4 Cyber Security Lessons for Banks from a Real-World Attack (Why Early Detection Matters)
A real-world case study of a cyber-attack on a bank, highlighting why early detection, visibility and MDR are critical for protecting financial institutions.
If you oversee cyber security in a banking environment, this highlights how Managed Detection and Response helps identify threats earlier, reduce investigation time and protect business continuity.
In 2019, we were contacted late on a Friday by a medium‑sized international bank that was not an existing client. The organisation had become aware of a potential cyber security issue following the receipt of credible intelligence indicating that unauthorised access to internal systems may have occurred.
At that stage, there were no service outages, no ransomware activity, and no immediate business disruption. However, given the nature of the indicators, the bank appropriately escalated the matter for specialist investigation to understand the scope, impact and risk.
Initial Assessment: What We Found When We Engaged
Once engaged, our role was to provide independent forensic clarity and support informed decision‑making. Within hours of beginning the investigation, it became clear that this was not a recent or isolated event.
Our investigators established that:
- The threat actor already had established access to the environment
- That access had persisted undetected for an extended period
- Traditional security tooling was present but had not identified suspicious activity
Critically, there was no single “alert” moment. This was a persistent, low‑noise intrusion designed to avoid detection rather than cause immediate disruption.
Nature of the Threat: Persistence Rather Than Disruption
The activity observed did not align with common financially motivated attacks such as immediate ransomware deployment. Instead, the behaviour suggested a focus on:
- Maintaining long‑term access
- Observing internal processes and communications
- Preserving multiple methods of re‑entry
As the investigation progressed, it became apparent that weaknesses in network design, including excessive administrative privileges and minimal internal segmentation enabled the attacker to move laterally once access was obtained.
Why Existing Security Controls Did Not Raise Alerts
At the time of the incident, the bank had invested in endpoint protection and antivirus tools. Despite this, the attacker’s activity remained undetected.
This was due to several factors identified during the investigation:
- Use of standard system administration tools already present within the environment
- Credential access achieved through legitimate system processes rather than malware execution
- Manipulation of security controls to exclude specific activity from detection
In effect, the attacker relied on behaviours that appeared operationally normal. Without continuous behavioural monitoring and centralised log correlation, these actions did not trigger alerts.
Our Approach: Containment With Evidence Preservation
Given the duration of access and the lack of clarity around attacker objectives, an immediate blanket shutdown was not the most appropriate response. Instead, we worked with the bank to balance risk reduction, evidence preservation and operational continuity.
Controlled Containment
External access paths were reviewed and restricted, with carefully managed controls applied to avoid triggering further escalation or data destruction.
Centralised Monitoring and Log Collection
Enhanced monitoring was deployed across key systems, with log data captured in real time and stored independently of the affected environment. This ensured activity could not be erased locally, something that proved critical during subsequent access attempts.
Identification of Persistence Mechanisms
Through correlation and observation over time, persistence mechanisms disguised as legitimate system accounts were identified, enabling effective remediation planning.
Recovery and Remediation
Based on the length of time the attacker had access, we advised that the environment could not be guaranteed clean without a full rebuild. While this would have been the most robust option, operational constraints required the bank to remain live.
The response therefore involved:
- Immediate stabilisation measures completed within weeks
- A structured remediation programme covering credentials, network design, legacy access and infrastructure
- Continued monitoring due to repeated access attempts following containment
Full operational recovery was achieved within weeks. However, forensic and legal processes, as is common in regulated sectors extended over several months.
Key Lessons for Banks
This incident reinforced several important lessons for financial institutions:
- Serious incidents are not always immediately visible
Long‑running, low‑noise intrusions can exist without triggering alarms or outages. - Compliance does not equate to continuous security
Controls may be in place, but gaps in visibility can still exist. - Visibility underpins control
Without centralised monitoring, confirmation and containment would not have been possible. - Reactive response is harder and riskier
Deploying detection capabilities during an incident is always more complex than having them in place beforehand.
Why We Are Referring Back to a 2019 Incident
We are deliberate in referring to an incident from 2019.
Cases of this nature are now significantly less common across our client base, largely because our first advisory position with banks today is to implement continuous monitoring and Managed Detection and Response (MDR) as a foundational control, rather than relying solely on periodic assessments or preventative tooling.
The measures that ultimately enabled this investigation, including centralised log collection, behavioural monitoring, and human‑led analysis, are now standard components of how we support banks on an ongoing basis, not capabilities deployed only during major incidents.
Transparency as a Trust‑Building Control
The bank involved has explicitly permitted reference to this incident because of the value transparency brought both during and after recovery.
By openly addressing the issue, taking decisive remedial action, and clearly communicating the long‑term security improvements implemented with CND’s support, the organisation was able to reassure clients, partners, and stakeholders that cyber security is treated as a strategic priority.
This transparency strengthened trust rather than undermining it. In practical terms, it supported client retention and helped encourage new business by demonstrating operational maturity and resilience in the face of cyber risk.
This reflects a broader pattern across financial services: institutions that manage incidents professionally and openly are often better positioned commercially than those that rely on silence or minimal disclosure.
Why Managed Detection and Response (MDR) Changes Outcomes
Every capability that enabled effective investigation and control in this case, continuous monitoring, behavioural detection and human‑led analysis, is now delivered proactively through our Managed Detection and Response (MDR) service.
For banks, MDR provides:
- Continuous visibility across infrastructure, endpoints, and authentication events
- Early identification of anomalous behaviour before regulatory or operational impact
- A dedicated security operations capability with contextual understanding of the environment
Had MDR been in place from the outset, this activity would likely have been identified significantly earlier, reducing both remediation effort and wider business impact.
Final Thought
Cyber incidents in financial services are increasingly defined by what is not immediately visible.
This case illustrates that the absence of alerts does not mean the absence of risk, only the absence of detection. The most effective way for banks to protect operations, reputation and client trust is to establish continuous visibility before an incident occurs, not after.
Please contact the Service Delivery team via
This case study is based on a real incident discussed with the senior investigator / CTO leading the response at the time. All sensitive details have been anonymised.