As Chief Information Security Officers (CISOs) at financial services organizations embrace digital transformation and cloud adoption, they face several challenges. Challenges for CISOs include safeguarding critical assets, managing an expanding attack surface, and navigating a complex regulatory landscape. CISOs across the sector must deliver on a broad array of imperatives while operating in a world of reduced visibility and heightened noise due to the proliferation and resulting complexity of data. The capability to focus at once on vulnerabilities, critical assets and incidents has become critical.
While budgets are not necessarily shrinking, they are also not growing in proportion to increasing demands. CISOs must continuously justify their current spending while struggling to secure additional funding for essentials such as automation and cloud security. The bigger challenge is the tension between focusing budgets on innovative solutions that incorporate artificial intelligence (AI) and machine learning (ML) versus ongoing regulatory remediation given the global uptick in new cyber rules and standards.
In addition, financial services CISOs must also navigate an onslaught of multi-regional regulations that are becoming increasingly rigorous and complex. In the US, the Office of the Comptroller of the Currency (OCC) and the Federal Reserve have intensified their oversight of Tier 1 global banks, issuing matters requiring attention (MRAs), formal communications from regulators offered during an examination or review that require an institution to address specific issues. Similarly, in the European Union, regulations such as the Digital Operational Resilience Act (DORA), which requires specific tactical security requirements, are increasing in intensity and priority.
To get ahead of these challenges, CISOs are turning to advanced technologies such as AI and ML to automate security operations, reduce false positives, and streamline incident response. However, technology alone is not enough. CISOs need to promote collaboration and ensure their programs align with the objectives of the business by maintaining open communication with senior leaders. Change is already underway. According to KPMG research, 74 percent of financial services organizations say cybersecurity is typically involved from the earliest planning stages of technology investment planning and has a high influence on the decision-making process.
In the aftermath of the pandemic, many organizations found themselves with bloated second lines of defense. This eventually led to reassessing existing roles and responsibilities. We encourage CISOs to work closely with the second line of defense — which manages oversight of controls — to focus on operational key performance indicators (KPIs) as proxies of the overall health of the digital environment and align those KPIs with the relevant key risk indicators (KRIs). As always, CISOs must be proactive and adaptable, continuously assessing cybersecurity, identifying gaps, and implementing strong yet flexible controls to mitigate risks.
In this report, we will explore some key cybersecurity considerations for financial services organizations with actionable insights and recommendations for CISOs.
Key cybersecurity considerations for CISOs
Real-world cybersecurity in the financial services sector
In financial services, regulatory requirements are increasingly pressuring organizations to strengthen their vulnerability management capabilities. The overwhelming volume of vulnerabilities and decisions requires an innovative solution to address these risks consistently and systematically.
A leading investment bank was looking to develop and implement AI/ML models that enhance operational efficiency and ensure regulatory compliance. Through close collaboration and a comprehensive assessment of the bank's needs, the KPMG firm’s project team devised and deployed ML-driven solutions for vulnerability management and incident response. These solutions leverage targeted use cases to identify weaknesses in current operations and determine where innovative solutions can be most effective. The use cases ranged from triage and ownership assignment to criticality adjustment.
The AI/ML models deployed by KPMG not only reduced manual intervention and accelerated decision-making processes but also incorporated built-in compliance checks. These checks helped ensure that human expertise maintains proper visibility into the models' decision-making processes, aligning with regulatory requirements.
Such solutions enable financial services organizations to identify, prioritize, and remediate vulnerabilities more rapidly than ever before. Thus, they can tackle a wider range of risks across their entire environment, strengthening their overall cybersecurity posture.
As the sector continues to face mounting pressure from regulatory bodies, organizations that proactively adopt innovative solutions can be better positioned to swiftly identify, prioritize, and mitigate vulnerabilities. By doing so, forward-thinking institutions can not only safeguard their assets and reputation but also stay ahead of the curve in an increasingly complex and demanding cybersecurity landscape.
Top priorities for financial services cyber security professionals
- Zero trust architecture: Focusing on identity-centric security and micro-segmentation strategies
- Integrating AI/ML driven tools to automate routine security operations center activities, allowing cybersecurity teams to focus on complex tasks
- Conducting continuous monitoring of third-party vendors to ensure a secure and resilient supply chain
- Developing transparent processes for assessing AI systems, including data classification and quality management, to mitigate privacy concerns and build trust
- Embedding security measures into the development lifecycle of AI technologies to avoid costly retrofitting and potential regulatory or reputational damage
- Engaging with regulatory bodies to stay ahead of compliance requirements and proactively address concerns related to AI implementation
How KPMG professionals can help
With extensive experience in the financial services sector, KPMG firms help CISOs tackle complex challenges, supporting areas such as advanced threat detection, automated incident response, AI-driven vulnerability management, and cyber resilience strategies. We can assist in developing and testing incident response plans, conducting due diligence on third-party vendors, and integrating security into AI technology development. Additionally, we work on regulatory compliance and promote continuous improvement to help ensure operational continuity against evolving cyber threats.
Our commitment to delivering innovative, industry-specific solutions empowers CISOs to proactively address the unique challenges they face and help position their organizations for success in an increasingly complex and demanding cybersecurity landscape. Through our extensive experience and innovative solutions, financial organizations can enhance their cybersecurity posture, protect their assets and reputation, and maintain the trust of their customers and stakeholders.
Contacts
Connect with us
- Find office locations kpmg.findOfficeLocations
- kpmg.emailUs
- Social media @ KPMG kpmg.socialMedia