Right now, financial services is one of the most attacked industries on earth. Threat actors follow the money, so finance sits at or near the top of the target list year after year, and the volume and intensity keep climbing.
Financial services also happens to be one of our fastest growing client segments at TryHackMe. And the longer we spend in the sector, the clearer one thing becomes: the sector's security teams have been woefully underserved by the platforms that should be keeping them ready and confident for the next wave of attacks.
In the crosshairs and running complex systems
IBM X-Force has ranked finance and insurance the second most-attacked industry for five years running. The IMFestimates nearly a fifth of all reported cyber incidents over the past two decades have hit the sector, with around $12 billion in direct losses. Ransomware against financial firms rose 30% last year, and DDoS attacks on them more than doubled. When you hold the money, you are, unsurprisingly, a permanent target.
Then there's the environment security teams in this sector protect. Financial estates are vast and intricate, built up over decades of growth and acquisition, spanning countless systems, vendors and regions, with a different regulator in every market. The rules get more demanding by the year. Defending all of that is hard, skilled work, and the people doing it are good at it. One leader was candid about the sheer scale, calling complete asset visibility across a sprawling estate "a nut we haven't cracked," a reflection of how large and intricate these environments have become. A SOC leader at a global broker walked us through the clock his European operations face under the EU's DORA rules: an initial report within hours, an intermediate report within 72 hours, and a final report within a month, one of several regional regimes his teams answer to. Meeting obligations like that, consistently across a global footprint of regulators, is a real feat of operational discipline. These are sophisticated teams, running complex systems under rising scrutiny, and doing it well.
So why is the training so... stale?
So here is what surprises us. For a sector carrying this much risk, the training on offer has been thin, and the buyers are refreshingly candid about it.
On the compliance training most of them inherited, one security chief said he would "much rather watch paint dry at half speed," and called the material "woeful" and barely changed in three years. A security team at a health insurer described paying "20K for a dungeons and dragons session" that never once put hands on a keyboard. All too often we hear that teams have been going with the 'gold star', analyst-recommended platform, but the content is "rarely updated" and "not very engaging."
In a sector this complex, box-ticking e-learning and theory decks prepare no one for an incident. Neither does surface-level immersion that doesn't keep up with industry needs.
They know exactly where the hard problems are
What strikes us most in these conversations is the honesty, and the deep self-knowledge behind it. The security leaders in this space understand their environments intimately, and the challenges facing their teams. When asked how they catch a failed control, one financial-services firm answered plainly: "unfortunately, we find out about it through incidents a lot of times." A credit union security lead, pressed on control testing, was just as straight: "I don't think we do an adequate enough job." There's strength in that acknowledgment, because it's the first step towards addressing the problem. It doesn't come from negligence, either. One European bank articulated it perfectly: the paradox lies in stronger controls leading to fewer opportunities to practice incident response. That's why financial services deserves better training.
A payments company described its ransomware response as "kind of ad hoc again in the incident itself." Tabletop exercises, where they run, are often lighter than the team would like: one said its scenarios are loosely scoped, "we'll just pick a topic and go for it," with no executives in the room, and another flagged the absence of a security tabletop as "a concerning gap that I need to address." None
Even comparison is hard to come by. "I don't even know where we stack within our industry," one credit union leader said, wishing for a benchmark the market does not readily give them. In a sector measured on everything else, honest peer comparison remains out of reach.
Workload shapes requirements
If these teams see the problems so clearly, why do the gaps persist? Time. "Work comes first and everyone's really busy," one firm said. A credit union leader was blunter on why upskilling stalls: "the team has been so overloaded with work." An insurer's operations lead described the daily reality: "we are basically firefighters within the company, so we get pulled in different directions throughout the day."
So format matters as much as content. Teams want to learn in ways that fit their changing realities and constraints: "you're not climbing Mount Everest, but maybe the hill in the next neighbourhood." Low-friction and role-relevant is key.
Proof is non-negotiable
Like all security teams regardless of sector, finance teams want evidence their people can do the work when an incident hits, presented in a way they can hand upward.
The pressure comes from above and outside. A broker's security leader shared an extensive list of questions that never leave his client and regulator questionnaires: qualification levels, how well his practitioners are trained. Showing the board a team practising real material week in and week out, he said, is far easier to justify than one expensive certification. And when an auditor asked for proof of a tabletop exercise: "I simply forwarded the report and a few screenshots... and they were like, this is great. We love this."
A global professional services firm put it commercially. With "8 to 12 weeks" to make new hires "production enabled," they needed "coverage beyond theory," a way to "train and track it," and "quantifiable, outcome and evidence" to "show evidence to leadership." Hands-on practice, tied to real scenarios, with proof at the end that someone can do the job at hand. That is the whole ask.
A score you can game counts for little. A payments-firm engineer liked that with hands-on content "you can't really just skip through the training," the way her developers would "just turn on the content and not click through" a passive one. Certifications go only so far: one broker's security chief noted a cert shows "a certain professional level at a given period of time," and then "you're not tested on that again for another three years." They want current, demonstrated capability. A professional services firm needed to "prove they can use their skills in their day to day work," and a credit union ran its engineers through hands-on training because they "lacked confidence in their ability to respond" on the on-call rota.
Building the business case
Finance buyers rarely buy on instinct; someone upstairs wants a defensible reason, and these leaders are fluent in giving one. Proving continuous, hands-on practice to the board, one broker's security leader told us is "easier to justify... than trying to come in and say, I want all of my teams to take certified ethical hacker," and "more cost effective" on top of that. He calls the data it produces cumulative, and a board-friendly record of improvement: "I made choices based on data... my conscience is clear."
External scrutiny does half the selling. In a world where cyber is "always seen very much as a cost base and never a cost saver," evidence that moves is rare. One of our clients tied it directly to the balance sheet: after an insurer reviewed his processes, the team won a "highly recommended" rating and a 35% cut in its cyber insurance premium.
For others the case is onboarding speed. The same firm said making new hires productive fast "was the business case to leadership," and it had to "showcase the impact to our internal leadership and also member firms," proving its people were "evaluated by standards and skilled at the platforms." The money is there: 81% of mid-market financial-services firms plan to raise their cyber budget this year, they just need a solid case for why training is the right investment to yield measurable readiness.
Reshaping hiring and retention
Once a team trusts hands-on work to measure capability, it starts using it everywhere. In hiring, finance leaders are moving off the résumé and onto demonstrated skill. "Give me attitude, I can teach you knowledge," one broker's SOC manager told us, naming his best-ever hire as someone who joined at seventeen with no A-levels. At a global bank, analysts said the platform was "instrumental in them getting the job," and the team now puts hands-on work straight into interviews.
It shows up in retention as well. The same bank runs threat-hunting simulations so analysts can cross-train and move around the business, calling it "one of the main reasons we have really good retention across our global team." A broker's SOC manager, asked about churn: "we haven't lost anybody in three and a half years." In a field with a chronic talent shortage, and complex and costly onboarding, that is a competitive edge.
There's also indisputable value in keeping good people engaged. An insurer's analyst described the weeks when internal work alone could not feed the team's appetite to dig in: "there's a genuine interest to investigate and learn... and there isn't necessarily always a path to feed that passion." In our own research, 66% of security professionals have considered leaving a job over a lack of training and growth. Give capable people something real to work on, and they stay.
None of this surprises us. TryHackMe was built on a simple belief: people learn security by doing it, on content that keeps pace with real threats, where they can break things safely and be pushed hard. For a finance team, that maps directly onto risk management. The point of a simulated incident is that your analysts make their mistakes in the lab, against a realistic attack, rather than against a real one. When shortcomings in readiness are reflected in regulatory action and lost customer trust, practice under pressure moves beyond 'training' and becomes an important business lever.
Financial services has been underserved, but we see that it's neither complacent nor accepting of this reality. The teams we meet are not waiting for the old vendors to catch up. They see clearly that stale content and rigid training modalities won't help them protect their organisations, and they're voting with their budgets.
Interested to see how your team can build cyber capability? Explore TryHackMe for Financial Services.
Joanna Duffy
