According to the IBM Cost of a Data Breach Report 2023, the global average cost of a data breach in 2023 was $4.45 million, 15% more than in 2020. In response, 51% of organizations plan to increase cybersecurity spending this year.

For the financial industry, however, global statistics don’t tell the whole story. Finance firms lose approximately $5.9 million per data breach, 28% higher than the global average. In addition, evolving regulatory concerns play a role in how financial companies respond to cyberattacks and where they’re investing to reduce total risk.

By the numbers: The true cost of a data breach for financial companies

When it comes to calculating the true cost of a data breach for financial firms, monetary loss is just the beginning.

Consider common threat vectors. While 48% of financial attacks start with malicious actors, human error accounts for 33%. Phishing and compromised credentials take the top spots for initial attack vectors at 16% and 15%, respectively. If attackers are successful, they often have access to millions of transaction and client records — the average cost for breaches of 50 million records or more now tops $300 million.

It’s not all bad news, however. In terms of detecting and containing data breaches, finance organizations are ahead of the curve. Globally, companies take 204 days to identify and 73 days to contain a breach. In the financial industry, breaches are identified in 177 days and contained in 56 days on average.

Where are financial firms investing in cybersecurity?

More than half of organizations will increase their cybersecurity investments this year.

For financial firms, top areas of investment include security AI, automation and incident response (IR). In 2023, 39% of financial organizations reported “extensive use” of security AI and automation, which led to $850,000 in savings compared to the global average cost of a breach. When it comes to IR teams and testing, meanwhile, firms with robust incident response frameworks saved an average of $2 million.

Read the full report

How can the financial industry defend critical data?

The financial industry faces unique challenges when it comes to effective data protection. One of the most prevalent is the need to identify and incorporate global regulations into everyday banking practices. This could include client data privacy obligations under legislation such as CCPA in California and GDPR in Europe, along with fraud reduction efforts governed by FINRA and FinTECH. In addition, new regulations, such as the EU’s Digital Finance Strategy, are emerging to govern growing cryptocurrency markets.

It’s also worth noting that financial firms face steep fines for failing to meet regulatory requirements. Consider that in 2022, the U.S. Securities and Exchange Commission (SEC) fined more than a dozen banks almost $2 billion for cybersecurity shortcomings.

To help combat emerging threats and ensure compliance with evolving legislation, finance firms can benefit from a multi-pronged approach that includes the following elements.

DevSecOps integration

A DevSecOps approach to security makes it possible for firms to integrate protection at application, tool and platform levels for increased control. Here, success depends on both comprehensive integration and regular testing.

Robust data discovery

82% of data breaches include data in cloud environments. By implementing robust data discovery tools, financial organizations can identify where they’re at risk — and what they can do about it.

Security AI and automation deployment

AI and automation can reduce IT staff workloads and streamline data-intensive processes. Deploying AI tools can also lower total security costs and deliver faster data breach identification.

Attacker perspective adoption

Knowledge is power — and knowing what attackers will do before they do it offers a decisive advantage for financial organizations. By using attack surface management tools and adversary simulation techniques, companies can better understand the attack perspective to pinpoint likely avenues of compromise.

When it comes to financial industry cybersecurity, it’s not just about the up-front costs of a data breach. Instead, it’s about creating reliable and repeatable processes capable of addressing current threats, incorporating new regulatory expectations and laying the groundwork for ongoing defense.

Get the full IBM Cost of a Data Breach Report 2023 here.

More from Banking & Finance

DORA and your quantum-safe cryptography migration

5 min read - Quantum computing is a new paradigm with the potential to tackle problems that classical computers cannot solve today. Unfortunately, this also introduces threats to the digital economy and particularly the financial sector.The Digital Operational Resilience Act (DORA) is a regulatory framework that introduces uniform requirements across the European Union (EU) to achieve a "high level of operational resilience" in the financial services sector. Entities covered by DORA — such as credit institutions, payment institutions, insurance undertakings, information and communication technology…

Web injections are back on the rise: 40+ banks affected by new malware campaign

8 min read - Web injections, a favored technique employed by various banking trojans, have been a persistent threat in the realm of cyberattacks. These malicious injections enable cyber criminals to manipulate data exchanges between users and web browsers, potentially compromising sensitive information. In March 2023, security researchers at IBM Security Trusteer uncovered a new malware campaign using JavaScript web injections. This new campaign is widespread and particularly evasive, with historical indicators of compromise (IOCs) suggesting a possible connection to DanaBot — although we…

Virtual credit card fraud: An old scam reinvented

3 min read - In today's rapidly evolving financial landscape, as banks continue to broaden their range of services and embrace innovative technologies, they find themselves at the forefront of a dual-edged sword. While these advancements promise greater convenience and accessibility for customers, they also inadvertently expose the financial industry to an ever-shifting spectrum of emerging fraud trends. This delicate balance between new offerings and security controls is a key part of the modern banking challenges. In this blog, we explore such an example.…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today