Science & Technology
Financial Service Providers Need to Catch Up on TLPT
[ad_1]
Keith Poyser on DORA: “A penetration test every three years is ineffective, irrelevant and immediately out of date. Monthly, or weekly testing is far more effective.”
London, 30 April 2025 – Since the implementation of the Digital Operational Resilience Act (DORA) on January 17th this year, financial institutions in the EU are required to conduct regular Threat-Led Penetration Testing (TLPT). This involves using real-world cyber-attack techniques to assess IT infrastructures and identify exploitable attack vectors before they are discovered by threat actors. “While this is a positive step, the mandated three-year testing cycle is far too long given the fast-paced nature of cybercrime,” said security expert Keith Poyser, Vice President for EMEA at cybersecurity company Horizon3.ai. The company operates the autonomous pentesting platform NodeZero®, where financial service providers can conduct penetration tests on their IT infrastructure, cloud and kubernetes environments, as often as they like to identify potential security gaps. Poyser points to findings from Horizon3.ai’s “Cyber Security Report UK 2024/25” according to which 70 percent of organisations questioned have fallen victim to a cyberattack at least once in the past two years.
“Given the increasing frequency of cyberattacks, it is unacceptable for a financial services provider to assess just once every three years whether their IT infrastructure is capable of withstanding an attack or if it will fail,” explained Poyser. He further added: “With cybercriminals becoming ever more aggressive, an exploit focused, impact prioritised, high frequency, modern testing regime, with fix actions and re-tests, has to be a key part of any sensible strategy for financial services institutions.”
“Like Finding a Needle in a Haystack“
According to the industry veteran, the biggest challenge is identifying which of the vast number of potential IT weaknesses or vulnerability “noise” are real world exploitable within an organisation, and prioritising these for quick remediation. “The list of potential entry points is long, ranging from outdated software somewhere in the system, weak or reused passwords, or excessively broad access rights for individual employees, to threats arising from the software supply chain,” explained Poyser, illustrating the scale of the task. He continued: “In this typically heterogeneous and complex IT landscape, finding a security gap is like searching for the proverbial needle in a haystack. Threat actors manage to do it, which is why financial service providers need to use the same methods as cybercriminals to stay one step ahead. And that’s exactly what penetration tests are: searching for needles in your own IT haystack before attackers can find them.”
Extensive Compliance Requirements
“It’s not just about technical protection; compliance is equally important,” emphasised cybersecurity expert Keith Poyser. He highlights the extensive obligations for financial service providers under the Digital Operational Resilience Act: ICT risk management, digital operational resilience testing, which includes TLPT, ICT incident reporting, business continuity and emergency management planning, management of ICT third-party risks, and information sharing between entities to collectively enhance resilience.
In relation to all these obligations, financial service providers are subject to increased oversight by national and European authorities, including inspections and audits. “In the event of a serious security incident, the question of how thoroughly the requirements have been implemented at each institution will come to the forefront,” Poyser is certain.
“A successful self-attack on one’s own IT infrastructure, which is exactly what a penetration test is, provides the best proof of resilience. For this compliance consideration alone, a penetration test is recommended on a monthly, if not weekly, basis.”
CTEM und ASM are Key
Cybersecurity leader Poyser strongly recommends extending the Threat-Led Penetration Testing (TLPT) required by DORA to a Continuous Threat Exposure Management (CTEM). This new approach not only continuously monitors the risk but also makes it visible at both the IT level and management level.
A crucial element in this process is Attack Surface Management (ASM), which involves monitoring the portion of the IT infrastructure that is connected to the internet and, therefore, vulnerable to external attacks. “In the era of online banking and smartphone apps, continuous ASM is essential for financial service providers,” explained Poyser. By integrating the autonomous penetration testing platform NodeZero into their CTEM and ASM strategies, institutions can direct their security efforts towards addressing the actual vulnerabilities that are proven to be exploitable, identified during testing.
Instead of searching for long lists of often low relevance vulnerabilities, Poyser recommends focusing on targeted repairs at critical points. This approach can significantly reduce the so-called Mean Time to Remediation (MTTR), which is the time between discovering a vulnerability and fixing it. In normal practice, this time frame typically ranges from one to three months due to a lack of sufficient staff to fix “all errors at once.” However, with NodeZero tests, exploitable weaknesses are prioritised based on their risk to the specific organisation, enabling the IT team to address the most critical entry points for hackers first, and only then tackle the “smaller gaps.” The tool then shows how to fix the issue, then re-runs a specific retest to ensure that attack is no longer possible.
“DORA is an important step in the right direction,” said Poyser, “but only with significantly shortened pentesting intervals can cybersecurity in the financial sector be made appropriate to the level of criminal energy in the hacker community. And only through an autonomous pentesting platform like NodeZero can this increased frequency be achieved at manageable costs and with a reasonable amount of personnel effort.”
For more in-depth insights on DORA and its impact on legal firms and their requirements for demonstrating resilience, read our detailed whitepaper here.
Download your complimentary copy of the 2025 Gartner® Market Guide for Adversarial Exposure Validation here.
About Horizon3.ai and NodeZero: Horizon3.ai provides a cloud-based platform, NodeZero, enabling organisations and public authorities to simulate self-attacks on their IT infrastructure to assess their cyber resilience through penetration testing (pentesting). Thanks to its cloud model, the platform offers affordable, regular pentesting, making it accessible to mid-sized companies. Horizon3.ai continuously monitors the cybercrime landscape to ensure that newly discovered vulnerabilities are swiftly integrated into the cloud system. NodeZero not only identifies security flaws but also offers tailored recommendations for remediation. Through this platform, Horizon3.ai helps organisations meet rising regulatory demands for cyber resilience in Governance, Risk & Compliance (GRC), with guidelines recommending an internal self-attack at least once a week.
Trademark notice: NodeZero is a trademark of Horizon3.ai
Further information: Horizon3.AI Europe GmbH, Sebastian-Kneipp-Str. 41, 60439 Frankfurt am Main, Web: www.horizon3.ai
PR Agency: euromarcom public relations GmbH, Tel. +49 611 973150, Web: www.euromarcom.de, E-Mail: [email protected]
[ad_2]
Source link
Science & Technology
Quantum Computing Breakthrough: Data Security Implications
MIT’s new quantum algorithm could revolutionize data processing, posing significant challenges for current cryptographic systems. This article explores the implications for data security and potential solutions to counteract quantum threats.
The recent breakthrough in quantum computing by researchers at MIT marks a pivotal moment in the field of data security. On August 19, 2026, Nature published the details of a new quantum algorithm capable of processing data at speeds previously unimaginable. While this innovation holds enormous potential for advancing machine learning and other computational fields, it simultaneously presents a formidable challenge to the current cryptographic systems relied upon to safeguard sensitive information.
At the core of contemporary data security is the reliance on encryption techniques that depend on the complexity of certain mathematical problems, such as the factoring of large numbers, which are currently infeasible for classical computers to solve within a practical timeframe. However, quantum computers, with their ability to perform calculations exponentially faster than traditional machines, threaten to render these encryption methods obsolete. This development could have profound implications for sectors that prioritize data security, including finance, healthcare, and government, where sensitive data is at risk of exposure.
The immediate concern for cybersecurity experts is the potential for quantum computers to crack widely used encryption protocols, such as RSA and ECC, which form the backbone of secure internet communications. The computational power unleashed by quantum algorithms could theoretically decrypt encrypted data in a fraction of the time required by classical computers, leaving digital communications vulnerable to interception and exploitation.
In response to this looming threat, researchers and industry experts are actively exploring the development of quantum-resistant algorithms. These algorithms are designed to withstand the capabilities of quantum computing, ensuring the confidentiality and integrity of data even in a post-quantum world. Efforts in this direction include the study of lattice-based cryptography, hash-based signatures, and multivariate polynomial equations as potential foundations for secure encryption systems.
The urgency to develop and implement quantum-resistant cryptography is underscored by the rapid pace of advancements in quantum technology. Tech companies, governments, and academic institutions are investing heavily in research to safeguard their data infrastructures against quantum threats. The transition to quantum-resistant systems, however, is not without its challenges. It requires a comprehensive overhaul of existing cryptographic frameworks and widespread adoption across industries, a process that demands both time and resources.
Despite these challenges, the potential benefits of quantum computing in fields such as artificial intelligence, pharmaceuticals, and materials science cannot be overlooked. The same capabilities that pose a threat to data security also offer the promise of unprecedented advancements in computational power, enabling breakthroughs that were previously beyond reach.
As the world stands on the brink of a quantum revolution, the dual-edged nature of this technological leap is clear. While the security of our digital world faces new threats, the opportunity for innovation and progress is equally profound. The path forward will require a concerted effort to balance the risks and rewards of quantum computing, ensuring that the transformative potential of this technology is harnessed responsibly and securely.
In the coming years, as quantum technologies continue to evolve, the focus will be on developing robust standards for quantum-resistant cryptography and fostering collaboration between academia, industry, and government to navigate this new frontier. The race to secure our digital future in the face of quantum capabilities is not just a technical challenge but a strategic imperative that will shape the landscape of cybersecurity for decades to come.
Science & Technology
AI-Driven Tools Propel Mars Exploration to New Heights
NASA’s latest Mars mission features AI-driven tools in its rover, enabling autonomous navigation and faster data transmission, marking a significant advancement in space exploration technology.
NASA’s latest mission to Mars has captivated both scientific communities and the public, as the new rover equipped with AI-driven exploration tools begins its journey across the Martian landscape. Wired’s August 2026 report highlights the rover’s ability to autonomously navigate the challenging terrain while making real-time decisions, significantly enhancing the efficiency of data collection. This innovation is poised to revolutionize the way robotic missions are conducted in space.
The rover’s sophisticated communication systems represent another leap forward, allowing for faster and more reliable data transmission back to Earth. These advancements mean that scientists can receive critical information more swiftly, enabling them to adjust mission parameters as needed. According to Wired, this capability is essential for responding to unexpected findings and maximizing the scientific value of each mission.
Moreover, the integration of AI tools in the rover’s design marks a pivotal shift towards reducing dependence on Earth-based commands. As Wired notes, this development could pave the way for future missions that operate with greater autonomy, setting the stage for more complex and prolonged explorations of Mars. The implications of this technology extend beyond current missions, suggesting a future where human exploration of Mars is supported by highly capable robotic counterparts.
As NASA continues to push the boundaries of space exploration, the success of this mission will likely influence the design and execution of future endeavors. The potential for these AI-driven tools to transform space exploration is immense, promising a new era of discovery and innovation on the red planet and beyond.
Science & Technology
Quantum Computing Breakthroughs: Disrupting Industries with Oxford’s Innovations
A recent breakthrough in quantum computing at the University of Oxford promises to disrupt multiple industries by significantly enhancing computational capabilities. Explore the technological implications and potential disruptions poised to redefine sectors.
In May 2026, the University of Oxford announced a significant breakthrough in the field of quantum computing, unveiling an advanced error correction algorithm that has the potential to transform computational capabilities. This development is not just a scientific triumph; it heralds a new era of technological disruption across multiple industries. Quantum computing, long anticipated as the next frontier in technology, promises to solve complex problems beyond the reach of classical computers, and Oxford’s latest advancement brings this closer to reality.
At the core of this breakthrough is the enhancement in quantum error correction, a critical component that addresses the inherent instability of qubits, which are the fundamental units of quantum information. Traditional computers use bits of 0s and 1s, but quantum computers operate on qubits, which can exist in multiple states simultaneously. This superposition allows quantum computers to process information exponentially faster than classical computers. However, qubits are notoriously prone to errors due to environmental noise and operational inaccuracies. Oxford’s new algorithm significantly improves the error correction process, maintaining qubit stability longer and allowing extended computational tasks to be performed accurately.
The implications of this are profound. Industries ranging from pharmaceuticals to finance stand on the cusp of disruption as quantum computing offers the ability to model complex molecular structures, optimize large-scale financial portfolios, and even revolutionize artificial intelligence algorithms. In pharmaceuticals, for example, quantum computing can expedite drug discovery by accurately simulating molecular interactions, potentially reducing the time and cost associated with bringing new drugs to market. Similarly, in finance, quantum algorithms can optimize trading strategies and risk management with a precision unattainable by current technologies.
Moreover, the ripple effects of such a leap in computational power extend to data encryption and cybersecurity. Quantum computers possess the potential to decrypt classical encryption methods, prompting a race for quantum-resistant cryptography. This necessitates a paradigm shift in how we secure digital information, affecting every sector that relies on data security.
Despite the tremendous promise, the transition to quantum computing is not without its challenges. The infrastructure required to support quantum technologies is expensive and complex. There is also a significant skills gap; experts in quantum computing are scarce, and training a new generation of scientists and engineers is imperative. Furthermore, ethical considerations regarding the power of quantum computing must be addressed, particularly in terms of privacy and security.
Looking forward, as quantum computing continues to evolve, industries will need to adapt swiftly to harness its capabilities. Early adopters who invest in quantum technologies and develop quantum-ready strategies will likely dominate in the coming decade. As Oxford’s breakthrough demonstrates, the race is on to fully realize the potential of quantum computing and redefine the boundaries of what is technologically possible.
-
Entertainment & Arts4 months agoDrake’s ‘Iceman’: A Streaming Chart-Busting Success Story
-
Science & Technology4 months agoApple’s AI Innovations: Shaping the Competitive Landscape in 2026
-
Environment & Nature1 year agoSK tes Launches New Circular IT Facility in Shannon, Expanding Ireland’s Role in Global Sustainable Tech Services
-
Business & Finance1 year agoApple Appeals €500 Million EU Antitrust Fine: A High-Stakes Battle Over App Store Rules
-
Business & Finance3 months agoAI Revolutionizes Cryptocurrency Trading with Real-Time Analysis
-
Entertainment & Arts4 months agoThe Cinematic Legacy of Michael Jackson: A Biopic Unveiled
-
Science & Technology4 months agoAI Fitness Instructors and Unreal Gains: Revolutionizing the Fitness Industry
-
Entertainment & Arts1 year agoOXYGEN FILMS ANNOUNCES NEW FILM ‘NOSEBLEED’ — A BOLD QUEER THRILLER THAT PEERS INTO THE DIGITAL ABYSS.
