When Prevention Isn't Enough
The cybersecurity challenge facing many financial services organisations isn't one that can be solved with better firewalls or stricter password policies. The structural vulnerabilities - federated access, third-party dependencies, legacy systems, fragmented infrastructure - are embedded in how these businesses operate.
You can't eliminate these vulnerabilities without fundamentally changing the business model, which simply isn’t going to happen.
The question therefore becomes: if you can't prevent every breach, how do you build resilience into an ecosystem that was never designed for today's threat landscape?
The answer isn't a single tool or framework. It's a shift in approach - from trying to build impenetrable walls around assets you don't fully control, to understanding your ecosystem's real risk posture, detecting threats where they emerge, and responding before they cascade.
This requires three foundational capabilities that most organisations in this space are only just beginning to develop. Visibility into third-party risk that goes beyond questionnaires and excel spreadsheets, security maturity across cloud and SaaS environments that truly reflects how you operate, and intelligence about threats targeting your ecosystem before they result in an incident.
Third-Party Risk: Beyond the Questionnaire
Many financial institutions already know that they're heavily dependent on third parties. What many don't know is which of those third parties pose the greatest risk - and whether the controls those suppliers claim to have are actually in place.
The traditional approach is to send out questionnaires, collect responses, and file them away until next year's review cycle. The problem is that questionnaires tell you what a vendor's security program is supposed to look like, not what it really looks like. And in the time between assessments, everything can change.
Consider a managing general agent handling sensitive client data on your behalf. Their questionnaire showed robust controls. But six months later, a subsidiary they acquired in a merger - one you didn't even know about - suffers a ransomware attack. The threat actor pivots through shared infrastructure and suddenly has access to underwriting data across your entire book of business.
The breach didn't happen because the assessment was wrong. It happened because the assessment couldn't capture the dynamic reality of how modern businesses operate, merge, and evolve - or validate whether the controls on paper actually existed in practice.
Creating a Single Source of Truth
Effective third-party risk management in federated environments starts with knowing what you're dealing with. Not just a spreadsheet of vendor names, but a genuine understanding of your supplier landscape, including who has access to what, which relationships are truly critical, and where concentrations of risk exist.
This means building a single source of truth for your third-party ecosystem - one that classifies suppliers by their criticality rather than contract value or historical importance. A small actuarial consultancy with access to your exposure models may pose more risk than a large facilities management provider. A law firm that represents both you and five of your competitors may not seem critical on paper, but if they're compromised, the attacker gains lateral access across an entire segment of the market.
The risk isn't linear - it's exponential based on the connections and the sensitivity of the data and systems that are shared. Understanding your ecosystem properly means probing the areas that reveal how much risk a third party introduces into your business, understanding the business impacts of those risks, and assigning and risk ownership appropriately across the business. If you’re struggling to assess the criticality of your suppliers, get the step-by-step guide here.
Going Beyond Checkboxes to Real Behaviours
Once you know which suppliers matter most, the question becomes: how do you assess their security posture in a way that reflects reality?
Traditional questionnaires ask about policies and frameworks. But having an information security policy doesn't mean it's being followed. Being ISO 27001 certified doesn't tell you whether their cloud storage is misconfigured or their credentials are circulating on criminal forums.
The organisations developing mature third-party risk capabilities are conducting structured due diligence that goes deeper - looking at actual controls, real behaviours, and tangible evidence rather than self-reported compliance. This means reviewing access controls as they're implemented, understanding how data flows in practice, and examining incident response capabilities beyond what's written in a playbook.
For high-risk suppliers where the stakes are highest, this can extend to validation using external intelligence - checking whether their credentials have appeared in data breaches, whether their domains show up in threat actor reconnaissance, and whether their security claims align with what's observable from outside their perimeter.
Staying Current Without Constant Reassessment
One of the main challenges with third-party risk is that it doesn't stay static. Suppliers get acquired, systems get reconfigured, security teams change, and controls that existed last year may not exist today.
But you can't continuously reassess every supplier – it’s simply not feasible. The solution is risk-based monitoring: reassessing high-risk suppliers frequently enough to catch material changes, while extending the cycle for lower-risk relationships. When something significant happens - a merger, a reported breach, a substantial change in what data they access - that triggers a re-evaluation regardless of schedule.
It also requires translating technical findings into business language that stakeholders can act on. Security teams might care about unpatched vulnerabilities and weak encryption protocols. But business risk owners need to understand whether a compromised supplier is likely to impact operations, clients, and regulatory standing.
The organisations getting this right aren't trying to achieve perfect visibility across every supplier. They're focusing their resources where the risk is genuinely concentrated, validating what matters most, and maintaining enough currency to detect when risk levels change materially.
Click here to explore how Talanos helps organisations to manage third-party risk.
Cloud and SaaS Security: Where Your Data Lives
Most financial services organisations have undergone some form of cloud transformation over the past five years. The problem is that "cloud transformation" often means different things in different parts of the business.
It’s perfectly possible to have one division migrating to a modern SaaS platform with robust security controls, another running critical workloads in a hastily configured cloud environment that was stood up during the pandemic, and a third using shadow IT - cloud applications that the business adopted because they solved an operational problem, completely outside the security team's visibility.
Meanwhile, your partners, brokers, and service providers are on their own cloud journeys, each with varying levels of security maturity. Data flows between these environments constantly - underwriting information, claims data, actuarial models, financial records - often through APIs and integrations that were set up quickly and never fully reviewed.
Understanding What "Secure Enough" Means
The question isn't whether the cloud is secure - it's whether your specific cloud implementation is configured securely, whether you have visibility into how data moves through cloud and SaaS environments, and whether your controls align with the risks you face.
This requires understanding your cloud security maturity not as a binary yes/no, but as a spectrum. Where are your misconfigurations? Which environments have overly permissive access controls? Where is sensitive data being stored or processed in ways that create regulatory exposure?
Achieving cloud security maturity means having visibility into these configurations across your entire environment, understanding where gaps exist, and prioritising remediation based on data sensitivity and business impact rather than compliance checkboxes.
It also means extending that visibility to your critical SaaS applications - not just the ones IT approved, but the ones the business is actually using. Because if your underwriters are collaborating on sensitive client information through an unapproved file-sharing service, that's not just a policy violation - it's a material security gap.
Learn more about how to assess the security of your cloud and SaaS environment here.
Threat Intelligence: Knowing What's Coming Before It Arrives
Traditional cybersecurity operates reactively. An alert fires, an investigation begins, containment happens if you're able to act quickly and decisively. Much of the time however, by the time you detect the breach, the attacker has been in your environment for weeks or months.
In interconnected ecosystems where a single compromise can cascade across multiple organisations, reactive detection isn't fast enough. You need to understand what threats are emerging, who's being targeted, and where your organisation or your partners appear in threat actor planning - before the attack reaches your perimeter.
This is where intelligence from the deep and dark web becomes operationally relevant. Not the generic threat feeds that every security vendor includes in their platform, but specific, actionable intelligence about your ecosystem.
From Generic Alerts to Ecosystem-Specific Intelligence
Your organisation's compromised credentials don't just appear in your security logs. They often surface first in dark web marketplaces, criminal forums, or Telegram channels where threat actors trade access to financial services organisations.
Similarly, when a threat actor is planning a campaign targeting reinsurers, for example, they often discuss it openly in closed forums - sharing techniques, comparing notes on which organisations have weak controls, trading information about valuable targets. By the time the attack launches, there may have been weeks of observable planning.
That's the difference between intelligence and information. Information tells you a breach happened. Intelligence tells you one is being planned, giving you time to harden defences, revoke exposed credentials, and alert partners who might also be at risk.
For organisations operating in highly connected ecosystems, this also means understanding when your partners appear in threat intelligence. If a broker you work with daily shows up in dark web discussions or their domains appear in phishing infrastructure, that's a signal worth acting on - even if they haven't reported a breach. Read the blog to learn more about why it’s so hard to get relevant threat intelligence.
Building an Intelligence-Led Security Posture
The organisations developing mature threat intelligence capabilities aren't just collecting feeds. They're actively monitoring for specific indicators relevant to their ecosystem and early warning signs of supply chain compromises.
They're also contextualising that intelligence against their actual risk landscape. A credential leak matters more if it belongs to someone with access to sensitive client data. A phishing campaign targeting law firms matters more if you rely heavily on external counsel. The value of intelligence is in how you apply it, not just in having it.
Resilience Is a Capability, Not a State
The cybersecurity challenge in reinsurance and similar sectors isn't going away. The ecosystem is the vulnerability, and the nature of the ecosystem isn't changing.
But resilience doesn't require eliminating every risk. It requires understanding where risks exist - in your third-party relationships, across your cloud environments, and in the threat landscape targeting your sector. It requires moving from static, point-in-time assessments to adaptable visibility. And it requires intelligence that gives you time to respond before attacks succeed.
The organisations building this resilience aren't waiting for perfect solutions. They're acknowledging the reality of how they operate - federated, distributed, interconnected - and building capabilities that work within that reality.
None of this eliminates risk. But it shifts the balance from hoping attacks don't happen to being ready when they do - and increasingly, detecting them before they cascade through the ecosystem you're part of.
That's not perfect security. But in an interconnected world, it’s the most realistic form of resilience available.
