How can firms build operational resilience that evolves alongside risk?

The 2024 CrowdStrike outage had a notably widespread impact, affecting over 8.5 million Windows users worldwide. Two years later, the financial industry seems to face similar headline-grabbing outages on a regular basis.

Operational risks and threats continue to advance, urging firms to build resilience strategies sturdy enough to meet today’s needs and agile enough to adapt to future threats. By understanding the common denominators that triggered previous incidents and combining these with industry-wide knowledge sharing and regulatory guidance, firms can ensure their operational resilience is proactive, not reactive.

How are cyber incidents impacting financial services?

Some of the most notable examples of recent large-scale disruptions include the CrowdStrike and AWS outages, which caused a ripple effect across industries. These outages affected thousands of enterprise companies and millions of individual users worldwide, and underscore how reliant internet services are on a handful of hyperscalers.

As technology advances, firms must also contend with unprecedented AI-enabled cyberthreats. Frontier AI models enable threat actors to breach firm and vendor environments at unprecedented speed and widen the scope of social engineering attacks.

Frontier AI has been used to create attack-specific agentic frameworks that can breach enterprise networks. Similarly, AI developers have announced that frontier models have been able to bypass controls and gain unauthorized access to firms’ systems. Firms are using frontier AI to support operational resilience and spot gaps in posture, though a recent FCA review found that these models are identifying gaps faster than firms can fix them.

Since financial services organizations handle a considerable amount of sensitive data, they’re often a priority target for bad actors and potential breaches:

• An Identity Theft Resource Center report found that financial services suffered more breaches in 2024/2025 than any other sector
• A survey conducted by the ABA Banking Journal found that 76% of executives said their bank has experienced an increase in cyber attacks
• KPMG reported that 75% of respondents said cyber incidents have increased over the last 12 months

What is the regulatory guidance on operational resilience?

Regulators worldwide have responded to the increasing frequency and complexity of cyber incidents with a range of operational resilience requirements and guidance:

• The European Union (EU) Digital Operational Resilience Act (DORA): DORA establishes five pillars that firms in the EU and U.K. must adhere to, including: operational resilience testing, ICT risk management, third-party monitoring, incident reporting frameworks, and information sharing.
• The Financial Conduct Authority’s (FCA) Senior Management Arrangements, Systems and Controls (SYSC) 15A.2: In its SYSC Rulebook, the FCA requires firms to identify important business services that could cause intolerable levels of harm if disrupted.
• The Office of the Superintendent of Financial Institutions (OSFI) E-21: Operational Risk for Canadian FRFIs: OSFI’s E-21 establishes expectations for operational risk management and resilience. Its four pillars include governance, operational risk management, operational resilience, and specialist risks.
• The Financial Industry Regulatory Authority’s (FINRA) Rule 4370: FINRA’s Rule 4370 requires firms to create and maintain business continuity plans to manage unexpected disruptions.
• The Federal Reserve’s Supervision Principles on Operational Resilience: In an interagency paper, the Federal Reserve outlines a comprehensive approach firms can take to strengthen their operational resilience, covering governance, risk management, continuity, and third-party risk standards.

Global regulators have also issued more recent statements on how firms can strengthen their operational resilience frameworks against evolving and novel risks:

• The FCA’s frontier AI review: The FCA highlights that frontier AI can outpace existing regulations and risk management practices, urging firms to re-evaluate governance and escalation routes as well as accountability.
• OSFI’s 2026 Semiannual Risk Outlook: OSFI underscores how frontier AI can intensify cyber, technology, and third-party risks, including by exploiting vulnerabilities or launching coordinated large-scale attacks.
• Office of the Comptroller of the Currency (OCC) Semiannual Risk Perspective: In its Risk Perspective, the OCC discussed how advanced AI models lower barriers for threat actors to commit cybercrimes while also increasing the speed of attacks.

What can firms learn from previous cyber incidents?

Firms can build and strengthen their operational resilience strategies using a wide range of information, including understanding of their own unique operations and tech stack, industry best practices, regulatory guidance, and knowledge sharing between peers. However, firms can also learn from previous cyber outages, even if they were not directly affected.

1) Proactive security is pivotal across all systems and services

A security vulnerability in one system can easily cascade to other systems, ultimately disrupting business operations across a firm or even the wider industry. Firms should map out dependencies, review vendors’ redundancy plans, and establish their own recovery capabilities.

Organizations and third parties should follow leading security standards like SOC-2 or ISO 27001. In addition, multi-layered security processes like multi-factor authentication, encryption, threat monitoring, and access controls can help reinforce resilience.

2) Centralized systems provide better control

Public and shared cloud environments have been the source of some considerable disruptions in recent years and are a priority target for bad actors. In many cases, affected firms are subject to a vendor’s recovery timelines and must wait for systems to come back up.

Private cloud infrastructure can minimize exposure to threats compared to shared cloud services. With more control over scalability and system deployment, firms can better manage cloud-related risks.

3) Transparency and accountability help maintain risk management

As new technologies increase cyber risks and expose system vulnerabilities, it’s important to have complete transparency between firms and their vendors. This will help stay up to date on updates or changes, data privacy processes, cost predictability, and other compliance obligations. Firms and their IT and operations teams get clearer oversight of any changes they may need to compensate for, and a clear line of contact and accountability should they have questions or require additional support.

Firms have always needed to ensure their operational resilience strategy evolves in step with risk. Now, the pace of that evolution has increased and will only continue to accelerate. Firms that build strong yet flexible resilience strategies, follow regulatory guidance, and learn from peers and examples will be the ones that are best placed to keep operations running.

As firms continue to contend with outages, Global Relay’s priority is remaining operational, secure, and reliable. If you’re looking for a secure and adaptable technology vendor, get in touch.