams increasingly difficult to manage.

The result can be slower detection and response, giving attackers more time to move laterally and establish a foothold in the network.

How should security teams work more effectively together in unified workflows? 

There are several ways to streamline work which depend on team culture and communication; a good first step would be for teams to understand the demands and workflows of their counterparts. 

SOC analysts should understand detection engineering and threat intelligence, not just alert triage, and detection engineers need threat intelligence context to build resilient, not just preventative, controls. 

Technology also has a role to play, particularly when teams need to make quick decisions. Taking file inspection as an example; there would typically have been a trade-off between time and depth when it came to checks - either deep inspection on files to ensure they are safe or maintaining speed and accepting there will be security blind spots.  

That’s not workable at a time when security matters more than ever, but it can’t be the barrier to people getting on with their jobs. Security teams need to quickly determine whether a file is safe, malicious, or suspicious and traditional antivirus and sandbox tools were never architected for the scale or complexity of modern organisations.

New approaches, known as Deep Content Disarm and Reconstruction (CDR) are closing this gap, combining the depth needed to quickly sanitise files, from removable media to email attachments, and to detect unknown threats before they reach users, devices, or internal systems. 

This is the path to improved and more cohesive security: intelligent solutions which secure data movement without slowing down workflows.