Jack Madine, Senior Product Manager at OPSWAT
Like every other industry, the security challenges for banks have entered a new era. The old techniques designed to protect against nation state-funded ransomware attacks, and social engineering campaigns designed to de-fraud customers, are no longer sufficient on their own.
We’re in an era of criminal groups supercharged by AI, which means that the barriers to entry are lower, attackers can move more quickly and with greater precision. The window of time between vulnerability discovery and exploitation has also shrunk; consider that in 2018, the median time from disclosure to exploitation for Common Vulnerabilities and Exploits (CVEs) was 771 days. It’s projected that will collapse to one minute by 2028, putting teams under new pressures to react to, and patch, critical threats.
Complex, interconnected systems, which rely on the security of external suppliers and third parties, place further strain on a sector that’s already facing huge external geopolitical and regulatory pressures.
The adage that we are “stronger together” has never been more relevant to the banking sector’s daily fight against cyber threats. This why a siloed approach can prevent them from understanding the real scale of threats and, importantly, how best to mitigate them.
What’s one of the most overlooked areas of security?
Given its importance underpinning our critical services, the data it holds and the rewards it offers for cybercriminals, the banking sector has faced huge increases in the number of incidents it has to deal with year-on-year. One report on the finance sector found that incidents rose 76% in Q1 2026 compared to Q1 2025.
As such, banks are amongst the most tightly regulated, well-resourced and sophisticated sectors in terms of the security measures they have in place.
That said, there are areas that can be easy to overlook, especially when it comes to file transfers. This is often because there’s an inherent tension between the need for operational efficiencies – so that everyone within the organisation can get on with their jobs as quickly as possible – and the need for security checks on the files moving into and out of the network which could be embedded with malicious code, active content, or zero-day threats.
This is a big challenge as there are millions of files crossing the perimeter of organisations every few seconds which are receiving far less scrutiny than they should. This includes everything from files needed for customer onboarding to operational documents, contracts and datasets.
Every time a contract is sent to a partner, a dataset is shared with a supplier, or a report is submitted to a regulator, information crosses an organisational boundary. And traditional signature-based defences are struggling to keep pace with the volume and variety of threats that are embedded.
They’re looking for known malware but can’t recognise or stop zero-day threats which leaves organisations exposed at a time when these types of exploits are reaching a record high. The odds are not stacked in the defenders’ favour when attackers now have AI at their disposal to find and weaponise threats in minutes. It’s perhaps not unique to the finance sector, but it’s certainly an area which is easy to miss while teams are having to contend with other challenges.
We can expect breaches involving file-based attacks to rise. This makes approaches such as content disarm and reconstruction (CDR) so important; rather than simply authenticating the channel a file arrives through, it looks inside the file itself, deconstructing it, sanitising it by removing any malicious content and rebuilds a safe, usable version.
How do operational challenges impact security?
Traditionally, financial institutions’ security teams have been structured around specialist silos: SOC analysts handle alerts, threat intelligence teams produce reports, detection engineers build rules, and automation platforms execute predefined playbooks. Meanwhile, separate fraud teams are examining and identifying phishing and social engineering incidents which are very often using a similar playbook to those that the cybersecurity teams are dealing with.
So, you have a wealth of information and intelligence, but it’s spread across different teams, and very often the mechanisms aren’t in place for two-way sharing between departments which can slow the response times of teams.
The answer lies in integrating people, processes and technology into a cohesive detection ecosystem. Regulatory requirements mean that banks need a layered approach to the technology they use for cybersecurity. But security maturity in financial services is no longer about simply adding more controls, it’s also about intelligence sharing, between and across departments, and a coordinated response to disrupt malicious activity as quickly as possible.