CBEST 2025 shows cyber fragility is still a containment problem

At a glance

What this is: CBEST 2025 shows that financial institutions can still look well controlled on paper while failing to contain attackers once they gain internal access.

Why it matters: IAM, network, and detection teams need to treat containment as a design requirement because weak identity enforcement and flat trust paths let compromise spread quickly.

Context

CBEST is a threat-led testing framework that measures how organisations perform against realistic attack conditions rather than how many controls they can list. In this article, the primary security problem is not the presence of controls but the gap between policy design and production enforcement across identity, infrastructure, network, and monitoring domains. That gap is especially important for banking and other regulated environments where a single compromise can cascade across critical services.

For identity and access practitioners, the article is a reminder that strong authentication alone does not solve lateral movement. If administrator, service, and help desk access are not tightly governed, attackers can turn one foothold into broad internal reach. That makes CBEST relevant not only to cyber resilience teams but also to IAM, PAM, and NHI governance owners.

The pattern described is typical of mature environments under stress, not an isolated exception. The hard lesson is that resilience depends on limiting what an attacker can reach after entry, not only on preventing the initial entry.

Key questions

Q: What fails first when a bank has controls on paper but still gets breached internally?

A: The first failure is usually containment, not policy. If segmentation, privilege boundaries, and account discipline are weak, an attacker can turn one foothold into internal movement before alerts trigger. That is why organisations should measure how far a compromised account can actually reach, not just whether controls exist in documentation.

Q: Why do weak service account and admin controls increase breach impact?

A: Because privileged accounts often have broad reach and are trusted by systems and operators. When those accounts are over-permissioned, poorly stored, or reused, an attacker can escalate quickly and move laterally with legitimate credentials. In practice, excess privilege turns a local compromise into a wider operational risk.

Q: What are the signs that internal containment is failing?

A: Look for flat network paths, development and production systems that can talk too freely, privileged accounts with broad reach, and alerts that only fire after suspicious traffic has already spread. If a single compromise can touch multiple critical services, containment is not working as designed.

Q: How should banking teams respond when EDR does not catch lateral movement?

A: Treat EDR as one layer of evidence, not the control that stops spread. Banking teams should tighten segmentation, reduce unnecessary trust between systems, and validate whether valid credentials can still reach sensitive assets. The goal is to stop internal movement even when endpoint detection is late.

Technical breakdown

Why flat trust paths defeat containment

Containment fails when internal systems are allowed to trust each other too broadly. In the CBEST findings, poor segmentation and weak separation between environments meant an attacker who entered one place could reach many others without hitting meaningful barriers. That is an architectural problem, not just a tooling issue. Zero trust thinking matters here because it assumes the network is not inherently trustworthy and that access must be evaluated continuously by identity, device, and context.

Practical implication: Map east-west trust paths and remove implicit reachability between critical workloads and production environments.

How weak identity enforcement becomes lateral movement

Identity controls can exist formally while failing operationally. The report describes weak passwords, insecure password storage, and excessive permissions on administrator and service accounts, all of which make privilege escalation easier after initial access. Once attackers have valid credentials, they often bypass perimeter defences and blend into normal activity. For financial services, this is a governance issue as much as an authentication issue, because standing access and poor account hygiene turn identity into an attack path.

Practical implication: Tighten privileged account governance, especially for service accounts and help desk processes that can expand access.

Why detection tools miss internal compromise

Detection is weakest when it depends on alerts that assume obvious malicious behaviour. CBEST found that poorly tuned EDR, limited traffic inspection, and weak network monitoring let attackers use built-in tools and legitimate credentials without immediate detection. That means visibility gaps are not just operational noise, they are the condition that lets compromise become impact. In practice, detection has to be paired with preventive containment, because late alerts do not stop internal spread.

Practical implication: Correlate endpoint, identity, and network telemetry so containment can begin before internal movement completes.

Threat narrative

Attacker objective: The objective is to move from one initial foothold to broad internal reach inside banking environments while remaining difficult to detect and contain.

1. Entry occurred through realistic attack simulations against live banking environments, where exposed weaknesses in patching, configuration, and identity controls created a usable foothold.
2. Credential access and privilege escalation followed when attackers misused credentials, relied on weak password handling, or exploited over-permissioned administrator and service accounts.
3. Lateral movement spread the intrusion across poorly segmented environments, allowing activity to blend into normal traffic and reach additional systems before detection.
4. Impact was the ability to move inside trusted banking environments with limited resistance, increasing exposure of critical services, privileged access, and sensitive data.

Breaches seen in the wild

• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Containment has become the real resilience control in banking. CBEST shows that firms can accumulate strong point controls and still fail when an attacker gets inside. The decisive question is not whether an organisation has controls, but whether those controls stop internal spread when the first layer fails. For banking and FMI environments, that shifts resilience ownership toward segmentation, identity governance, and blast-radius reduction.

Identity governance is only as strong as its enforcement path. Weak passwords, insecure storage, and excess permissions on administrator and service accounts turn IAM into a lateral movement enabler. This is especially relevant for NHI governance because service accounts and shared credentials often sit outside the same discipline as human access reviews. The control gap is standing internal trust, not authentication theory.

CBEST exposes a containment trust gap. That phrase captures the mismatch between documented security design and what actually happens in production networks under attack. Organisations often assume alerts and perimeter controls will buy time, but CBEST shows attackers can move before that assumption holds. Practitioners should treat internal reachability as a governance problem and a design flaw, not a monitoring shortfall alone.

Financial services resilience is being measured against adversarial realism, not compliance completeness. The Bank of England's testing model rewards systems that can absorb compromise, not just systems that can describe controls well. That means programmes built around checklists, isolated tools, or static policy statements will continue to underperform. The practical conclusion is that banking teams need measurable limits on movement, privilege, and trust.

EDR without containment is an observation layer, not a resilience layer. The article makes clear that visibility and response remain necessary but insufficient when attackers use legitimate tools and valid credentials. That is why control design has to assume detection will be late in some cases. Practitioners should align operational monitoring with explicit movement controls rather than expecting alerts to compensate for a flat network.

From our research library:

• 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
• Read next: Financial Services Identity Security Guide

What this signals

Containment design needs to move closer to the workload and identity layer. Banking teams cannot rely on perimeter assumptions when valid credentials and implicit trust paths allow movement inside the estate. The practical shift is toward tighter communication boundaries, stronger privileged access governance, and verified blast-radius limits.

CBEST-style testing should become a recurring control validation method, not an annual exercise. The article's core lesson is that real attack conditions expose gaps that policy reviews miss. For regulated firms, the programme question is whether a compromised account can still reach critical services before response begins.

Internal trust is now a measurable risk factor. When development, production, and service accounts can interact too freely, the environment becomes harder to defend and easier to traverse. Teams should watch for internal paths that remain open simply because they were never challenged under adversarial testing.

For practitioners

• Harden segmentation around critical banking services Identify the systems that should never be directly reachable from user, development, or shared service zones, then enforce those boundaries at the communication layer.
• Review privileged administrator and service accounts Inventory accounts with elevated reach, remove unnecessary permissions, and separate service credentials from human workflows wherever possible.
• Reduce credential exposure in operational files Search for passwords and access material stored in spreadsheets, shared drives, and other unsecured locations, then move them into governed storage.
• Tune EDR and network monitoring for internal movement Calibrate detections for credential misuse, built-in tool abuse, and suspicious east-west traffic so attackers cannot blend into normal operations.
• Test containment under live-attack assumptions Use threat-led testing to validate whether a single compromised account can move beyond its intended boundary before detection or response begins.

Key takeaways

• CBEST 2025 shows that banking resilience breaks down when internal trust, privilege, and segmentation are not enforced under attack conditions.
• The article links exposure to weak passwords, insecure password storage, broad service-account permissions, and poor detection of east-west movement.
• For practitioners, the control priority is containment: reduce internal reach, tighten privileged access, and test whether compromise can spread.

Key terms

• Containment Gap: Containment gap is the space between detecting a risky condition and actually limiting its spread. In practice, it appears when teams can see exposed ports, reachable workloads, or suspicious flows but lack the policy, ownership, or segmentation to stop movement quickly.
• Lateral Movement: A post-compromise technique where an attacker uses a compromised NHI to move through a network, accessing additional systems and escalating impact without triggering detection.
• Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
• Service Account Governance: The set of policies and operational controls used to manage non-human accounts across their full lifecycle. It covers provisioning, access scope, rotation, revocation, and review, with the goal of preventing long-lived credentials from becoming persistent paths into critical systems.

Deepen your knowledge

NHI Mgmt Group covers identity security, NHI governance, and agentic AI through independent research, practitioner guides, and the NHI Foundation Level course. It is suitable for security teams that need to connect identity governance with operational containment and access control.