Bank of England: Financial sector failing to implement basic cybersecurity controls

The UK’s 2025 CBEST review of financial institutions highlights recurring weaknesses—misconfigured and inconsistently patched systems, weak access controls, inadequate detection/monitoring, and staff prone to social engineering (phishing, helpdesk impersonation); NCSC notes these tactics align with groups like Scattered Spider. While CTI foundations exist and MFA adoption has improved, integration across the business and security culture remain gaps, and regulators urge firms and FMIs to strengthen resilience against sophisticated/state-backed, third-party/supply-chain, and insider threats.