Finance Sector

A ransomware attack or credential-led intrusion does not always begin with an outage. Transactions may continue to clear, portals may remain open, trading screens may still show positions and customers may continue to log in. Availability, however, does not establish that the account, session, supplier connection or data flow behind each action remains legitimate.

A settlement path can appear normal while compromised access is being used within it. A vendor connection may continue operating after its credentials become suspect. A service account can keep authenticating even when the actions performed through it no longer belong to your organisation.

During a live intrusion, availability and authorisation can diverge. The immediate risk is therefore not only a future outage. Apparently normal activity can carry an attacker towards customer data, privileged systems or market infrastructure before the institution narrows the route.

Financial leaders naturally watch whether payments move, portals remain available and trading, treasury and customer-service teams continue to operate. Those indicators show that a service is running. They do not prove that every instruction is authorised or that every connected route should remain open.

A payments workflow can continue while a supplier connection is under investigation. A privileged session can remain technically valid after the person or process behind it has become suspect. A customer channel can stay online while the institution is still determining whether the same environment exposes customer data or transaction metadata.

Financial resilience therefore depends on the ability to validate origin, authority and route while activity continues. The institution needs to reconcile exceptions, restrict questionable access and preserve regulated services without treating availability as evidence that nothing has changed.

The ICBC Financial Services incident showed why finance is not only a data target.

Reuters reported that the U.S. arm of Industrial and Commercial Bank of China was hit by ransomware in November 2023, disrupting trades in the U.S. Treasury market. The incident was limited in market impact, but it exposed a larger truth: a cyber incident at one financial entity can touch the plumbing through which other institutions move money, securities and obligation.

The deeper operational detail was more revealing. Reuters later reported that the hack left the brokerage temporarily owing BNY Mellon $9 billion for unsettled trades. Reuters also reported that corporate email stopped functioning and that ICBC had to work with market infrastructure partners while it recovered.

That is the finance control problem in miniature. The issue is not whether one firm had an outage. The issue is what happens when the market depends on a flow that suddenly has to be trusted, rerouted, reconciled and explained under pressure.

In financial services, an incident does not have to be systemic to create systemic anxiety. It only has to make other institutions ask: are we exposed, are our routes safe, and can we prove control quickly enough?

Finance leaders recognise this pressure because it rarely arrives as one visible failure. It arrives as uncertainty inside flows that normally run invisibly.

• A settlement path is delayed, rerouted or manually reconciled while counterparties ask whether exposure exists.
• A supplier platform remains connected, but the institution can no longer treat that route as automatically safe.
• A privileged identity, remote session or service account behaves normally enough to pass ordinary trust checks, but abnormally enough to make the risk team hesitate.
• A customer portal stays available, yet leadership worries whether the same environment could expose customer data or transaction metadata.
• Regulators, markets, clients, legal teams and operational leaders ask different versions of the same question: what is affected, what is contained, and what can continue?
• Security teams may see the signal, but the business has to decide how much of the flow can be narrowed without creating the very disruption it is trying to avoid.

This is why finance cannot treat cyber resilience as a purely defensive function. It is also a continuity, trust and governability function.

A financial institution must preserve confidence in service while reducing the attacker's ability to use legitimate routes against it.

Financial services are built around authorised movement: payments, securities, customer instructions, market data and regulatory records pass continuously between internal systems, counterparties and service providers.

That movement creates the sector-specific dilemma. A questionable account or supplier route cannot always be judged in isolation because other services may depend on it, and transactions already in motion may still require settlement, reconciliation or customer communication.

Regulatory frameworks such as DORA strengthen ICT risk management, incident reporting, resilience testing and third-party oversight. During a live incident, the institution must also demonstrate which activity was restricted, which services continued and what evidence supported those decisions.

The distinctive finance problem is therefore not an abstract loss of trust. It is the possibility that apparently normal activity is no longer properly authorised, reconcilable or defensible.

Modern financial institutions are heavily protected, but they are not self-contained. They rely on core banking platforms, outsourced technology providers, payment processors, cloud services, market-data providers, identity services, reporting platforms, compliance tooling and managed service providers. Many of these routes are trusted deeply because the business cannot operate without them. That creates a structural exposure: the institution can mature faster than the ecosystem around it.

Black Kite's 2026 financial-services research described a two-front pressure: direct ransomware incidents targeting financial institutions rose from 156 in 2024 to 202 in 2025, while Q1 2026 was already 76% higher than Q1 2025. The same research found that 109 of 140 core finance vendors showed at least one critical-level patch management failure. The exact numbers matter less than the pattern.

A financial institution may be regulated, tested and monitored. The vendor path may still become the weak route through which trust begins to degrade. This is why finance needs containment that can operate across identity, server, virtual and supplier pathways, not only perimeter prevention at the edge of the institution.

Late containment changes the nature of a financial incident.

A single compromised identity becomes a wider search through privileged access. A server-side intrusion becomes a path into adjacent systems. A supplier connection becomes a question for every dependent service. A virtual environment becomes a concentration point. Customer data becomes leverage. A local disruption becomes a confidence event.

The cost is not only downtime. It is uncertainty in the institution's ability to explain what happened, what is safe, what can keep moving and what evidence supports those claims.

Sophos reported that, in 2024, 90% of financial services organisations hit by ransomware said attackers attempted to compromise their backups. Sophos also reported that the mean recovery cost in the sector rose to $2.58 million.

Those findings reinforce a practical point: attackers do not only encrypt. They try to remove your organisation's room to recover and negotiate control. By the time recovery becomes the only remaining lever, the institution is already operating with fewer options.

Finance cannot afford to discover too late that its only containment options are broad shutdown, manual workaround or uncertain continuation.

Early containment preserves transaction options. If harmful activity is restricted before it reaches more accounts, servers, data stores or virtual workloads, fewer financial services need emergency interruption and fewer transactions require manual exception handling.

The institution gains time to isolate suspect access, reconcile affected activity and keep unaffected channels operating. It can give counterparties, customers and regulators a clearer account of which services continued, which routes were restricted and which evidence supports that position.

The objective is not to preserve every connection. It is to reduce the attacker's reach before questionable access becomes a wider transaction, customer-data or market-infrastructure problem.

Controlled containment is more useful than a blunt shutdown when the institution has already agreed which flows can be narrowed, who may authorise the action and how exceptions will be reconciled.

Our containment platform becomes relevant when a financial institution needs to interrupt harmful activity without unnecessarily removing the operational trust on which essential services still depend.

Ransomware Containment is the platform. It agentlessly monitors file activity across the protected data environment and, once illegitimate encryption begins, isolates the responsible user, session or device to prevent the encryption process from spreading further.

Additional Server Intrusion Protection (SIP) and Virtual Server Protection (VSP) features run on the platform and extend its capabilities. SIP detects and contains compromised server access before an attacker can progress further. VSP monitors and protects supported VMware, vSphere, ESXi and Hyper-V environments against attacks directed at the hypervisor layer.

For a financial institution, these controls support a more precise response. Active encryption can be contained before it spreads across additional file shares and data stores. Compromised administrative or remote-support access can be interrupted before it becomes a deeper route into critical systems. Attacks directed at supported virtual infrastructure can be addressed before one concentrated layer places multiple dependent workloads at risk.

Our platform complements existing prevention, detection, EDR, SIEM, identity controls and resilience planning by adding executable containment when malicious activity becomes visible. Security and infrastructure teams can restrict the harmful activity while the executive and operational teams determine which services can continue, which transactions require additional verification and what the wider response requires.

How our platform strengthens financial control

A financial institution should not wait for a live incident to discover whether it has the authority, technical control and evidence required to contain harmful activity without unnecessarily disrupting trusted services.

The wider readiness questions should be addressed through architecture review, response planning, technical discussion and appropriately scoped validation:

• Can active ransomware encryption be isolated before it spreads across additional file shares and data stores?
• Can compromised administrative or remote-support access be contained before an attacker reaches systems supporting payments, customer portals, reporting or treasury operations?
• Are supported virtual environments protected if an attack is directed below the application and operating-system layers?
• Can compromised server access be interrupted before an attacker disables controls, stages ransomware or exfiltrates sensitive data?
• Can the executive and incident teams explain which accounts, sessions or systems were contained, which services remain available and what evidence supports that position?

These questions determine whether a financial institution can preserve transaction integrity, justify its decisions and continue essential services while an incident is still developing.

Our remote ransomware resilience assessment has a deliberately narrower role. It evaluates the platform’s Ransomware Containment functionality by running controlled file-encryption scenarios with the institution’s existing security controls left active, first without RC enabled and then with RC enabled. It does not test SIP, VSP, lateral-movement interruption, data-exfiltration prevention, supplier dependencies, governance or wider business-continuity readiness.

Containment changes the financial question. From "how bad is the breach?", to "what is the attack no longer allowed to touch?"