Ahead of our 3rd December webinar, we sat down with Mo'men Mahmoud, Content Engineer at TryHackMe, to talk about why the groups targeting banks and insurers keep changing, how financial services security teams can sustainably keep pace.
Qilin, Famous Chollima, and now names like TraderTraitor, n0n, TheGentlemen. The list keeps growing. Is the job of incident response teams really about tracking all of them?
Awareness, and building adversary fluency into a team's defensive practice are crucial. But at the rate that these attackers are evolving, and with new groups coming onto the scene constantly, defensive teams need to get off the back foot. If your readiness depends only on recognising a specific group, you're already behind.
Look at the pace: Qilin has been naming a new victim roughly every six hours. North Korean operators pulled in a record haul last year, and in October the FBI tied TraderTraitor to the theft of around $6.3 billion from Binance. New extortion and ransomware-as-a-service crews surface constantly. You can't prepare for each name. What you can prepare is the best practice, instincts and coordination to be certain that you're not losing time with your response. You can build familiarity with TTPs and know how to handle them, without having had full exposure to a particular threat actor before.
Financial services gets hit harder than almost any sector. Why does readiness feel so urgent there specifically?
A few factors come together here. The stakes are high, because these groups go where the money and the data are, and a bank or an insurer has both in abundance. In this sector, you're a target every day.
Financial institutions usually have strong, mature defences, which is exactly what you want. But the better your prevention is, the less your responders get to practise on the real thing. So when that incident inevitably happens one day, the team can't act based on lived experience.
That is why the testing matters. The moment you put a team into a realistic scenario, process gaps and knowledge gaps are visible. Process, as in how the incident response itself runs, and knowledge gaps, in terms of understanding the attack techniques and how to investigate them. You don't find those by hoping they're not there. You have to test.
Is incident response about process and tooling, or instinct?
Process and tooling are the minimum. What separates teams is whether they can read the situation quickly. Can you recognise the shape of a technique, see the pattern, and start moving in the right direction before you have the full picture?
A lot of this is thinking like the attacker. Sophisticated groups don't improvise, they work from playbooks they have already tested, and they know the approach works. They pick the techniques that fit your environment, usually the blind spots where you have no visibility, and very often they abuse legitimate, built-in tools so they blend into normal activity. So the skill is being able to tell malicious from legitimate, and to understand why they chose that specific move here. Once you understand that, you can predict the next step. So in the end it really is your playbook against theirs.
The other side of it is efficiency of thinking. What we see at TryHackMe, during Live Breach IR exercises, is that people don't know where to look. They start building hypotheses that have nothing to do with what actually happened. They go down rabbit holes, and they lose a lot of time. In an exercise, that is a good lesson. In a real incident it is a catastrophe, because the most valuable thing you have is time. A prepared responder knows the go-to evidence, knows the fastest way to get a lead, and doesn't waste a second getting there.
You mentioned the tooling itself being targeted. What happens when the tools fail?
Most teams we've seen lean on their EDR, because it sits in the vendor's cloud, it has the detection rules, it flags the attack steps for you. But EDR bypasses are everywhere now, and plenty of groups go straight for the tooling. What we hear on calls is that the moment the telemetry isn't there, people freeze. They say, we don't see it in the console, so we don't know what to do.
The answer is to have knowledge deep enough that you don't depend on any single tool. If you understand the techniques and the traces they leave on a system, you can investigate by hand. Even when the tools are working, you can validate what they're telling you instead of trusting them blindly. It's the same thing everyone is relearning with AI. Use the tool, but understand the work well enough to catch it when it's wrong.
The same goes for gaps in the evidence. If one artefact isn't there, you go to another one that answers the same question. If that one is missing too, you go to the next. In this way, you're building a method that adapts to whatever environment you land in. And that is the whole job in the end: using what you know to work out what the attacker did, and contain it, so the business gets back to normal.
Instinct sounds very individual. Where does the team come in?
Team effectiveness requires more than just a group of individuals doing their own work well in their own way. You can put a room full of very skilled people together and still respond badly, because incident response is not a solo thing. It is coordination, under time pressure. Seconds get lost in handoffs, in 'who owns this', in two people doing the same task and missing another. You need to all move as one, with clear roles and a shared read of the situation.
And the individual and the team are not really separate. They are in harmony. You're always drilling, always finding something to brush up on, then going again. It's a loop.
Regulators are increasingly asking financial institutions to prove readiness, not just claim it. How does that change the picture?
Significantly. Describing a plan isn't sufficient, you need evidence that your team can respond, and the level of assurance expected is increasing. The direction has to be making readiness measurable, treating incident response as a discipline you can track with real data over time, like anything else that matters.
So what do you want people to walk away with from the session?
That you will never out-predict the attacker, but you can out-prepare them. Attendees will walk away understanding what out-preparing them looks like, and how they can implement this approach, realistically into their teams.
Building Incident Response Readiness in Financial Services
Thursday 3rd Dec 2026 · 17:00-18:00 CEST · 1 hour · Live online
Joanna Duffy
