FinCyber Today

Australia is unique in a lot of ways, including its approach to cyber resilience. In this episode, Robert Veres, CISO at Colonial First State and Co-Chair of the Australian Superannuation Cybersecurity Forum, outlines how one of the world's largest retirement savings systems is adapting to escalating cyber threats, highly prescriptive resilience regulations, and growing concentration risk across critical suppliers. From the limits of traditional vendor attestations to the challenge of managing third- and fourth-party dependencies, he shares practical lessons and a candid look at the impact of collaboration in the financial ecosystem. 

For over 50 years, the global investment company Temasek has selected its portfolio based on long-term structural trends “with tomorrow in mind,” as the company says. One of those long-term trends – watched closely by Temasek’s Chief Information Security Officer, Cheri Lim – is the evolution of Artificial Intelligence (AI) as both a tool of and a threat to cybersecurity.  

In this conversation, Lim describes Temasek’s portfolio‑based cybersecurity and resilience model, her concerns about the black box of the supply chain, and the potential benefits to cybersecurity from agentic AI. Those are long-term trends too, which Lim considers increasingly inseparable from business success. 

Smaller financial institutions face the same threats as their larger peers but have far fewer resources. Yet Dana Turner, the CISO at Nebraska’s Union Bank and Trust, has designed enterprise-grade resilience without enterprise-scale assets, such as multinational cyber range exercises involving 14 infrastructure industries, and an IT inventory of every person, place, and thing in the bank. His approach is the result of years of experience, the knowledge of what matters to his exec team, and a firm belief that threat actors care more about an institution’s exposure than its size.

FS-ISAC has been at the forefront of the sector’s collective security and resilience for over 25 years. But the threat environment across the financial services ecosystem is changing at an unprecedented rate – and our operating model is evolving in response. 

Our CEO, Valerie Abend, outlines how our core services are a necessary response to the threat landscape, details our call to collaborative engagement, and explains why FS-ISAC’s mission to advance the cybersecurity and resilience of the global financial system will never change – but the way we achieve it must.

GenAI offers outsized opportunity from faster development and broader security coverage, says Patrick Sullivan, VP and CTO at Akamai. It also introduces novel risks by breaking traditional assurance models and opening new attack surfaces. The creative, non-deterministic nature of GenAI forces tough choices between creativity, predictability, and security – but Sullivan says a bedrock of first principles reduces the risk in the sector’s increasingly non-deterministic environment.

Fraud is changing, says Romano Stasi, Managing Director, ABI Labs. More and more, fraudsters don’t break into systems – they trick customers into giving the threat actor access to their data and accounts. Italian banks are responding with investments in customer education, cybersecurity, and AI tools – even funny commercials aimed at potential victims. Still, Stasi believes collaboration within banks and across the ecosystem is necessary to fight fraud.  

MasterCard’s definition of resilience is to prepare for – and deliver despite – any local, regional, or global crisis that might arise, says Fadwa Rachi, Director, Head of MasterCard's European Cyber Resilience Centre. Mastercard can execute on that definition because leaders drive an exceptionally proactive culture and because its highly organized response teams – uniting over 30 different departments – take a situationally adaptive approach to communication, deployment, and exercising. Listen in as Fadwa describes how MasterCard’s resilience machine runs. 

As LLMs become the gateway to the internet, agentic AI grows ubiquitous, and the threat landscape evolves faster, CISOs may need to think about security modernization in a new way. Everything from endpoint access to fraud strategies to data localization will be affected, says Grant Bourzikas, Chief Security Officer, Cloudflare. Still, he believes that despite these critical shifts in the financial sector’s digital landscape, the basics will be even more important: contextualized intelligence, core security principles – and common sense.  

 In APAC, cyber defenders are likelier to share tactical threat intel rather than strategic information, often out of fear of suggesting they were breached, says Devinder Singh, Maybank’s CISO. But getting intel out fast – and across borders – is key to the sector's defense. To encourage a culture of trust and collaboration, Singh says APAC cyber teams need to share information on successful defenses, have the option of anonymity, and be sure of their leaders’ and regulators’ support. After all, sharing is a shield, and doing the right thing is often doing the smart thing.

Quantum computing’s threat to cryptography makes many cyber experts in the financial services sector nervous. But Jaime Gomez Garcia, Global Head of Santander's Quantum Threat Program and Chair of Europol's Quantum Safe Financial Forum, thinks stoking anxiety around quantum is the wrong approach. He says cyber leaders should pose quantum resilience as “basic cybersecurity hygiene” — because, in reality, it is — prioritize use cases, and invite risk managers to the conversation. But most importantly, the sector must coordinate its efforts because, as Garcia says, we have to do this together.