Article Details

Bank of England: Financial sector failing to implement basic cybersecurity controls. Mind the cyber gap – similar flaws highlighted multiple years in a row. Concerned about the orgs that safeguard your money? The UK's annual cybersecurity review for 2025 suggests you should be. Despite years of regulation, financial organizations continue to miss basic cybersecurity safeguards. The latest findings come from the CBEST report, which was co-authored by representatives from the Prudential Regulation Authority, Financial Conduct Authority, and Bank of England. Taking 2025's most prominent findings from 13 CBEST assessments and regulator-backed pentests for finance businesses, BoE found weaknesses like poor access controls and passwords were common among businesses and financial management infrastructures (FMIs). From a technical perspective, misconfigured and inconsistently patched systems were highlighted as recurring issues, as were mechanisms for detecting potential intrusions and vulnerabilities. The report noted: "Given the sophistication of some attackers, it is important that firms and FMIs are prepared to handle breaches effectively, rather than relying solely on protective controls.  "In addition to technical measures, we continue to observe challenges in staff culture, awareness, and training, highlighting that technical measures alone are not sufficient." CBEST assessments revealed that criminals using social engineering tactics could bypass controls when targeting organizations with a poor security culture. Assessors believe that phishing could be successful in some cases, and that staff revealing sensitive information through social media and job descriptions was a realistic possibility. FMIs that did not have strict protocols for their helpdesks, such as verifying the identity of callers, were also vulnerable to attackers who fraudulently accessed legitimate credentials. The NCSC weighed in on this matter, saying these kinds of attacks are the bread and butter of groups like Scattered Spider. The group is thought to be comprised of native English speakers and cyber-cops speculate it is behind at least some of the high profile attacks on British businesses last year. "They are known to use phishing and spear phishing to leverage established trust in organizations," said the NCSC. "Therefore, it is important to ensure that all individuals in an organization are aware of potential tricks and methods to counter these attempts." Social engineering attacks were one of the few areas of focus for CBEST assessments in 2025, which are required to simulate the most severe and plausible threats to FMIs.  Other types of attack that regulated financial organizations were tested against included those from sophisticated and state-sponsored groups, compromised third parties and supply chains, and malicious insiders. All four of these themes were observed frequently in real-world attacks throughout the year. The orgs said regulated entities needed to improve their resilience against them. Comparing the results of the 2025 assessments with previous years makes for interesting, if unsurprising reading.  Many of the key weaknesses highlighted by the assessments over the past 12 months were the primary issues of yesteryear too. Weak configurations, overly permissive access controls, ineffective network and vulnerability monitoring, and staff who were susceptible to social engineering and phishing were all features of the BoE's reports from 2023 and 2024.  It's not all bad, though. CBEST assessors found that organizations and FMIs "demonstrated a range of maturities across cyber threat intelligence (CTI) management domains." They judged most of the assessed orgs to have "relatively effective foundations" across CTI operating models, although the report said the intelligence was not often well-integrated across the business. Plus, despite many of the main weaknesses identified in previous years remaining unaddressed in 2025, improvements can be seen, such as with MFA.  Per the 2023 and 2024 reports, organizations were struggling to roll out effective MFA programs, but the control was not mentioned alongside the primary failures in the most recent annual review. The purpose of CBEST assessments is not to introduce new regulatory requirements on those in the financial sector, which are already among the most heavily regulated for cybersecurity. The BoE says the assessments serve as guides for all regulated entities to understand the most common security gaps that are likely to lead to a successful cyberattack, and potentially damaging consequences resulting from one.