Financial services is among the most highly targeted sectors, because attackers know disruption carries immediate business consequences. A compromised account—or an exploited internet-facing system—can expose customer data, disrupt transactions, and open paths into branch, partner, and third-party connectivity.
Attackers have learned to exploit that operational sensitivity. They target identity and public-facing infrastructure as fast paths to initial access, knowing lateral movement can outpace manual approval workflows. Public-facing exploitation does not require a user to click, and attackers can quickly use ransomware and data theft to create pressure, increasing fraud risk and damaging customer trust.
Ransomware attacks against finance and insurance rose 122% in Q3 2026, while Exploit Public-Facing Application climbed from 24% to 36% of observed techniques. Attackers are getting faster and broader while many defensive models still depend on human analysts, manual escalation, and after-hours coverage gaps.
There is no time for slow defense when access can turn into impact this quickly.
Four Ways Finance and Insurance Teams Can Act Now
Automate containment for high-confidence threats.
Known malicious behavior—validated command-and-control, confirmed credential abuse, ransomware tooling, or activity from blocked infrastructure—should trigger immediate response through approved playbooks. These are scenarios where the risk of waiting is greater than the risk of acting. In Q3 2026, finance and insurance organizations using Automated Response Playbooks achieved a mean time to contain (MTTC) of 3 minutes.
Define the business-critical topology.
Payment systems, privileged service accounts, branch connectivity, and customer portals need to be tagged and prioritized before an incident. Ransomware activity became more distributed this quarter, with Qilin, The Gentlemen, Storm, and LockBit all posting sector victims. Storm and LockBit posted finance and insurance victims above all sector baselines, suggesting selective interest in the industry. This makes it more critical for teams to know which assets create the most business risk before attackers force a response decision.
Prioritize edge and remote access controls.
This quarter’s data points directly to public-facing exploitation. Finance and insurance organizations should prioritize VPN and edge-device patching, restrict remote administration with Privileged Access Management, enforce phishing-resistant MFA, and limit API access to trusted IPs wherever possible. This is especially important as the number of CVEs observed in active exploitation rose to 109, with 59 exploited within five days of public disclosure.
Harden detection around the fastest access paths.
Exploit Public-Facing Application rose from 24% to 36% of observed techniques, making it the clearest driver of activity. Phishing remained active, but exploit-driven access gained ground because it scales without a user click. Teams should tune detections around exposed applications, suspicious authentication patterns, web shells, external remote services, brute force, and scanning activity. The goal is to catch the access attempt before it becomes lateral movement, data theft, or ransomware deployment.
What Agentic Defense Looks Like for Financial Services
Finance and insurance organizations cannot accept a black box making response decisions across regulated systems. They need AI that is governed, explainable, and tuned to the environment.
GreyMatter is built for that operating model.
The platform decomposes investigations into single-task agents across identity, endpoint, network, cloud, and email. Each task is routed through the AI Model Broker, which selects the right model based on speed, cost, and accuracy. The result is fast, accurate execution without forcing customers to manage models or AI usage costs.
GreyMatter uses its Universal Translator to normalize telemetry across the customer’s existing tools without requiring data centralization—giving the AI a unified picture of the environment while allowing detections to run wherever the data lives or moves.
