For most of the last two decades, a serious cyber incident in financial services was a data event: records exposed, regulators notified, damage measured in disclosure and reputation.

That framing no longer holds — because the thing being attacked has changed.

BFSI hasn't simply digitised existing processes. It has re-platformed how financial services are built and run. Payments execute in real time. Identity moves across ecosystems. Models make consequential decisions. Infrastructure changes continuously. Critical services depend on platforms, APIs and providers no single institution fully controls.

When the architecture changes, the consequences of attacking it change too.

Here's the lens I've come to trust after years of forensic work: a breach is almost never a single failure. It's a chain — a gap in how something was designed, in how a control was enforced, in what the system could see, and in how fast anyone could respond. This is the pattern digital forensics and incident response teams see repeatedly. BFSI operates across six layers. Each has undergone a structural shift that opens one of those gaps. The breach happens when they line up. Each has undergone a structural shift that opens one of those gaps. The breach happens when they line up.

1. Customer & Identity. Trust is no longer established once at a perimeter — it's continuously negotiated across systems, sessions and models. In several of our investigations the password was never the problem: an attacker-in-the-middle framework stole the session token after authentication, and from there the token, not the password, was the credential. Every control worked as designed. The design just assumed you stayed who you said you were. Reconstructing exactly how an attacker moved through a compromised session is the kind of digital forensic analysis that turns an alert into an answer.

2. Transaction & Financial Logic. Instant execution removed the thing security teams quietly relied on — time to detect and intervene. Look at any single control and it passes: the OTP validates, the transaction authorises. Run those same legitimate steps concurrently against a race condition, and you get a fraud where every step is technically valid. Nothing "broke." The sequence was the attack — visible only once the money had moved.

3. Data & Intelligence. The question expands from "Can someone access the data?" to "Can we trust the data, and the decision it produced?" An attacker often doesn't need to breach the database or crack the model at all. Manipulating the inputs feeding a model can be enough to bend the outcome — without ever tripping a conventional alarm. Detecting manipulation this quiet is why threat detection and a forensics-led compromise assessment matter.  

4. Platform & Infrastructure. The estate no longer has a stable edge. A cloud provider's attestation covers the provider's side — not tenant-side IAM drift, over-broad OAuth permissions, or inter-service trust that's quietly grown too permissive. And because control planes span the whole estate, one misconfiguration carries a blast radius no server-level weakness ever did.

5. Ecosystem & Dependency. Third-party risk has become systemic risk. Vendor due diligence is a point-in-time snapshot of a direct supplier — while the real exposure runs through transitive dependencies and an API perimeter that changes far more often than the vendor list. A single supplier compromise can now hit dozens of institutions at once. Validating whether those exposures are actually exploitable is where breach and attack simulation and continuous security control validation earn their place.

6. Control & Assurance. The same environments that cleanly pass an attestation cycle are, in a meaningful number of cases, the ones that later need a forensic investigation. Attestation proves a control existed at a point in time. It doesn't prove the control held under an actual attacker. Closing that gap is the premise of forensic resilience assurance - testing whether controls hold up in practice, not just on paper.

The pattern across all six

None of these shifts is a mistake. Instant payments, open ecosystems, cloud, model-driven decisions — all features, and good ones. The problem is only that the architecture moved faster than the security assumptions around it. And the gaps that result are financial, operational and systemic at once — which is why they can't be governed as a technology problem alone.

For years we measured security by how much we had: controls, audits passed, coverage on paper. Attackers now measure us by something else — how long it takes us to notice, and how fast we can recover. That second scorecard —  mean time to respond — is now the one that matters, and it's why a DFIR retainer that guarantees response before an incident hits has moved from nice-to-have to baseline. The gap between those two scorecards is where the last few years of breaches have lived.

This article is the short version. The full picture — how each of these six shifts becomes an actual breach, reconstructed as a failure chain from the control gap down to the forensic root cause, plus an 18-month roadmap to close them — is in the SISA Digital Threat Report 2025-26, built with CERT-In and CSIRT-Fin.

Read it here → Digital Threat Report 2025-26