GRA · Financial Cyber and Operational Resilience
Spatial financeWhere capital meets hazard, exposure and transition
Financial cyber threats
Financial firms face ransomware, intrusions to steal data or funds, attacks that enable fraud, insider threats and activity by state-linked groups. Attackers exploit vulnerabilities in software, suppliers and people. This page sets out how cyber threats to finance develop and spread, how they are tracked, and who decides how firms and authorities respond. It describes threats in general terms and does not publish intelligence.
Financial cyber threats in seven parts.
- 01The questionFinancial cyber threats: how the risk develops
- 02IndicatorsWhat is measured, and how well
- 03SourcesWhere the evidence comes from
- 04DecisionsWho decides, and what the evidence serves
- 05Core questionsWhat threat analysis asks
- 06MechanismsHow attacks reach financial firms
- 07Methods and limitsHow threats and controls are studied
Financial cyber threats: how the risk develops.
Attack paths and control evidence. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Ransomware halts operations
Encrypting systems and threatening to leak data, ransomware groups can stop services for days. Paying does not guarantee recovery and may breach sanctions.
People are the entry point
Phishing, social engineering and stolen credentials remain common ways in. Help desks and privileged access are frequent targets.
Suppliers import risk
Compromise of a software update or managed service gives attackers access to many customers at once.
Geopolitics raises the stakes
Tensions bring disruptive attacks on financial infrastructure and firms, beyond theft, with aims to undermine confidence.
Important business services.
The screen a team would use to follow this subject: its measures, states and decisions. Names are examples and values are illustrative.
Important business services
Financial cyber threats · Bank B services · Self-assessment 2
Services vs impact tolerance
| Make a payment | 3 | 2 | Cloud region loss | Within |
| Access cash | 24 | 13 | Cyber attack | Within |
| Mortgage servicing | 58 | 37 | Data centre loss | Within |
| Claims payment | 45 | 60 | Third-party failure | Outside |
Dependency map
people · process · technology · third parties
Remediation
- R-1Second claims platform supplierExit plan tested70 d
- R-2Immutable backups for paymentsCyber recovery42 d
What is measured, and how well.
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Cyber incidents reported to financial authorities | count by type | annual | Authority reports | Published statistics |
| Ransomware incidents in financial services | count | annual | Industry and authority reports | REPORTED |
| Time to detect intrusion | days | annual | Industry studies | ESTIMATED |
| Known exploited vulnerabilities patched within deadline | share | periodic | Firm records | DECLARED |
| Phishing simulation failure rate | share of staff | periodic | Firm records | DECLARED |
| Cost of cyber incidents | currency | per study | Industry studies | ESTIMATED |
How a local shock becomes a system outage.
How much of the networks an operator, insurer or lender depends on stays working after a local shock, and how much the coupling between them amplifies it. Teaching model with stated illustrative values, not a prediction.
Controls
- Assets per layer
- 18
- Hazard footprint
- 8% of area
- Assets that depend on another layer
- 60%
- Spare capacity (tolerance)
- 30%
Readouts
- Assets hit by the hazard
- 19%
- Assets still working
- 41%
- Amplification of the initial damage
- 3.2 times
- Steps to settle
- 2
Numbers, methods and sources
| Step | Data centres working (%) | Networks working (%) | Power working (%) |
|---|---|---|---|
| 0 | 83 | 94 | 67 |
| 1 | 56 | 56 | 61 |
| 2 | 33 | 50 | 39 |
Methods
- Interdependent networks Buldyrev and others (2010), Catastrophic cascade of failures in interdependent networks, Nature 464
- Overload cascades Motter and Lai (2002), Physical Review E 66
- Betweenness load Brandes (2001), Journal of Mathematical Sociology 25
- Multilayer networks Kivela and others (2014), Journal of Complex Networks 2
- Infrastructure interdependencies Rinaldi, Peerenboom and Kelly (2001), IEEE Control Systems 21(6)
- Uncertainty fan (parameter Monte Carlo) Spiegelhalter, Pearson and Short (2011), Visualising uncertainty about the future, Science 333
- One-at-a-time sensitivity (tornado) Saltelli and others (2008), Global Sensitivity Analysis: The Primer, Wiley
Data
The model runs on the teaching values set by the controls. To calibrate it for a place, read it against these admitted layers and series, which this page's map can draw:
- Major roads Natural Earth
- Railways Natural Earth
- Seaports Natural Earth
- Airports Natural Earth
- Urban extents Natural Earth
- Night lights tonight, outages (VIIRS Day/Night Band) NASA/NOAA VIIRS (Suomi NPP) · register nasa.gibs.context-live-layers
- Natural events (NASA EONET) NASA EONET · register nasa.eonet.events
Across the six pillars, led by Nexus Consortium
- Experiments Labs
- Built in Financial Cyber and Operational Resilience in Foundry
- Tested at Financial Cyber and Operational Resilience in Universe
- Codified in Digital, Cyber and AI in Standards
- Published in Financial Cyber and Operational Resilience in Reports
- Taught in Faculty of Technology and Digital Systems in Academy
Where the evidence comes from.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| ENISA threat landscape for the finance sector | Threat trends in EU finance | Free, ENISA terms |
| FS-ISAC public reports | Financial sector threat trends | Free to read, terms to check |
| IMF Global Financial Stability Report chapter on cyber risk | Analysis of cyber risk to financial stability | Free, IMF terms |
| CISA Known Exploited Vulnerabilities catalogue | Actively exploited vulnerabilities | Public domain |
| Carnegie Endowment cyber incident timeline for financial institutions | Public record of incidents affecting finance | Free to read, terms to check |
What financial cyber threats means for exposure, loss and capital.
The exposure, loss, scenario and capital views a risk officer, supervisor or ministry of finance would ask for, with the frameworks they report against. Structures follow supervisory and actuarial practice. Values are illustrative: never prices, ratings or advice.
Transmission channels
How a shock in financial cyber threats reaches credit, market, underwriting, liquidity and operational risk, and feeds back.
Who decides, and what the evidence serves.
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards and chief information security officers | How much to invest in prevention, detection and recovery | Threat trends and control effectiveness evidence |
| Supervisors | Which cyber expectations to set and enforce | Incident data and sector assessments |
| Law enforcement and sanctions authorities | How to respond to ransomware groups and payments | Legal frameworks and incident intelligence |
| Sector information sharing bodies | What intelligence to share and how | Member reports and threat analysis |
Outputs this topic produces
- Guide to cyber threat categories facing financial firms
- Brief on ransomware and payment decisions
- Method note on reading cyber incident statistics
- Questions for boards on cyber risk appetite
What threat analysis asks.
- Which threat actors target the sector, and what are their motives and typical methods?
- Which attack paths have led to the most significant incidents in the industry?
- What evidence shows which controls reduce the likelihood or impact of these attacks?
- How are threats changing with new technology, including AI?
How attacks reach financial firms.
Common initial access routes include phishing and social engineering, stolen or weak credentials, exploitation of unpatched systems exposed to the internet, and compromise of suppliers or software. Once inside, attackers seek to escalate privileges, move laterally and reach valuable systems or data. Ransomware groups often steal data before encrypting systems, to apply double pressure.
Fraud increasingly combines technical and social methods, including impersonation of executives or customers. Attacks on payment systems seek to send fraudulent instructions through legitimate channels. Denial-of-service campaigns aim to disrupt online services. AI tools can make phishing more convincing and help defenders detect anomalies, changing both sides of the contest.
How threats and controls are studied.
- 01
Threat modelling
Structured analysis of who might attack what and how, grounded in cybersecurity and cryptography. Limits: depends on imagination and intelligence quality.
- 02
Attack framework mapping
Mapping observed techniques to common frameworks of attacker behaviour. Limits: frameworks describe known techniques.
- 03
Incident evidence analysis
Studying aggregated, anonymised incident data for patterns. Limits: under-reporting and inconsistent classification.
- 04
Control effectiveness research
Assessing which controls reduce harm in practice. Limits: rigorous evidence is scarce.
How it is studied, and what the methods cannot say.
- 01Cybersecurity and cryptographyIdentity and privileged access · Detection and response capability · Threat-led testingApplied here
- 02Network science and contagionSector dependency maps · Outage propagation · Software component networksApplied here
- 03Reliability and resilience engineeringService and dependency mapping · Recovery strategy comparison · Learning reviewsApplied here
Questions and answers.
Why are financial firms frequent targets?
Should firms pay ransoms?
What is a supply chain attack?
Does the platform share threat intelligence?
Why not publish detailed attack techniques?
Is AI making attacks worse?
Which controls matter most?
Contribute evidence from this page.
Reports is the Consortium's quarterly publication. What you know about this subject can become evidence, a case or a correction in the next edition, credited to you and published under CC BY 4.0 where it is your own work.
- EmailGateway GW-GRASend it from this pageEvidence, a correction, a case, a method, a review, a translation or profile input. It arrives tagged with this page, so the editor who owns it receives it.
- ZenodoOpen depositDeposit it and submit to the communityPublish your own record on Zenodo with your ORCID iD, then submit it to the Reports community there. Curators review it; the DOI stays yours.
- ReportsGlobal Risks AllianceSee every way to contributeThe contribution types, how each is reviewed, what credit you receive, the licence and what is never accepted.
Never send personal data, sensitive infrastructure detail or anything you have no right to share. A contribution is reviewed before use; sending it confers no authorship or editorial rights, and sponsorship never buys a finding.
Bring an exposure or capital question to the Alliance.
Information and enquiries are open today. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.
Legal documents.
Maps, data and figures on this site are shown for context and general information. They are not advice, forecasts or warnings; the limits of the information are set out in the Disclaimers and Data Notices.