Bank of England Warns Financial Sector Lacks Basic Cybersecurity Controls
- Securityish
- Threats & Incidents
Quick Summary
The UK’s 2025 cybersecurity review reveals that financial organizations are failing to implement essential cybersecurity measures. The CBEST report, co-authored by the Bank of England and other regulators, highlights persistent issues such as poor access controls and misconfigured systems. These vulnerabilities expose organizations to social engineering attacks, particularly phishing, emphasizing the need for improved staff training and security culture.
The Securityish Brief
The Bank of England’s 2025 cybersecurity review, based on 13 CBEST assessments, indicates that financial organizations are not adequately addressing basic cybersecurity controls. Key findings reveal weaknesses in access controls, password management, and system configurations. Misconfigured and inconsistently patched systems were identified as recurring issues, alongside inadequate mechanisms for detecting intrusions and vulnerabilities.
The report emphasizes the importance of being prepared for breaches, rather than relying solely on protective measures. It highlights that social engineering tactics, particularly phishing, can exploit organizations with weak security cultures. This vulnerability is exacerbated by staff potentially sharing sensitive information on social media.
Criminal groups, such as Scattered Spider, are noted for using phishing and spear phishing tactics to exploit established trust within organizations. The National Cyber Security Centre (NCSC) warns that these attacks are common and effective against organizations lacking strict identity verification protocols.
CBEST assessments also tested organizations against threats from sophisticated state-sponsored groups, compromised third parties, and malicious insiders. Many of the vulnerabilities identified in 2025 mirror those from previous years, including weak configurations and ineffective monitoring.
Despite these challenges, the report acknowledges some improvements, such as the better implementation of multi-factor authentication (MFA), which was not highlighted as a primary failure in the latest review. The CBEST assessments aim to guide regulated entities in recognizing common security gaps that could lead to cyberattacks.
- CBEST assessments: A framework for evaluating cybersecurity in financial organizations, co-authored by the Bank of England and other regulators.
- Scattered Spider: A criminal group known for using phishing tactics to exploit organizational trust.
- Multi-factor authentication (MFA): A security measure that requires multiple forms of verification to access accounts, showing improved implementation in recent assessments.
- Social engineering: Tactics used by attackers to manipulate individuals into revealing sensitive information.
- National Cyber Security Centre (NCSC): A UK government agency that provides guidance on cybersecurity threats and defenses.
Key Takeaways
- Review and strengthen access controls within your organization to prevent unauthorized access.
- Implement regular training programs for staff on recognizing and responding to social engineering attacks.
- Ensure systems are consistently patched and configured correctly to mitigate vulnerabilities.
- Establish strict identity verification protocols for helpdesk interactions to prevent fraudulent access.
- Monitor social media and job descriptions for sensitive information that could be exploited by attackers.
Key Terms & Concepts
- CBEST assessments: In this article, CBEST assessments refer to evaluations designed to test the cybersecurity resilience of financial organizations.
- Scattered Spider: In this article, Scattered Spider is identified as a criminal group known for using phishing tactics to exploit trust within organizations.
- Multi-factor authentication (MFA): In this article, MFA is described as a security measure requiring multiple forms of verification to enhance account security.
- Social engineering: In this article, social engineering refers to tactics used by attackers to manipulate individuals into revealing sensitive information.
- National Cyber Security Centre (NCSC): In this article, the NCSC is a UK government agency that provides guidance on cybersecurity threats and defenses.
Read the original article here: https://go.theregister.com/feed/www.theregister.com/2026/01/22/financial_sector_cyber_gap/
Your 5-Minute Securityish Brief
A weekly digest of cybersecurity news, phishing alerts, privacy tips, and emerging threats, simplified so anyone can understand what matters and why.
Securityish
Securityish explains cybersecurity, scams, data breaches, and privacy risks in simple language so you know what’s happening and how to protect yourself.
© 2026 Securityish
