Securing the Office, A Banking Perspective

In June 2025, cyber criminals stole about $140 million from six Brazilian banks. They didn’t hack the banks. They compromised one staff member at C&M, a vendor that connects those banks to the country’s central bank system. That single credential took down parts of PIX, Brazil’s instant payment system, a service more than three-quarters of the country relies on.

Less than a year earlier, someone walked off with $30 million in cash from a GardaWorld facility in Los Angeles, over an Easter weekend. GardaWorld isn’t sloppy:  Low-profile buildings, layered access controls, camera coverage, staff-only access. On paper it looked tight.

Neither of these was a case of one broken lock or one missed patch. Both were failures to see risk across people, process, technology and outside vendors all at the same time. NIST has a phrase for the opposite of that failure — operational resilience — meaning the ability to keep functioning under stress and bounce back fast when something goes wrong. Banks talk about resilience constantly. These two incidents show what happens when it’s more talk than practice.

The Perimeter Isn’t Just Physical or Just Digital

The Brazil breach is really a third-party story. The attackers went after the weakest link, a vendor employee, not the banks themselves. That’s become a familiar pattern, and it’s why third-party risk management keeps climbing up the priority list for financial institutions.

GardaWorld is the physical mirror of that. The rooftop camera coverage was weak. Real-time analytics weren’t catching much. And the pattern of the robbery is what makes investigators suspect an inside job — four alarms, four police responses, four all-clears, and in every single one, officers never actually checked the cash. Whoever did this knew the building’s layout, knew police procedure, and apparently knew there was a plan in motion to move the cash elsewhere to cut down “concentration risk.”

Same lesson from both. Good tech and good physical controls don’t mean much if you can’t see what the people involved — employees, vendors, contractors — are actually doing.

Naming the Threats

You can’t secure anything until you’ve named what you’re securing it against. A decent starting list of threat types looks something like this: Disgruntled employees, reckless employees, untrained employees, internal spies, government spies, corrupt officials, legal adversaries, activists, competitors, vandals, cyber attackers, data miners, organized crime, radicalized individuals, thieves, vendors, terrorists. It’s a long list on purpose. The point is that “hacker” is one threat among dozens, not the whole category.

Assets aren’t just what’s on the balance sheet, either. Customer data technically belongs to the customer, not the bank, but the bank still must protect it like its own.

And vulnerabilities show up in places you might not expect. A badly designed bonus structure can push staff toward risky behavior just as easily as a gap in the network. Threat, asset and vulnerability all have to be looked at together. Looking at any one alone gets you a partial picture.

What Causes the Risk

Outsourcing

Banks lean on outside vendors constantly, so outsourcing policy matters more than most people give it credit for. Outsourced work needs to follow the law, it can’t be so critical that the bank can’t function without it, and it must run at the same risk-adjusted efficiency the bank would get doing it in-house.

Most of that gets enforced through contracts. A solid third-party agreement covers the scope of the work, how performance gets measured, who’s responsible for handling information, audit rights, confidentiality, liability limits, how disputes get resolved, subcontracting rules, insurance, ongoing monitoring and how the relationship ends if it must.

Culture and Governance

Weak governance has quietly killed more banks than any single hack ever has. The Basel Committee’s 13 principles for corporate governance are still a useful reference point for thinking through architecture, data management and performance across the whole bank, not just one department. Operational resilience is really just a piece of broader enterprise resilience. It’s not its own separate IT project.

Technology Choices

A resilient system requires IT teams to understand how the pieces connect, because a weak spot in one system rarely stays contained to that system. Back to GardaWorld for a second. RFID tags on cash packets, better tracking of staff movement and cooperation with local police on vehicle monitoring around the facility could have caught some of what slipped through.

Staff

People move through three phases that matter for security. Hiring and onboarding. Performance review and retention. Termination. Each one carries its own risks. And the Brazil breach is a reminder that behavioral analytics can’t just watch customers. It must watch staff too, since insider access is one of the hardest risks to catch with technology alone.

Policy

Policy is where all of this becomes enforceable rather than aspirational. At the top level, bank IT policy needs to cover architecture, technology, data management, outsourcing, international standards, business continuity, staff internet and social media use, email conduct and remote work. Down at the component level, it needs to reach ATM management, call centers, handheld devices, internet and mobile banking and password, network, and data center security.

Data governance deserves its own mention. The core principles — lawfulness, fairness, transparency, accuracy, purpose limitation, data minimization, storage limitation — work as a template even outside jurisdictions where they’re legally required. In the U.S., the foundation goes back to the Computer Security Act of 1987 and the Privacy Act of 1974, with newer sector-specific laws like Gramm-Leach-Bliley layered on top for financial institutions.

Business continuity planning comes down to two things: Business impact analysis and then knowing which systems, roles and processes are actually mission critical. It only works as a joint effort between the functional and technical sides of the bank, usually pulling in vendors too, and the list of critical assets needs a fresh look every year, not a one-time exercise.

Remote work is a good example of policy that had to catch up to reality. Bank of America has published guidance for employees working remotely, and it reflects a shift in thinking. It highlights the importance of securing people and data wherever they happen to be working, rather than assuming everything important stays inside four walls. Mobile and digital forensics round this out, pulling in data from connected devices or even drones when needed, with chain-of-custody procedures keeping the evidence usable.

Knowing What You Don’t Know

There’s a simple matrix worth keeping in mind here:

Known-knowns are risks the bank understands and can mitigate. Known-unknowns are weaknesses the bank knows exist but doesn’t fully understand yet, with cause, impact and consequences all still fuzzy. Unknown-knowns are the ones nobody did their homework on, sometimes waved off as not worth worrying about. And unknown-unknowns are the risks nobody’s even aware of. That last category is where the real damage tends to come from.

What Regulators Are Saying

Risk appetite is basically how much loss a bank is willing to absorb from market, credit, liquidity or operational events over a year. It shouldn’t sit in a binder somewhere. It needs to be built into how the technology actually operates.

U.S. regulators have been fairly direct about this. The Federal Reserve Board and the FDIC, along with the OCC, have acknowledged that American banks have run into all kinds of disruptive events, IT failures and natural disasters. Some of these got worse because banks were leaning too hard on third-party providers. That’s the same thread running through both the Brazil hack and the GardaWorld heist. Resilience planning must account for vendors and partners, not just what happens inside the bank’s own walls.

Existing Frameworks Already Cover a Lot of This

Nobody needs to build a security program from a blank page. COSO’s internal control framework, Sarbanes-Oxley Sections 302 and 404, trade finance rules from the International Chamber of Commerce, standards from the International Swaps and Derivatives Association and FATF’s anti-money-laundering guidance all already exist and cover real ground.

On the technology side, ISACA’s COBIT framework gives you a process — and risk — based way to manage IT risk specifically, and it pairs well with SWIFT’s Customer Security Program and the Center for Internet Security’s control framework.

Putting any of this into practice comes down to the three lines of defense. Front-line staff are the first line. Risk managers are the second. And whoever’s providing independent assurance on the whole security program is the third.

From Process to Performance

A bank’s process inventory has turned into a core part of digital transformation, letting institutions coordinate work across business lines, staff and systems, with process flows tied to data flows. AI tools are increasingly able to watch those processes continuously and flag things in real time. Performance measurement should weigh fulfillment, residual risk and cost together instead of scoring them separately. Fulfillment connects directly to customer experience, so resilience and usability need to be part of the design from day one, not something added after the fact.

Where This Is Heading

Almost every framework mentioned here shares a trait. They’re process-based and risk-based. Regulators are leaning further in that direction too. The OCC’s Cybersecurity and Financial System Resilience Report, released in June 2026, pushed hard on the need for better threat intelligence across the industry. A few days later, on June 10, 2026, CISA issued Binding Operational Directive 26-04, a risk-based vulnerability management directive aimed at the risks created by fast-moving AI models. It requires agencies to weigh internet exposure, known exploited vulnerabilities, real-world exploitability and how critical the asset is. Banks don’t need a federal mandate to start doing the same thing. Brazil’s payment breach, the GardaWorld heist, and the latest federal guidance all point at the same idea. Securing the office is something you keep doing, not something you finish. People, process, technology, third parties — all of it — on an ongoing basis. Not a checklist you complete once and put away in a drawer.