Financial Firms Are Failing Basic Cybersecurity, Bank of England Finds

The Bank of England’s CBEST thematic report, based on 13 assessments and penetration tests of financial firms and FMIs, identifies widespread basic cybersecurity shortcomings—insufficient patching and hardening, weak identity and access controls, limited detection and response capabilities, inadequate encryption and network segmentation, and cultural/awareness gaps—and recommends risk-based remediation, stronger technical controls (e.g., MFA, secure credential handling, patching), improved monitoring, and maturity improvements for threat intelligence programs.