Cybersecurity accreditation organization CREST has outlined a framework for strengthening financial sector cyber resilience, emphasizing coordination between financial institutions, regulators and cybersecurity service providers.
According to CREST’s Cyber Resilience in Financial Services: A Whole Ecosystem Approach, vulnerabilities can emerge from gaps between these groups, including differences in organizational responsibilities, oversight and international regulatory requirements.ㅤ
The framework identifies three interconnected areas of responsibility:
- Financial institutions must protect critical business services and maintain recovery capabilities;
- Regulators must establish supervisory expectations and assess sector-wide risks;
- Cybersecurity providers must deliver qualified security testing, threat intelligence and incident response services.
CREST also emphasizes threat-led penetration testing that combines current threat intelligence, realistic attack scenarios and remediation to identify weaknesses affecting important financial services.
Steven Swift, Managing Director, Suzu Labs:
“Its absolutely valid that connected organizations in our financial system share risks, as they’re all part of the larger whole. This is essentially just 3rd party risk management, tailored for our interconnected financial systems.
“The risk tiering makes sense, small local institutions will have a smaller worst case scenario than larger global institutions.
“However, choosing which subset of the NIST CSF and CRI Profile to apply to organizations based on their Tier makes zero sense. These are both foundational, it sets relatively basic, very high level requirements, and is largely focused on security governance, rather than specifics about which technical controls are appropriate to require.
“What’s missing, is that organizations should include tailoring a baseline based on the NIST 800-53 controls. This framework functions as a controls catalog, and it contains enough content that we could tailor additional requirements for larger, more mature, more impactful institutions, and pulling back a portion of those controls for smaller institutions.
“As always, compliance is not security. Organizations can meaningfully meet all of the requirements set forth at the Tier 1 level, and still have plenty of basic security gaps that remain wide open.
“Effective posture is the intersection of security governance, and technical security controls. Frameworks aiming to improve industry wide security posture need to address both directly if we hope to make meaningful improvements in security posture for the industry.”
ㅤ
Ryan McCurdy, Vice President of Marketing, Liquibase:
“CREST is right to call for a broader approach to cyber resilience. Financial institutions operate across an increasingly interconnected ecosystem but there’s another risk that deserves more attention: the changes organizations make to their own critical systems.
“Not every disruption starts with an attacker. A poorly governed database change can interrupt financial services just as effectively. And as AI accelerates software development, the volume of changes moving toward production will only increase.
“Financial institutions need to know what’s changing, who or what initiated it, and whether the right controls were enforced before deployment. That requires consistent policies, clear accountability, and evidence that can stand up to scrutiny.
“You can’t build resilience across an ecosystem if you don’t have control over the changes happening inside it.”
ㅤ
Seemant Sehgal, Founder & CEO, BreachLock:
“Having run global red teaming inside a bank for years, I know first-hand that the real exposure in financial services sits in the gaps between institutions, regulators, and providers. CREST is naming that reality in the framework, and shared responsibility across all three is a step in the right direction toward building real resilience.
“The threat-led penetration testing component of the framework is a practical approach to testing against current threat intelligence and realistic attack scenarios. It separates a compliance exercise from one that focuses more on proving resilience. A lot of institutions already run this discipline, and with this framework in place, the rest finally have something they can point at when they build the case internally.”
I hope that financial institutions read this and take action. Otherwise I and everyone else should reconsider their life choices.
Open-weight AI is changing the rules of product security
Posted in Commentary with tags AI on October 29, 2026 by itnerdNew research on Z.AI’s open-weight GLM-5.3 model is raising fresh questions about how quickly advanced cyber capabilities are spreading.
Open-weight models are making sophisticated attack capabilities more accessible, why provider safeguards become harder to enforce once models can be downloaded and modified. AI is already changing the way attackers find and exploit software vulnerabilities.
If you want a view of this, here’s one: https://www.businessworld.in/article/chinese-ai-model-executes-complex-cyberattacks-in-tests-631067
Willy Leichter, CMO, PointGuard AI
“This is a predictable next step: powerful attack capabilities becoming more accessible and easier to adapt. Open-weight models give operators more control, making provider safeguards harder to rely on. The biggest change is how quickly attackers can turn emerging capabilities into usable tools.
“AI reduces the expertise, time, and resources needed for sophisticated attacks. It doesn’t make every novice an expert, but it puts specialized capabilities within reach. The genie’s not going back in the bottle. Defenders must assume these tools are already available.
“Defenses must cover AI-enabled attacks and the broader AI attack surface: models, agents, endpoints, tool connections, identities, and data. Teams need continuous visibility, enforceable access controls, and rapid containment, powered by equally capable AI to keep pace with attackers.
“The cycle is familiar: new attack tools emerge and defenses evolve. What has changed dramatically is the timeline. Attackers can develop and execute attacks faster, leaving less time to respond. Intelligent defenses must match that speed and act before damage spreads.”
Matt Wyckhouse, CEO, Finite State
“Manufacturers can no longer rely on an AI provider’s safeguards to keep capable adversarial agents away from their firmware. They need to assume attackers have access to these capabilities and use the same advances to find and fix weaknesses first.
“These models could make it easier to exploit device software and third-party components, and firmware analysis is already showing what that looks like. Following the French refrigeration attacks, Finite State analyzed refrigeration-controller firmware using a blinded, binary-only agent workflow. Our agents independently rediscovered the disclosed vulnerabilities within hours. (See published findings here)
“Across our broader firmware work, we are routinely finding zero-day vulnerabilities and exploitable N-day vulnerabilities for pennies to dollars of compute. That is compute expenditure, not the total cost of engineering validation and remediation, but it represents a fundamental change in the economics of finding weaknesses.
“The tools around the models are advancing too. Open-source projects such as REA, Reverse Engineer Anything, connect AI agents to established reverse-engineering tools so they can inspect compiled software without its original source code. REA is not itself an autonomous vulnerability scanner, but it makes sophisticated analysis tools more accessible to agents and their operators.
“For manufacturers, this means attackers can often download firmware and investigate it offline. Shared libraries and supplier components can then carry the same weakness into many products. An attacker does not necessarily need a new vulnerability; an old vulnerability that remains exploitable in deployed firmware may be enough.
“Manufacturers should test their firmware the same way adversarial agents will: analyze the shipping binaries, investigate exposed interfaces and validate potential paths to compromise. They should do that regularly and continuously, rather than treating security testing as a one-time release gate.”
In short, your defences need to account for AI for starters. And they need to account for it evolving. Otherwise, I will be writing about you very soon once you’ve been pwned.
Leave a comment »