Topic starter
11/07/2026 1:57 pm
TL;DR: The Bank of England’s CBEST Thematic Report found weaknesses across infrastructure, identity and access, network security, detection and response, and staff awareness in UK financial institutions, showing that controls often fail when tested against real attack conditions, according to Illumio. Containment, not control volume, is the deciding variable when attackers can move laterally before defenders detect them.
Editorial analysis by NHI Mgmt Group, based on content published by Illumio: “2025 CBEST Thematic Report: What the Data Reveals About Cyber Fragility in Financial Services”.
Key questions
Q: What fails first when a bank has controls on paper but still gets breached internally?
A: The first failure is usually containment, not policy.
Q: Why do weak service account and admin controls increase breach impact?
A: Because privileged accounts often have broad reach and are trusted by systems and operators.
Q: What are the signs that internal containment is failing?
A: Look for flat network paths, development and production systems that can talk too freely, privileged accounts with broad reach, and alerts that only fire after suspicious traffic has already spread.
Practitioner guidance
- Harden segmentation around critical banking services Identify the systems that should never be directly reachable from user, development, or shared service zones, then enforce those boundaries at the communication layer.
- Review privileged administrator and service accounts Inventory accounts with elevated reach, remove unnecessary permissions, and separate service credentials from human workflows wherever possible.
- Reduce credential exposure in operational files Search for passwords and access material stored in spreadsheets, shared drives, and other unsecured locations, then move them into governed storage.
Bottom line: CBEST 2025 shows that banking resilience breaks down when internal trust, privilege, and segmentation are not enforced under attack conditions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/07/2026 2:06 pm
Containment has become the real resilience control in banking. CBEST shows that firms can accumulate strong point controls and still fail when an attacker gets inside. The decisive question is not whether an organisation has controls, but whether those controls stop internal spread when the first layer fails. For banking and FMI environments, that shifts resilience ownership toward segmentation, identity governance, and blast-radius reduction.
A few things that frame the scale:
- 40 percent of financial and software companies have already deployed agentic AI systems, and deployments are expected to double by 2028.
A question worth separating out:
Q: How should banking teams respond when EDR does not catch lateral movement?
A: Treat EDR as one layer of evidence, not the control that stops spread. Banking teams should tighten segmentation, reduce unnecessary trust between systems, and validate whether valid credentials can still reach sensitive assets. The goal is to stop internal movement even when endpoint detection is late.
👉 Read our full editorial: CBEST 2025 shows cyber fragility is still a containment problem