Financial services firms have been told they need to act over their cyber security as the implementation of major new regulations looms.

According to a recent State of Ransomware in Financial Services report, 65% of financial services organisations were hit by ransomware in 2024. The report concluded that the most common entry method of ransomware attacks for this sector was compromised credentials, which were used in 30% of attacks, with exploited vulnerabilities coming in second at 27%.

Entrusted with billions of personal data records, financial institutions face a relentless barrage of cyber threats amplified by the proliferation of digital systems and software, and as such regulators are set to act with new rules due to come into force at the end of the year.

Brian Sibley, solutions architect at Espria warned a cyberattack has the potential to disrupt essential services, jeopardise day-to-day transactions, and ultimately undermine customer confidence in the business.

“With the concerning increase in reported cyber incidents in the past three years, it’s crucial for firms, particularly those in the finance and professional services sectors, to build long-lasting cyber resilience strategies and better protect themselves from intruders,” he explained. “Through risk-based prioritisation and reliable technology, these organisations must ensure they can manage and reduce the attack surface for bad actors to strike, otherwise, they may find the risks of rapid technology adoption outweigh the benefits.”

The Digital Operations Resilience Act (DORA), which will take effect in January 2025, will further emphasise the need for financial entities to strengthen their IT security and remain resilient during disruption.

“The new regulations call for specific security measures to establish a harmonised cyber framework consisting of strong baseline cybersecurity such as approved written cybersecurity procedures, continuous vulnerability assessments and Risk Management,” Sibley commented.

Her added many financial and professional services organisations will already have several risk management measures set up, but it can be easy for IT teams to get caught up in managing complex IT environments rather than ensuring all systems are compliant and working to ward off threats effectively.

“Financial institutions must balance maintaining the risk-based approach while raising the bar to address weaknesses observed in prior cyber incidents. Sourcing a reliable MSP to shoulder operational burdens can resolve this for firms struggling to streamline these advanced technologies,” Sibley continued. “Financial institutions can cover any cybersecurity blind spots by adopting managed services to monitor and provide detailed insights into every aspect of their digital ecosystem. Firms can choose to implement the services they require when needed and avoid the costly downtime that comes with getting new solutions up and running, without compromising on expertise. As a result, firms can optimise their technology spending and operations under a single, securely managed umbrella.”

Sibley concluded, “Cyberattacks remain a significant threat to financial services organisations of all sizes. With the new DORA regulation, increased regulatory harmonisation will require updated or new systems to be adopted for survival. Firms must be proactive rather than reactive to keep pace with the changing landscape.”