GenAI offers outsized opportunity from faster development and broader security coverage, says Patrick Sullivan, VP and CTO at Akamai. It also introduces novel risks by breaking traditional assurance models and opening new attack surfaces. The creative, non-deterministic nature of GenAI forces tough choices between creativity, predictability, and security – but Sullivan says a bedrock of first principles reduces the risk in the sector’s increasingly non-deterministic environment.

Fraud is changing, says Romano Stasi, Managing Director, ABI Labs. More and more, fraudsters don’t break into systems – they trick customers into giving the threat actor access to their data and accounts. Italian banks are responding with investments in customer education, cybersecurity, and AI tools – even funny commercials aimed at potential victims. Still, Stasi believes collaboration within banks and across the ecosystem is necessary to fight fraud.  

MasterCard’s definition of resilience is to prepare for – and deliver despite – any local, regional, or global crisis that might arise, says Fadwa Rachi, Director, Head of MasterCard's European Cyber Resilience Centre. Mastercard can execute on that definition because leaders drive an exceptionally proactive culture and because its highly organized response teams – uniting over 30 different departments – take a situationally adaptive approach to communication, deployment, and exercising. Listen in as Fadwa describes how MasterCard’s resilience machine runs. 

As LLMs become the gateway to the internet, agentic AI grows ubiquitous, and the threat landscape evolves faster, CISOs may need to think about security modernization in a new way. Everything from endpoint access to fraud strategies to data localization will be affected, says Grant Bourzikas, Chief Security Officer, Cloudflare. Still, he believes that despite these critical shifts in the financial sector’s digital landscape, the basics will be even more important: contextualized intelligence, core security principles – and common sense.  

 In APAC, cyber defenders are likelier to share tactical threat intel rather than strategic information, often out of fear of suggesting they were breached, says Devinder Singh, Maybank’s CISO. But getting intel out fast – and across borders – is key to the sector's defense. To encourage a culture of trust and collaboration, Singh says APAC cyber teams need to share information on successful defenses, have the option of anonymity, and be sure of their leaders’ and regulators’ support. After all, sharing is a shield, and doing the right thing is often doing the smart thing.

Quantum computing’s threat to cryptography makes many cyber experts in the financial services sector nervous. But Jaime Gomez Garcia, Global Head of Santander's Quantum Threat Program and Chair of Europol's Quantum Safe Financial Forum, thinks stoking anxiety around quantum is the wrong approach. He says cyber leaders should pose quantum resilience as “basic cybersecurity hygiene” — because, in reality, it is — prioritize use cases, and invite risk managers to the conversation. But most importantly, the sector must coordinate its efforts because, as Garcia says, we have to do this together.

Cybersecurity threats to an institution are no longer limited to the organization themselves, as threat actors launch attacks across the entire supply chain in hopes of disrupting the financial services sector. Managing supply chain risk is top of mind for Ariel Weintraub, Chief Information Security Officer, Aon, who emphasizes that cybersecurity is not a competition, but an opportunity to share best practices and timely information to maintain the resilience of the global financial sector.

The quantum revolution is coming to the financial sector. Debbie Janeczek, Global Chief Information Security Officer, ING, is preparing for it and says the rest of the sector should, too. She suggests starting with building leadership’s awareness of quantum risks, inventorying algorithms, and developing the skill sets needed for post quantum cryptography. Those moves, among others, will help financial firms be ready when the quantum revolution arrives — and it’s getting closer every day.

The goal of information security is to not react to the change. It's to learn about change in advance. That’s one of the many lessons Meg Anderson, former CISO, Principal Financial Group, has learned after 40 years in cybersecurity. It’s a lesson she’s instilled in her teams, along with the power of saying no, the vital importance of developing a pipeline, and why cyber leaders need business leaders’ trust. Those lessons will help CISOs succeed, even as the cyber landscape changes. 

Fraud is one of the sector's biggest concerns, but passwords aren’t much of an obstacle to today’s innovative cybercriminals. Biometrics are the next frontier, but how do you get customers to accept the pivot?  Susan Koski, Chief Information Security Officer, PNC, has been examining the challenge and recommends managing by facts and known risks, understanding fraud prevention as a cross-sector problem, and remembering that the customer experience has to be central to the post-password cyber landscape.