IT 
ES 
October’s Cybersecurity Awareness Month gives banks an opportunity to reassess their security measures, particularly as cyber threats remain a significant concern. The Bank of England’s Systemic Risk Survey (2026) found that 82% of UK financial institutions list cyber-attacks among their top five risks. The World Economic Forum (2026) also reports that 94% of cyber leaders see AI as a defining force in cybersecurity, while 77% of organisations use AI in their cyber operations.
Together, these figures show how quickly the threat environment is changing. Banks must protect people, customers, suppliers, systems, ATMs and physical infrastructure. They must also prepare for faster and more complex attacks.
KEY TAKEAWAYS
- Cybersecurity must be part of everyday banking and not just annual training.
- Banks must protect people, suppliers, servers, networks, ATMs, hardware and physical connections.
- ATMs need protection at the hardware, firmware and pre-boot levels.
- AI can support cyber defence, but people must control high-impact decisions.
- Monitoring and reporting help banks detect incidents and demonstrate compliance.
HOW CAN BANKS BUILD SECURITY INTO DAILY WORK?
To make cybersecurity part of everyday banking, banks must build clear security controls into their normal processes. This helps reduce the risk of weak credentials, excessive access and unverified requests.
Multi-factor authentication, strong credentials and the principle of least privilege should be standard. Staff should also verify unusual requests before taking action, especially when they involve customer information, payments, credentials or privileged access.
These controls must also apply to employees, contractors and third-party workers. This includes people who maintain ATMs or replenish cash. Since anyone with access can affect the bank and its customers, banks should monitor critical infrastructure continuously.
This includes ATMs, servers, communications, hardware and physical connections. Continuous monitoring can identify configuration drift, which occurs when a system moves away from its approved security settings.
PROTECT THE FULL ATTACK SURFACE
This broad outlook is important because attackers search for the weakest link. That link may be an employee, supplier, server, network device, ATM or physical connection.
For example, a network device may be overlooked but could still affect communications or transactions. Therefore, the security perimeter includes every part of the infrastructure that supports banking services.
People are also a key target. AI can make phishing, social engineering and deepfakes more convincing. For this reason, employees should check requests before acting, particularly when they involve credentials, customer data, transactions or privileged access.
WHY DO ATMS NEED PROTECTION BEFORE STARTUP?
ATMs are critical cyber-physical assets in public environments. Their security must begin before Windows or another operating system starts.
Risks can exist in the hardware, firmware, BIOS settings and boot process. Attack paths may also involve PCI Express and Direct Memory Access.
As a result, physical access should not automatically provide privileged access to an ATM. Banks can reduce this risk through hardening, application whitelisting, controlled boot order and restricted hardware capabilities.
ATMs should contain only the hardware and functions they need. BIOS passwords and device settings must also be managed securely. Where supported, BIOS passwords can be centrally configured and rotated, while device settings can be centrally managed.
HOW CAN BANKS PROTECT ATMS THROUGHOUT THEIR LIFECYCLE?
As ATM security risks can arise at different stages, banks need protection that works throughout the entire ATM lifecycle. Lookwise Device Manager (LDM) helps provide that protection across deployment, updates, maintenance, network connections and remote operations.
LDM also identify and authorise ATM hardware devices, including cash dispensers, pinpads, card readers and cash modules, helping banks control their use and detect unauthorised connections, replacements or hardware changes.
With these capabilities in place, banks can take a more proactive approach to ATM security. Protection can extend across the full ATM environment, from physical access, hardware and firmware to pre-boot activity, remote operations and the operating system.
REMEDIATE RISKS WITH THE RIGHT CONTROLS
The same security focus is needed when banks respond to vulnerabilities. Remediation means more than applying patches. Banks should assess exploitability, exposure and business impact before deciding how to respond.
If a patch cannot be applied immediately, hardening, allowlisting, segmentation and enhanced monitoring can reduce risk. These controls are especially important when legacy systems cannot easily be taken offline.
The objective is to close the attack path quickly and safely. Patching remains important, but it is only one part of a broader security response.
USE AI WITH HUMAN CONTROL
AI can help security teams find vulnerabilities and respond faster. However, it can also make cyber-attacks more sophisticated and increase pressure on banks to act quickly.
For this reason, AI agents should handle only low-impact and reversible decisions. People must approve actions that affect customers, transactions, data, critical systems or privileged access.
Attackers may manipulate the information or prompts given to AI. Human oversight is therefore essential when an AI-supported decision could have a serious or irreversible impact.
IMPROVE VISIBILITY AND REPORTING
Reliable security records support better decisions. Banks should be able to retrieve, export and trace historical information across their security environment.
This helps teams understand incidents, identify weaknesses and explain what happened. It also supports operational reporting and regulatory reviews.
DORA and the EU Cyber Resilience Act are encouraging more consistent security practices across banks, suppliers and technology providers. However, compliance is not the same as security. Strong daily processes should create the required evidence naturally.
SECURING THE FUTURE OF BANKING
Over the next three to five years, AI could increase the speed and scale of cyber-attacks. Banks may face more convincing phishing, deepfakes and AI-enabled attacks against employees and customers. Attackers may also target privileged AI agents.
However, AI should not be the only focus. Banks must protect legacy systems, cyber-physical infrastructure, supply chains and third-party connections. They must also secure hardware, firmware and the boot process before the operating system starts.
Finally, banks need to monitor configuration drift. Systems that are secure when deployed may move away from approved settings. Continuous monitoring can help banks identify these changes and respond to them.
By making cybersecurity part of everyday banking, banks can strengthen protection across their operations. They can respond to changing threats, protect customers and preserve trust in the essential services people rely on every day.
FREQUENTLY ASKED QUESTIONS ( FAQ)
What is the main message for Cybersecurity Awareness Month?
Cybersecurity must be part of everyday banking. Banks must protect people, customers, suppliers, systems, ATMs and physical infrastructure.
Why is reporting important for banks?
Reliable security records help banks understand incidents and explain what happened. They also support operational reporting and regulatory reviews.
Why must cybersecurity be part of everyday banking?
Attackers search for the weakest link. This could be an employee, supplier, server, network device, ATM or physical connection.
Who should be included in a bank’s security processes?
Security controls should apply to employees, contractors and third-party workers. This includes people who maintain ATMs or replenish cash.
How can banks reduce the ATM attack surface?
Banks can reduce risk through hardening, application whitelisting, controlled boot order and restricted hardware capabilities. ATMs should contain only the hardware they need, and BIOS passwords and device settings must be managed securely.
How should banks use AI in cybersecurity?
AI can help security teams find vulnerabilities and respond faster. However, AI agents should handle only low-impact and reversible decisions. People must approve actions affecting customers, transactions, data, critical systems or privileged access.
Why must humans remain involved in AI decisions?
Attackers may manipulate information or prompts given to AI. Human oversight is therefore essential for serious or irreversible decisions.
