TL;DR: Financial institutions faced 566 breaches and more than 254 million leaked records by December 2022, while ransomware attacks in the sector rose from 55% in 2022 to 64% in 2023, according to SentinelOne’s analysis. The practical lesson is that resilience now depends on identity controls, segmentation, and recovery discipline, not perimeter assumptions alone.
At a glance
What this is: SentinelOne's analysis argues that financial-sector cyber resilience now hinges on identity, segmentation, and recovery discipline as breach frequency and ransomware pressure keep rising.
Why it matters: For IAM and PAM teams, the message is that access control, privilege containment, and rapid recovery are now operational resilience controls, not just security hygiene.
By the numbers:
- As of December 2022, finance and insurance organizations globally experienced 566 breaches.
- Those breaches led to over 254 million leaked records.
- Ransomware attacks on financial services increased from 55% in 2022 to 64% in 2023.
Context
Financial-sector resilience is not limited to preventing intrusion. The harder problem is limiting blast radius when attackers get in, because finance combines high-value data, complex third-party access, and tightly coupled operational systems. In that environment, identity governance, segmentation, and recovery capability determine whether an incident becomes a contained event or a business-wide disruption.
The article frames identity and access management as a practical resilience layer, not a compliance afterthought. MFA, least privilege, account audits, and segmentation are presented as controls that reduce unauthorized access and constrain the impact of phishing-led credential compromise. That is a familiar pattern in financial services, where the starting position is often complex rather than mature.
Key questions
Q: Where do financial-sector cyber defenses fail when attackers steal valid credentials?
A: They fail when identity is treated as authentication only. If a stolen account still has broad role assignments, weak monitoring, or third-party reach, the attacker can move from login to privileged action without triggering strong containment. The failure is governance of access scope, not just password strength.
Q: Why do least privilege and supervision matter so much in regulated financial services?
A: Least privilege limits how far a compromised or misused account can move, while supervision makes abnormal activity visible and attributable. In regulated financial services, those two controls are linked because excessive access increases both fraud risk and the chance that a firm cannot defend its actions during review.
Q: What are the signs that a recovery program is not ready for a ransomware event?
A: A recovery program is not ready when teams have not practiced the runbook, roles are unclear, and approval delays slow action during a crisis. Other warning signs include untested backup validation, weak coordination across incident response, legal, communications, and insurance teams, and no rehearsed process for restoring from isolated copies without re infection.
Q: How should banks balance prevention, containment, and recovery in cyber resilience planning?
A: They should treat them as linked controls rather than competing priorities. Prevention reduces exposure, containment limits spread when prevention fails, and recovery restores operations after impact. The right balance is the one that still preserves business continuity when an attacker gets through.
Technical breakdown
Why financial-sector identity controls fail under credential theft
Financial institutions are especially exposed when phishing or third-party compromise turns legitimate credentials into the attacker’s entry point. Once access is established, standing privileges, weak account hygiene, and overly broad role assignments let a small initial foothold become a systems-wide issue. Identity controls fail when they are treated as authentication only, rather than as continuous authorization governance across users, admins, and external parties. In a sector with many integrated services, the real control question is whether a stolen identity can move beyond its intended scope.
Practical implication: treat identity governance as blast-radius control, not just login protection.
How segmentation changes the ransomware and lateral movement problem
Segmentation matters because many financial breaches become worse after the first compromise, not at the perimeter. If critical services, data stores, and administrative planes share too much network trust, adversaries can pivot laterally after initial access and reach high-value systems quickly. Network segmentation, default-account removal, and service hardening reduce the number of paths available to an attacker and make containment more realistic. In operational terms, segmentation is not a substitute for identity controls, but it is the control that prevents one compromised account from becoming enterprise-wide access.
Practical implication: map critical services to explicit trust zones and verify that administrative access cannot traverse them freely.
What recovery discipline means in a sector that assumes breach
Recovery discipline is the difference between a security incident and prolonged business interruption. The article’s emphasis on incident response plans, recovery exercises, forensics contacts, and communication workflows reflects a sector where prevention is never perfect. When ransomware or destructive intrusion succeeds, the speed and clarity of recovery become the main resilience test. That includes having role clarity, tested restoration paths, and decision points for law enforcement, legal, and business leadership. For financial organisations, recovery readiness is part of operational continuity, not an after-the-fact insurance issue.
Practical implication: test restoration, escalation, and communication paths as often as you test detection.
Threat narrative
Attacker objective: The objective is to disrupt financial operations, encrypt or steal sensitive data, and extract leverage through extortion or prolonged downtime.
- Entry typically begins with phishing, credential theft, or another path that gives the attacker legitimate-looking access to a financial environment.
- Escalation follows when the compromised identity can reach privileged systems, shared services, or weakly segmented administrative paths.
- Impact occurs through ransomware, data encryption, service disruption, or broader business interruption that affects confidentiality, integrity, and availability.
Breaches seen in the wild
- Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.
Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity governance is now a resilience control in financial services. The article shows that authentication alone is insufficient when phishing, third-party access, and role overreach can all turn into business disruption. Financial institutions need authorization discipline that limits what a compromised identity can do, not just stronger password barriers. Practitioners should treat identity scope as a resilience boundary.
Blast-radius control is the decisive variable when ransomware meets banking operations. Segmentation, least privilege, and account hygiene matter because they determine whether one foothold reaches critical services. The financial sector’s interconnected systems make over-permissioned access especially dangerous. Practitioners should design controls around containment, not just prevention.
Recovery maturity exposes whether cyber resilience is real or merely documented. The article’s emphasis on incident response plans, restoration exercises, and coordination with legal and forensic teams reflects a basic truth: many controls are only proven after failure. In regulated sectors, recovery is a governance capability tied to operational continuity. Practitioners should measure whether restoration is actually repeatable under pressure.
Financial institutions should expect the attack path to cross identity, network, and recovery domains. That makes siloed control ownership a liability, because the attacker only needs one weak link to move from credential compromise to service interruption. The relevant frameworks here are NIST CSF, NIST 800-53, CIS Controls, and MITRE ATT&CK. Practitioners should align access, segmentation, and recovery programs around a single resilience outcome.
The article reinforces a governance gap common in mature enterprises: assuming prevention is the main control. In financial environments, the real question is how much damage a failed control can still permit. That shifts the governance conversation toward containment, tested recovery, and privileged access reduction. Practitioners should prioritise controls that fail safely.
What this signals
Financial resilience depends on limiting what a compromised identity can reach. In banking and insurance, the access layer is often the shortest path from phishing to operational disruption, so privilege scope has to be governed as a resilience issue, not an admin task.
Segmentation and recovery planning should be designed together. A well-segmented network slows lateral movement, but it only becomes operationally useful if restoration paths, decision rights, and communications are also tested under realistic conditions.
For practitioners
- Implement least privilege for all financial-sector access paths Constrain user, admin, and third-party access so compromise does not automatically expose critical systems or sensitive data.
- Segment critical systems from general user and vendor access Separate payment, transaction, identity, and recovery environments so lateral movement cannot move freely across trust zones.
- Remove default and unnecessary accounts before production use Audit inherited access, disable unused defaults, and ensure privileged accounts are explicitly justified and monitored.
- Test incident response and recovery workflows regularly Run restore exercises, communications drills, and escalation reviews so recovery speed is validated before a real ransomware event.
Key takeaways
- Financial-sector breaches are not just an exposure problem, they are a resilience problem when access scope and recovery paths are weak.
- The article ties breach volume, ransomware growth, and business disruption to a single operational reality, that containment now matters as much as prevention.
- Financial institutions should prioritise identity governance, segmentation, and rehearsed recovery because those controls limit both spread and downtime.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article centers on limiting access scope and privilege in financial environments. |
| PR.IR-01 — Incident Response Plan | The article stresses tested response and recovery as core resilience controls. | |
| Recommendation — Apply PR.AA-05 to constrain entitlements so a compromised account cannot traverse critical banking systems. Maintain and rehearse incident response plans that cover containment, escalation, and restoration in regulated operations. | ||
| NIST SP 800-53 Rev 5 | AC-6 — Least Privilege | Least privilege is explicitly recommended to reduce the rolling impact of account compromise. |
| Recommendation — Use AC-6 to restrict each user and administrator to the minimum access needed for their role. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article calls for auditing and disabling default and unnecessary accounts. |
| Recommendation — Use CIS-5 to review account inventory, disable unused access, and monitor privileged accounts continuously. | ||
| MITRE ATT&CK | TA0006;TA0008 — Credential Access; Lateral Movement | Credential theft and lateral movement are the main attack patterns discussed in the article. |
| Recommendation — Map phishing-led credential theft and post-compromise pivoting to TA0006 and TA0008 in threat hunting. | ||
Key terms
- Blast Radius: The potential scope of damage if a specific credential or identity is compromised. Identities with broad permissions have a larger blast radius and represent a higher priority for least-privilege enforcement and security controls.
- Operational Resilience: Operational resilience is the ability to keep critical services running or recover them quickly after disruption. In identity-led environments, that depends on authentication services, privilege management, and recovery procedures that can be tested under realistic failure conditions.
- Least Privilege: A security principle requiring that every identity, human or non-human, is granted only the minimum permissions necessary to perform its function. Least privilege is the single most effective control for reducing NHI blast radius.
- Network Segmentation: Network segmentation divides traffic and resources into controlled zones so access can be restricted between groups, systems, or applications. In remote access design, segmentation limits what a connected user or workload can reach after authentication, which reduces lateral movement and shrinks blast radius.
Deepen your knowledge
NHI Foundation Level course covers NHI governance, workload identity, and secrets management as part of a broader identity security curriculum. It is designed for practitioners who need to connect identity controls to operational resilience and access governance.
Published by the NHIMG editorial team on July 12, 2026.
Updated on October 13, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org