For too long, leadership teams across financial services have treated cybersecurity as a defensive item expense, a cost centre to be minimised wherever possible. However, as sophisticated threat actors scale their operations and exploit systemic gaps across global markets, this mindset is rapidly becoming a major liability. Financial institutions must fundamentally shift away from viewing security as an operational cost and start building it as vital, non-negotiable business infrastructure.
At Sibos 2026, our founder, Julia Streets, MBE, chaired an Innotribe session titled “Swimming with Sharks” to address this exact transition. Joined on stage by Mary D’Angelo, Senior Solutions Lead at Filigran, the discussion examined the evolving threat landscape, exposed critical internal blind spots, and mapped out a framework for threat-informed resilience.
To defend an institution effectively, security teams must first understand who is targeting them and how those adversaries operate. Threat actors generally fall into two distinct buckets, defined by vastly different motives, resources, and timelines. Financially motivated criminal groups prioritise speed and low-hanging fruit, aiming to get in, extract cash, and get out. Last year alone, ransomware groups collected $820 million in payments, continually reinvesting these funds to purchase dark-web credentials, recruit or attract insider threats, and hire technical specialists.
Crucially, while much of the public conversation around artificial intelligence focuses on how adversaries deploy deepfakes and automated recon, the panel underscored that we can anticipate that AI will increasingly become a vital tool for defenders to counter these well-funded threat networks.
State-sponsored actors act differently. They play a patient, long-term strategic game, seeking persistent access, intelligence, and influence while remaining undetected for years.
Regardless of motive, modern adversaries are conducting a systematic assault on identity and trust. Recent real-world breaches illustrate the scale of this problem, ranging from compromised FBI agent data to Revolut disclosing customer details in response to a fraudulent request originating from a legitimate government email domain. On the dark web’s Nexus Marketplace, over 153 million driver’s licenses surfaced recently, proving that personal identification data is being systematically harvested and distributed.
Because physical documents and personally identifiable information (PII) are widely compromised on dark-web marketplaces, institutions can no longer rely on traditional verification methods. Verifying whether a driver’s license or physical document appears genuine is no longer sufficient evidence of true identity.
Security evaluation must shift from asking “Is this document real?” to asking “Who is presenting this evidence, what authority do they hold, and does their request fit their expected behavioural context?”.
Over a 5- to 15-year horizon, current identity mechanisms like driver’s licenses will become obsolete, forcing the industry to invent entirely new digital trust models.
Analysing the Attack Anatomy Using the F3 Framework is Crucial
To counter these threats, the panel highlighted the F3 Fight Fraud Framework, developed jointly by MITRE, FS-ISAC, and other leading financial institutions. The framework maps attacks from the criminal’s perspective across six sequential stages: Reconnaissance, Resource Development, Access, Stealth, Account/Payment Changes, and Monetisation.
Most institutions operate beneath an “iceberg” effect, only detecting fraud at the final Monetisation stage when an automated alert fires, which is often far too late. True resilience requires detecting and disrupting adversary activity much earlier, specifically during the Reconnaissance and Resource Development phases.
In addition, despite widespread industry fascination with advanced AI threats, basic social engineering remains the primary entry point. Threat groups like Scattered Spider continue to achieve massive success simply by calling IT help desks to trick staff and bypass identity controls.
Defenders also face significant self-imposed challenges. Viewing cybersecurity as an expense severely restricts security teams’ budget and operational agility. Internal fragmentation creates severe blind spots, as departmental silos between cyber, fraud, identity, AML, risk, and customer support hide coordinated attacks that span across multiple functions.
Additionally, market pressure to deploy generative AI features into production without rigorous quality testing expands the attack surface. Third-party partners and fintech vendors represent a massive vulnerability in this ecosystem, currently accounting for roughly 30% of cyberattacks.
To close these gaps, cyber threat intelligence must serve as the connective tissue linking disparate departments across the enterprise. Intelligence cannot sit passively in static reports; it must be operationalised to directly drive risk management, policy adjustments, and process changes.
Following an incident, cross-functional teams should gather around the F3 framework and “walk backwards” to pinpoint where early intelligence signals were missed, using those learnings to strengthen defences.
While AI provides threat actors with new tools for automated reconnaissance and deepfakes, it also offers defenders a vital advantage. By dramatically accelerating post-incident analysis and distilling complex threat data, defensive AI helps security teams rapidly identify missed signals, automate investigative workflows, and continuously reinforce institutional defences.
Cybersecurity is no longer simply an IT responsibility or regulatory obligation. It has become a foundational component of market trust, operational resilience, and competitive advantage. Institutions that treat it as strategic infrastructure will be significantly better positioned to withstand the next generation of threats.
To translate these panel insights into tangible action, leadership teams and board members must regularly evaluate three fundamental questions:
