Financial Cyber and Operational Resilience
The Global Risks Alliance (GRA)
Financial firms face ransomware, intrusions to steal data or funds, attacks that enable fraud, insider threats and activity by state-linked groups. Attackers exploit vulnerabilities in software, suppliers and people. This page sets out how cyber threats to finance develop and spread, how they are tracked, and who decides how firms and authorities respond. It describes threats in general terms and does not publish intelligence.
GRA · In development · service level R0
Cyber threats to financial firms are attempts to steal, disrupt or corrupt financial services through ransomware, intrusion, credential theft, supply chain compromise and state-linked activity. They are tracked through incident reports and threat landscapes. Boards, supervisors, law enforcement and sector sharing bodies decide the response.
How a failure at one financial centre can spread through settlement links. Design links, not real dependencies.
The working screen behind this subject: its structure, terms and states. Names are placeholders and values illustrative.
Financial cyber threats · Bank B services · Self-assessment 2
| Make a payment | 3 | 2 | Cloud region loss | Within |
| Access cash | 24 | 13 | Cyber attack | Within |
| Mortgage servicing | 58 | 37 | Data centre loss | Within |
| Claims payment | 45 | 60 | Third-party failure | Outside |
people · process · technology · third parties
Attack paths and control evidence. The dossier below sets out how the risk develops, what is measured, where the data come from, how it is modelled and who decides.
Encrypting systems and threatening to leak data, ransomware groups can stop services for days. Paying does not guarantee recovery and may breach sanctions.
Phishing, social engineering and stolen credentials remain common ways in. Help desks and privileged access are frequent targets.
Compromise of a software update or managed service gives attackers access to many customers at once.
Tensions bring disruptive attacks on financial infrastructure and firms, beyond theft, with aims to undermine confidence.
Each term as this page uses it. Where a standard-setting body defines the term, the wording follows that body.
| Term | Definition |
|---|---|
| Ransomware | Malicious software that encrypts or steals data and demands payment for its release. |
| Social engineering | Manipulating people into revealing information or granting access to systems. |
| Supply chain attack | An attack that compromises a supplier's product or service to reach its customers. |
Each indicator carries its unit, its cadence, the kind of source behind it and the evidence label a value would carry. No values are shown: a programme supplies them under its own authority.
| Indicator | Unit | Cadence | Source type | Label |
|---|---|---|---|---|
| Cyber incidents reported to financial authorities | count by type | annual | Authority reports | OFFICIAL |
| Ransomware incidents in financial services | count | annual | Industry and authority reports | REPORTED |
| Time to detect intrusion | days | annual | Industry studies | ESTIMATED |
| Known exploited vulnerabilities patched within deadline | share | periodic | Firm records | DECLARED |
| Phishing simulation failure rate | share of staff | periodic | Firm records | DECLARED |
| Cost of cyber incidents | currency | per study | Industry studies | ESTIMATED |
The topic as a computational graph: named sources feed the methods, an evidence review gates the outputs, and the decisions stay with the authorities that hold them.
Fig. 02Nodes carry their type, two metric rows and a state; connectors show what feeds what; dashed frames name the owners; the timeline is the cadence. Design of the pipeline, not a record of a run.
Named public datasets and institutional records, each with its licence class. Sources by agreement are used only under their terms and never republished.
| Source | What it gives | Licence class |
|---|---|---|
| ENISA threat landscape for the finance sector | Threat trends in EU finance | Free, ENISA terms |
| FS-ISAC public reports | Financial sector threat trends | Free to read, terms to check |
| IMF Global Financial Stability Report chapter on cyber risk | Analysis of cyber risk to financial stability | Free, IMF terms |
| CISA Known Exploited Vulnerabilities catalog | Actively exploited vulnerabilities | Public domain |
| Carnegie Endowment cyber incident timeline for financial institutions | Public record of incidents affecting finance | Free to read, terms to check |
Financial Cyber and Operational Resilience prepares evidence. The decisions below are taken by the authorities named, under their own rules, and never by the platform.
| Who decides | The question | Evidence this page serves |
|---|---|---|
| Boards and chief information security officers | How much to invest in prevention, detection and recovery | Threat trends and control effectiveness evidence |
| Supervisors | Which cyber expectations to set and enforce | Incident data and sector assessments |
| Law enforcement and sanctions authorities | How to respond to ransomware groups and payments | Legal frameworks and incident intelligence |
| Sector information sharing bodies | What intelligence to share and how | Member reports and threat analysis |
Common initial access routes include phishing and social engineering, stolen or weak credentials, exploitation of unpatched systems exposed to the internet, and compromise of suppliers or software. Once inside, attackers seek to escalate privileges, move laterally and reach valuable systems or data. Ransomware groups often steal data before encrypting systems, to apply double pressure.
Fraud increasingly combines technical and social methods, including impersonation of executives or customers. Attacks on payment systems seek to send fraudulent instructions through legitimate channels. Denial-of-service campaigns aim to disrupt online services. AI tools can make phishing more convincing and help defenders detect anomalies, changing both sides of the contest.
Structured analysis of who might attack what and how, grounded in cybersecurity and cryptography. Limits: depends on imagination and intelligence quality.
Mapping observed techniques to common frameworks of attacker behaviour. Limits: frameworks describe known techniques.
Studying aggregated, anonymized incident data for patterns. Limits: under-reporting and inconsistent classification.
Assessing which controls reduce harm in practice. Limits: rigorous evidence is scarce.
The current service level is R0: information and enquiries. An enquiry receives a reference and names the next step; applications, payments, compute allocations and registrations open only when their team, terms and review capacity exist.