Evolving Security: AI, Advanced Analytics and Operational Resilience in the Financial Sector

DORA and its implications

On 16 January 2023, the new European regulation DORA (Digital Operational Resilience Act) came into force and will be binding from 17 January 2025. This regulation has the function and objective of consolidating and harmonising at European level the main cybersecurity requirements with regard to digital operational resilience in the financial sector, for an implementation of measures in the areas of governance, cybersecurity, risk management for companies and enterprises.

All actors covered by this regulation will be required to develop or implement their own corporate procedures to be fully compliant with the regulation's directives by meeting the requirements.

Evolving in security and using the correct tools to monitor and maintain compliance, in this case with DORA, which impacts not only the company but all its employees leads to companies necessarily having to be resilient companies.

Therefore, in order to be resilient, an organisation must make all processes resilient, and not only those involving logical 'information' security, in its cyber security sense, but also physical security, both because separating physical and virtual perimeters is almost impossible today.

Therefore, all the points set out in the DORA regulation must also be applied in the development of security processes in a modern and evolved sense, where resilience is not just a manifestation of principle to make the company compliant with a regulatory model, but is in fact concrete and applicable effective operational resilience.

From this point of view, it is then necessary to take up, in rethinking and evolving security processes, the issues of risk management, in general, where the outsourcing of risk provides for the re-internalisation of risk at any time, and on the other hand, the need to outsource risks not only to qualified subjects but to subjects that are themselves resilient.

Advanced analytics and Artificial Intelligence

The technological platforms with which the security systems in the banking world are managed and operate contain a wealth of data and information that, if extrapolated and properly processed and analysed, can provide a real and up-to-date snapshot of the state of the systems.

What data can and should guide us to truly define concrete strategies? While it is true that all data are important, it is equally true that some data are more important and useful, and the real added value lies in those who are able to identify which data are strategic. And no, it is not AI.

The human factor, people, skills can make the difference, only those who are able to understand phenomena and events can prepare the field and lay the foundations for technology to work to the best of its ability.

And it is in this context that it is necessary to identify the best and possible analysis of data from security platforms and systems because it is the starting point for building models, making decisions, directing investments, creating digital and sustainable models. It is therefore possible, even in the security world, to build a key to access AI, but we need to start from what we have, what information technology produces and how we can rationalise and use it.

Hence, data analysis must and can become a tool to improve and optimise business, and it is only the ability to analyse data that can lead to the inevitable use of artificial intelligence and truly advanced technologies that can support and guide choices and decisions and lead to a qualitative management of security, helping to overcome the age-old reflection of security between cost and value, and lead to digitised and sustainable service models.