Rise in Cybersecurity Threats
Cyberattacks have escalated significantly in recent years. Growing numbers of financial services companies – especially SMEs – are falling victim. Increasingly sophisticated and frequent cyber infiltrations have resulted in substantial financial losses, operational disruptions and reputational damage for the sector.
All this underscores the imperative for robust security measures, comprehensive monitoring of third-party relationships and adherence to regulatory standards. Organisations must remain vigilant and proactive to safeguard critical data in a rapidly evolving landscape of cyber threats.
That begins – but does not end – with Microsoft 365. Expert technical support is needed to ensure that organisations of all sizes do not fall victim to security vulnerabilities caused by misconfiguration.
Correct M365 configuration is critical. Not just for cybersecurity protection but also to ensure optimum productivity and employee efficiency and engagement. Get it wrong and the costs can be high – even if you don’t get hacked. Get it right and the operational return on investment can be very rewarding indeed.
Proliferation and Financial Impact of Cybersecurity Breaches
All of Europe’s top financial services companies experienced supply chain breaches in the past year, revealed a December 2024 report by SecurityScorecard.
Notably, 98% suffered third-party breaches – and the same percentage experienced fourth-party breaches, underscoring vulnerabilities within interconnected systems.
The average cost of a data breach in the UK rose to £3.58 million between March 2023 and February 2024, a 5% increase on the previous year. The financial services sector faced the highest costs with breaches averaging more than £5.4 million.
Equifax Ltd Fine: In October 2023, the Financial Conduct Authority (FCA) fined Equifax Ltd £11,164,400 for failing to manage and monitor the security of UK consumer data outsourced to its US parent company. This breach exposed millions to the risk of financial crime.
Finastra Hack: In November 2024, Finastra, a leading financial technology firm, disclosed a hack that exposed sensitive data from its extensive client base, including many of the world’s top banks. The breach involved the theft of 400 gigabytes of data, highlighting vulnerabilities even among major service providers.
MOVEit Data Breach: In June 2023, a vulnerability in the MOVEit file transfer software led to cyberattacks affecting thousands of organisations and nearly 100 million individuals globally.
Emerging Threats: AI Deepfakes
The rise of deepfake technology has introduced new challenges. In 2024, several FTSE 100 companies reported attacks where fraudsters used AI-generated deepfake voices to impersonate executives, deceiving employees into transferring funds.
Regulatory Scrutiny
UK regulators are intensifying scrutiny over the use of unmonitored and encrypted messaging apps such as WhatsApp within financial institutions.
It follows significant fines imposed by US regulators on JPMorgan, Bank of America and Goldman Sachs for failing to monitor so-called off-channel communications. In total, penalties have exceeded $2 billion since investigations began in 2021.
In the UK, the FCA has urged banks to report any policy breaches related to these platforms.
Data Protection and Regulatory Pitfalls for Financial Services Companies
When financial services companies fail to protect customer data, they expose themselves to a range of regulatory and legal challenges, including:
Breach of UK GDPR and the Data Protection Act 2018
The UK General Data Protection Regulation (GDPR) requires organisations to implement appropriate technical and organisational measures to secure personal data.
Failure to comply can result in significant fines, reputational damage and legal claims from affected individuals.
Litigation by Data Breach Victims
Affected customers may sue companies for failing to take reasonable care to secure their data, leading to compensation claims.
The Equifax data breach exposed the personal information of 147 million people. In the US, Equifax agreed to a settlement of up to $700 million – including $425 million for affected individuals – after a complaint by the Federal Trade Commission.
Regulatory Action
As you have already read, inadequate cybersecurity measures may result in sanctions from financial regulators such as the Financial Conduct Authority (FCA) and the Prudential Regulation Authority (PRA), which enforce standards for operational resilience.
In recent years, the FCA has imposed heavy fines on financial institutions for cybersecurity breaches, underscoring the vital importance of robust cyber defences.
In October 2018, the FCA fined Tesco Bank £16.4 million for failing to exercise due skill, care and diligence in protecting its personal current account holders against a cyberattack that occurred in November 2016. The attack led to the loss of £2.26 million from customer accounts.
Loss of Trust and Business
Beyond legal penalties, a breach can lead to customer attrition, reduced market share and diminished investor confidence – directly impacting turnover/revenue, profits and share prices.
In the case of Equifax, the immediate aftermath of the breach saw the company’s share price drop by 31% – wiping $5.3 billion off its market capitalisation – though the share price has since recovered.
UK Regulatory Authorities Responsible for Data Protection in Financial Services
Information Commissioner’s Office (ICO). The ICO enforces the UK GDPR and the Data Protection Act 2018. It monitors organisations’ data protection practices, investigates breaches and issues penalties.
Financial Conduct Authority (FCA). The FCA ensures financial services firms maintain operational resilience – including robust cybersecurity measures – under its SYSC (Senior Management Arrangements, Systems and Controls) rules.
It monitors adherence to Principle 11 (relations with regulators) and Principle 6 (treating customers fairly).
Prudential Regulation Authority (PRA). The PRA focuses on the safety and soundness of financial institutions. Cybersecurity is a critical component of operational resilience, which the PRA supervises.
Powers of Regulatory Authorities
The ICO can issue fines of up to £17.5 million or 4% of global annual turnover (whichever is higher) for severe GDPR breaches. It has the authority to conduct audits, issue enforcement notices and order organisations to stop certain data processing activities.
The FCA can impose unlimited fines for breaches of its principles and rules. It can issue bans, suspensions or restrictions on business activities and hold senior executives personally accountable under the Senior Managers and Certification Regime (SM&CR).
The PRA also has the authority to levy significant fines and impose requirements on firms – particularly if their cybersecurity shortcomings jeopardise financial stability. In May 2024 the PRA fined Citigroup Global Markets Limited (CGML) £33,880,000 for failings in its trading systems and controls between 1 April 2018 and 31 May 2022. The FCA has also imposed a financial penalty of £27,766,200 on CGML following an FCA investigation into related matters.
Aside from hefty fines, punishments for non-compliance also include:
Operational restrictions – regulators may restrict a firm’s ability to operate or demand costly corrective actions, such as enhanced monitoring, technology upgrades or independent audits.
Personal accountability – senior executives can face individual penalties, including bans or fines, under SM&CR if they fail to ensure robust cybersecurity measures.
How Good Microsoft 365 Configuration Addresses Cybersecurity Challenges and Drives Business Benefits
Microsoft 365 provides a robust, integrated platform that can address immediate cybersecurity challenges while delivering broader benefits, including compliance, enhanced collaboration and better productivity. Proper configuration is key to unlocking its full potential.
Effective M365 configuration can mitigate cybersecurity threats through built-in tools and policies:
Identity and Access Management
Challenge: Compromised credentials and unauthorised access.
Solution: Azure Active Directory (AAD) provides multi-factor authentication (MFA), conditional access policies and Single Sign-On (SSO) to secure user access.
Benefit: Reduces the risk of account compromise and ensures only authorised personnel access sensitive data.
Data Protection
Challenge: Preventing data breaches and leaks.
Solution: Microsoft Purview Information Protection encrypts sensitive data and restricts sharing based on labels and policies.
Benefit: Protects customer- and business-critical data against unauthorised access and accidental leaks.
Threat Detection and Response
Challenge: Identifying and responding to threats quickly.
Solutions: Microsoft Defender for Office 365 detects phishing, ransomware and malware threats in emails and documents. Microsoft Sentinel provides advanced threat intelligence and incident response capabilities.
Benefit: Reduces the risk of cyberattacks and speeds up response times.
Device and Endpoint Security
Challenge: Securing remote and hybrid work environments.
Solution: Microsoft Defender for Endpoint ensures endpoint protection with real-time threat detection and automated responses.
Benefit: Protects against endpoint vulnerabilities – even on personal or off-network devices.
Achieving Broader Business Benefits With M365
Properly configured M365 solutions not only enhance cybersecurity but also enable businesses to achieve strategic goals.
Regulatory Compliance
Microsoft Purview Compliance Manager provides pre-built assessments for industry standards such as GDPR, FCA regulations and ISO 27001.
Retention policies automate data retention and deletion to comply with regulatory requirements.
Together, these solutions reduce regulatory risks and penalties – and simplify audits with centralised data governance and reporting.
Enhanced Collaboration
Microsoft Teams enables secure, real-time communication and collaboration between departments and with external stakeholders.
OneDrive and SharePoint offer secure file sharing and co-authoring capabilities with access controls.
This fosters seamless collaboration in hybrid work environments, reduces silos and accelerates project delivery.
Improved Productivity
Microsoft 365 Apps for Enterprise deliver tools such as Word, Excel and PowerPoint with cloud capabilities, while Power Automate features tools that automate repetitive tasks to save time.
Businesses benefit from greater employee efficiency and focus. Workflows are streamlined, while the number of manual errors is reduced.
Integrating Cybersecurity and Business Goals
By aligning M365 configuration with business priorities, organisations can achieve dual objectives:
- Secure collaboration – conditional access and secure sharing ensure collaboration tools are safe from breaches.
- Cost Optimisation – unified security, compliance and productivity tools in M365 reduce the need for disparate solutions. This cuts costs.
- Future-Ready IT – scalable M365 solutions grow with the organisation, ensuring long-term value and adaptability.
A well-configured M365 environment provides immediate cybersecurity resilience while laying the foundation for broader business benefits.
By integrating robust security, compliance automation, and collaboration tools, organisations can enhance their operational efficiency, ensure regulatory compliance and drive productivity in a secure and scalable manner.
Cybersecurity Threats to the Financial Sector
The financial services sector faces unique cybersecurity challenges due to its reliance on sensitive data and interconnected systems.
Below is a list of the main cybersecurity threats and the corresponding Microsoft solutions to mitigate them:
Ransomware Attacks
- Risk: Attackers encrypt critical systems or data and demand payment for decryption.
- Impact: Operational shutdowns, data loss, reputational damage and financial costs.
- Solutions: Microsoft Defender for Endpoint offers advanced threat detection, endpoint protection and automated incident response to prevent and mitigate ransomware attacks. Azure Backup provides secure, off-site backups – ensuring data recovery without the need to pay a ransom.
Phishing and Social Engineering
- Risk: Fraudulent emails or messages trick employees into revealing sensitive information or granting system access.
- Impact: Data breaches, unauthorised access and compromised accounts.
- Solutions: Microsoft Defender for Office 365 protects against phishing and malicious email campaigns by identifying and neutralising suspicious emails. Microsoft Entra Identity Protection detects and mitigates identity-based risks, such as credential theft.
Insider Threats
- Risk: Malicious or negligent employees misuse their access to compromise systems or leak sensitive information.
- Impact: Data loss, regulatory violations and financial losses.
Solutions: Microsoft Purview Insider Risk Management uses AI-driven insights to detect and mitigate risks related to insider actions. Microsoft Entra Identity Protection provides role-based access control (RBAC) and multi-factor authentication (MFA) to limit unauthorised access.
Third-Party and Supply Chain Vulnerabilities
- Risk: Compromise of external vendors or partners, leading to breaches in the financial institution’s systems.
- Impact: Data breaches, operational disruptions and regulatory scrutiny.
- Solutions: Azure Security Center provides continuous monitoring of external connections and third-party integrations. Microsoft Sentinel is a cloud-native Security Information and Event Management (SIEM) tool for end-to-end visibility across the supply chain.
Data Breaches
- Risk: Unauthorised access to sensitive financial or customer data due to weak defences.
- Impact: Regulatory penalties, loss of customer trust and reputational damage.
- Solutions: Microsoft Purview Information Protection safeguards sensitive data using labelling, encryption and access restrictions. Azure Confidential Computing ensures data remains encrypted even during processing.
Distributed Denial of Service (DDoS) Attacks
- Risk: Excessive traffic overwhelms systems – causing service disruptions.
- Impact: Operational downtime and financial losses.
- Solution: Azure DDoS Protection mitigates large-scale DDoS attacks automatically, ensuring business continuity.
Zero-Day Vulnerabilities
- Risk: Exploitation of unknown software vulnerabilities before they are patched.
- Impact: Data breaches and unauthorised access.
- Solutions: Microsoft Defender Vulnerability Management identifies and remediates vulnerabilities in real-time. Microsoft Azure Security Center monitors systems for potential zero-day exploits and provides actionable recommendations.
Advanced Persistent Threats (APTs)
- Risk: Prolonged, targeted attacks aimed at stealing sensitive data or disrupting operations.
- Impact: Data exfiltration, intellectual property theft and financial damage.
- Solutions: Microsoft Sentinel uses threat intelligence to detect and respond to APTs. Microsoft Defender Threat Intelligence provides advanced analytics and real-time threat intelligence.
Cloud Misconfigurations
- Risk: Improperly configured cloud services that expose sensitive data or systems.
- Impact: Data leaks and increased vulnerability to attacks.
- Solutions: Azure Policy enforces consistent cloud configurations and compliance. Microsoft Defender for Cloud monitors and secures cloud environments.
The financial services sector must proactively address these threats by implementing robust cybersecurity measures.
Microsoft’s integrated security solutions offer comprehensive protection tailored to each specific risk – ensuring compliance with regulatory requirements and safeguarding sensitive financial data.
M365 Configuration: Financial Services Organisations' Different Requirements
While both large organisations and SMEs in the financial services sector use Microsoft 365, their challenges and needs can differ significantly.
These differences stem from user numbers, operational needs, regulatory requirements and internal IT capabilities.
Large financial services organisations can have thousands of employees – often distributed globally – with complex hierarchical structures and varied departmental needs.
Configuration challenges can include:
- managing multi-tenant environments
- customising role-based access for diverse teams
- implementing advanced integrations with third-party tools (CRMs, data analytics platforms)
- ensuring robust configurations for hybrid work setups involving remote and on-site employees
- large volumes of email traffic, document sharing and collaboration requiring high storage and bandwidth configurations.
Meanwhile SMEs will have typically fewer than 250 employees, often working in closely connected teams. Their M365 configuration challenges can include:
- limited resources to manage advanced features of M365 effectively
- basic misconfiguration issues, such as inadequate email security settings or insufficient backup protocols
- reliance on default configurations that may not meet compliance or security needs
- struggles with scaling features as the organisation grows or adds new employees.
Compliance and Security Requirements
Compliance is an issue for all financial services organisations – whether they are large or SMEs. But the levels of complexity tend to grow with scale.
Large organisations need advanced auditing, monitoring and reporting to satisfy regulators such as the FCA or the PRA.
All financial services companies should have incident response protocols to handle potential breaches swiftly – but those are likely to be more detailed and complex in larger organisations.
They need extensive identity and access management across geographies and devices. There will be strict data sovereignty requirements, with geo-specific configurations for data storage and processing.
SMEs may have overlooked basic configurations for data loss prevention (DLP) and encryption. Understanding and implementing UK GDPR requirements within M365 can also be problematic.
There may be a lack of real-time threat detection or automated responses to phishing attempts. Weak endpoint protection on personal devices used for work can create cybersecurity vulnerabilities.
Collaboration Tools And Usability
Large financial services organisations focus on seamless collaboration across departments and regions. They need to manage large-scale Microsoft Teams deployments, including multiple channels, meeting integrations and data archiving. There is a high reliance on SharePoint for document management at scale.
However, SMEs use basic Teams or Outlook functionality for collaboration. This can lead to underuse of advanced features such as SharePoint workflows, Teams apps or Power BI (interactive data visualisation). They can struggle to set up streamlined file sharing or to co-author documents securely.
How An Experienced Third-Party IT Supplier Can Help
SMEs require straightforward, cost-effective solutions tailored to basic compliance and security, whereas large organisations demand sophisticated, scalable and highly customisable configurations.
Third-party IT suppliers can bridge gaps for SMEs and elevate enterprise-level setups for larger organisations – ensuring both achieve robust cybersecurity, compliance and productivity.
For SMEs
An experienced third-party IT supplier such as PSTG can:
- simplify the IT setup by tailoring M365 configurations to address common SME gaps, such as email security, data backup and loss prevention
- help SMEs to choose the best value M365 subscription plan – avoiding unnecessary costs for unused features
- ensure SMEs meet UK GDPR, FCA and other regulations through pre-configured templates and best practices
- configure M365 to grow with the business – including automated user onboarding/offboarding and scalable storage solutions
- set up advanced threat protection (such as Microsoft Defender) and phishing simulations to educate and protect employees.
For Large Organisations
PSTG can:
- provide bespoke configurations to handle complex organisational structures and workflows
- deploy advanced tools such as Conditional Access policies, Privileged Identity Management (PIM) and Endpoint Detection and Response (EDR)
- ensure smooth integration of M365 with enterprise tools such as Salesforce or SAP
- establish continuous monitoring for compliance and performance, including automated reporting for regulatory audits
- configure M365 to support global operations with region-specific compliance and data sovereignty considerations.
Get Expert Advice: Why PSTG For M365 Configuration And Cybersecurity
PSTG is a highly experienced IT partner that offers enterprise-level expertise at an SME price point.
We are an accredited supplier to the Crown Commercial Service, an executive agency sponsored by the Cabinet Office.
PSTG is also ISO 9001, ISO 27001 and Cyber Essentials Plus certified.
For further information, please contact: