By Colette Kitterhing, Vice President UK & Ireland at Netskope
It’s no secret that the banking, financial services and insurance (BFSI) industry has gone through a profound transformation in recent years.
Once a branch-based, service-led industry, the BFSI industry is now digital-first and product-led, rolling out innovations such as AI-powered mortgage approvals on mobile apps and personalized savings tools at a global scale in a matter of weeks.
Yet with every new app, platform and cloud deployment, the attack surface widens. This is the velocity paradox: the faster BFSI institutions move to innovate, the more vulnerable they become to cyber threats, regulatory pitfalls and operational breakdowns, all of which are the enemy of speed.
So how did we get here? Let’s step back and explore in more detail.
Innovating Without Compromise
For financial services leaders, standing still is not an option. Today’s customers expect instant approvals, seamless claims and real-time payments. Fintech competitors, built without the burden of legacy systems, set the pace and force established players to move faster just to keep up.
At the same time global expansion, particularly in high-growth markets such as APAC, brings both opportunity and complexity, with regulators and customers alike demanding flawless digital experiences.
However, many financial institutions are weighed down by decades of accumulated infrastructure. Redundant systems, overlapping controls and network designs that were not built for the cloud era create complexity, and slow down essential applications. In a world where milliseconds can affect revenue, compliance or trust, velocity has become a survival imperative.
But velocity isn’t just about moving faster. It’s about moving in the right direction, balancing speed with purpose, stability and resilience.
Managing Converging Threats
This is where the problems begin. The faster BFSI organizations digitize, the more their risks multiply.
Financial institutions have always been prime targets for attackers, but today the stakes are higher than ever. As these companies digitize, the combination of sensitive data, mounting regulatory demands and rapid adoption means even the smallest of missteps can have devastating consequences.
And these risks don’t just come from external attackers. Employee behavior is often the biggest exposure. Shadow IT (including Shadow AI) is an example of this. 92% of financial services workers use personal apps in the workplace, and their quest to optimise productivity sees 13% uploading unsecured sensitive corporate data to these unmanaged apps. Underscoring the severity of this issue, 74% of personal app data policy violations involve uploads of highly regulated personal and financial data.23
Layer onto this issue employees’ growing use of ungoverned generative AI tools (54% of workers admit they would use AI tools without company approval), and you can see the scale of the problem. A drive for personal productivity is resulting in vast amounts of sensitive data being shared with unmanaged applications, bypassing controls and undermining governance.
The Velocity Paradox
All of this leaves CIOs caught between two competing forces: they must keep innovating to stay competitive, yet every step forward seems to expand their risk exposure.
The problem for many BFSI organizations is that they still approach security with a traditional mindset. For decades, the traditional security model was about building strong perimeters to keep threats out and assets in. As data and applications moved to the cloud, those boundaries dissolved – yet most institutions continue to apply strategies built for static, legacy environments.
So while BFSI business leaders are driving digital transformation at speed, security teams are working from a playbook designed for another era. Escaping this loop requires a shift: finding a way to move at speed while simultaneously ensuring trust and resilience are maintained.
Moving Without Breaking Things
The answer is to embed risk-awareness into every stage of innovation so progress happens quickly, but without creating fragility.
This starts with an integrated understanding of data, AI and user behavior. The goal is not just to contain threats, but to instill confidence in every transaction, service and innovation. By rethinking the way that controls are designed and managed, security can shift from being seen purely as a safeguard to being recognized as a catalyst for growth.
Approaches such as zero trust and Secure Access Service Edge (SASE) aim to ensure that data can move to wherever it is needed, and do so efficiently, without compromising security protections. For financial institutions, this can mean expanding services or entering new markets without adding unnecessary delays or exposing new vulnerabilities. Instead of treating security as an afterthought, these frameworks embed security into the architecture from day one, supported by continuous monitoring and safeguards across data, AI and API activity.
From Gatekeeper to Enabler
In a sector handling as much sensitive and valuable data as the BFSI industry, every innovation carries exposure to risk, regulation and reputational scrutiny. But with the right foundation, security shifts from being a barrier to becoming a business accelerator.
By adopting an approach with two acknowledged goals – managing risk and improving velocity, equally weighted and without the need for mutual sabotage – , financial institutions can create a comprehensive security strategy that not only protects the business but also positions it to compete and grow in a digital-first economy. It will be the CIOs who crack the velocity paradox who will redefine competitiveness in financial services in the years to come.