Editorial & Advertiser disclosure

Global Banking & Finance Review® is an online platform offering news, analysis, and opinion on the latest trends, developments, and innovations in the banking and finance industry worldwide. The platform covers a diverse range of topics, including banking, insurance, investment, wealth management, fintech, and regulatory issues. The website publishes news, press releases, opinion and advertorials on various financial organizations, products and services which are commissioned from various Companies, Organizations, PR agencies, Bloggers etc. These commissioned articles are commercial in nature. This is not to be considered as financial advice and should be considered only for information purposes. It does not reflect the views or opinion of our website and is not to be considered an endorsement or a recommendation. We cannot guarantee the accuracy or applicability of any information provided with respect to your individual or personal circumstances. Please seek Professional advice from a qualified professional before making any financial decisions. We link to various third-party websites, affiliate sales networks, and to our advertising partners websites. When you view or click on certain links available on our articles, our partners may compensate us for displaying the content to you or make a purchase or fill a form. This will not incur any additional charges to you. To make things simpler for you to identity or distinguish advertised or sponsored articles or links, you may consider all articles or links hosted on our site as a commercial article placement. We will not be responsible for any loss you may suffer as a result of any omission or inaccuracy on the website.

Home > Technology > Cyber in the finance industry: How can it do better?

Cyber in the finance industry: How can it do better?

Published by Gbaf News

Posted on December 13, 2019

3 min read

Last updated: January 21, 2026

Cyber in the finance industry: How can it do better?

By Jonathan Clarke

Given how lucrative and vital finance companies are to the UK economy, it’s no surprise that cyber criminals are trying their luck at infiltrating these organisations, stealing sensitive information, and causing havoc. In fact, the Financial Conduct Authority has revealed that the number of declared cyber-incidents in the UK finance sector has risen by more than 1000% since last year.

Jonathan Clarke

Jonathan Clarke

The evidence is rife too – earlier this year, Metro Bank became another victim that was added to the list of cyber-attacks, after hackers were able to intercept a telecommunications vulnerability, affecting on a few customers however. Not as lucky was Tesco Bank, which was subjected to a £16.4 million fine when a staggering £2.26 million was stolen from customers’ personal current accounts.

Despite such high-profile attacks being reported within the financial sector, businesses are still failing to implement robust cybersecurity policies. And, amid today’s advanced threat landscape, it is usually a case of ‘when’ and not ‘if’ a firm is breached. Many financial firms are still just trying to get the basics right, have old IT systems in place and do not carry out regular cyber-assessments.

What’s the problem?

It’s evident the industry needs to boost and improve its defence against malicious attackers, but first, it’s important to pinpoint where the issues are coming from. From the BeyondTrust 2019 Privileged Access Threat Report, 58% of organisations believe it is likely they have suffered a breach due to vendor access, and 64% say employees were a cause of the breaches – of which financial organisations are included. Indeed, most organisations in and out of the financial industry are having a difficult time managing privileged insiders and third-party vendors, in fact, almost half still use manual processes to control privileged identities, which simply isn’t scalable.

What’s the solution?

In light of these findings, employee error needs to be minimised, and should it happen, the ramifications need to be promptly dealt with effectively.

The weakest link in an organisation, often starts with employees. Usually ranging from their poor password hygiene, to being targeted by phishing emails. And, unfortunately, by giving employees administrator rights, this puts systems and data in the firing line for hackers. So, it’s paramount to tackle this issue at its root.

Indeed, productivity issues arise when limiting user rights–IT help desks can often be inundated with requests to grant access to basic systems or files. As such, the balance between security and productivity, specifically within a fast-paced, high growth environment like the finance sector, always seems to be a trade-off.

So, how can this be remedied? By removing unnecessary admin rights and giving users just enough access to do their jobs productively, organisations can significantly reduce the attack surface. To achieve this, Privileged Access Management (PAM) can be implemented. Three features of an effective PAM solution include:

Lock down and control credentials: Find, manage, and monitor privileged accounts/assets, and automate privileged password and session management.
Remove excessive end-user privileges: Control and monitor privileged activity on Windows, Mac, Unix, Linux, and network devices, remove excessive privileges without impacting productivity, and enforce granular application control.
Protect internal and vendor remote access: Secure, manage, and audit remote access from third-party vendors and internal employees with privileges, such as the service desk.

When organisations have fully integrated PAM tools, they are more confident to identify threats from employees with privileged access. With control and visibility over their entire environment, organisations can significantly reduce the likelihood that they become a victim of a breach, while allowing their employees to remain fulfilled and productive at work.