Most security isn’t designed. It accumulates.
Why resilience has to be built as an operating model, not bought as a collection of tools — and what one regulated financial services firm learned when it looked honestly at its own defences.
Sensitive client and financial data. Staff working from anywhere. And no secure way for them to connect to it.
That was the reality for one regulated financial services firm we worked with — and it is far more common than most boards would like to believe.
Ask most leadership teams whether they are secure and the answer is usually some version of “we have the basics in place.” Firewalls, antivirus, a backup routine, maybe multi-factor authentication. Each was a sensible decision at the time it was made.
The problem is that those decisions were made at different times, by different people, in response to different threats. Over years, security controls evolve organically. They rarely get stepped back from and judged as a whole. And the threat landscape they were meant to answer has quietly moved on.
We recently worked with a regulated financial services organisation in exactly this position. Nothing was obviously broken. But a structured assessment showed a security posture that no longer reflected how the business actually operated — or how it would actually be attacked.
The perimeter moved. The controls didn’t.
The most telling finding was the simplest: staff routinely needed to reach company systems from outside the office, yet there was no modern, secure remote access framework in place. Hybrid working had become normal. The security model hadn’t caught up.
That single gap carries a lot of risk — unsecured connections, unverified devices, weak assurance that the person signing in is who they claim to be. It also points to a wider truth. When people work from anywhere, the office network is no longer the boundary that matters. Identity is.
Every gap we found was a symptom. The underlying issue was the absence of a framework that connected them.
Six gaps, one root cause
Alongside remote access, the assessment surfaced five further risks. Few will surprise anyone who works in this space — which is precisely the point. They are common because they are what accumulated security tends to leave behind.
Email remained the primary attack surface, leaving room for phishing, credential theft and business email compromise.
Identity had become the new perimeter, with little visibility of suspicious sign-ins or compromised accounts.
Backup and recovery existed, but no one could say with confidence how quickly critical systems would come back after ransomware.
Sensitive client data needed far greater control to prevent loss, unauthorised access and accidental disclosure.
Threat visibility was limited — without continuous monitoring, an intruder could go unnoticed for weeks.
The instinctive response is to buy a product for each line on that list. It is also the response that created the problem in the first place. More disconnected tools would simply have produced a more expensive version of the same posture.
From tools to an operating model
Instead, the work was organised around three principles. They form the basis of how we approach cyber resilience at FutureRange, and we think they apply well beyond this one organisation.
Protectreduce exposure
Close the gaps that matter most: secure remote access, identity protection, email, endpoints, data and backup. The goal is not perfection; it is to make a successful attack far less likely and recovery far more certain.
Empowermake security owned
Technology alone does not create security. Leadership needs clear visibility of risk, named ownership, and an incident response plan people have actually rehearsed — so decisions are made with confidence, not under pressure.
Evolvenever finish
Cybersecurity is not a one-time project. Controls are reviewed regularly, risks are monitored as they change, and governance matures alongside the business rather than lagging behind it.
What changed
The most important shift wasn’t a technical one. The organisation moved from a reactive security posture to a resilience-focused operating model. Staff can now work securely from anywhere. Leadership can recover from an incident with confidence rather than hope. Threats are detected and dealt with before they become business events.
And for a regulated firm, perhaps most valuable of all: the board can now explain its cyber risk in business terms, and connect every security investment to an outcome it cares about.
- Was our current security posture designed, or did it accumulate?
- If we lost our core systems tomorrow, how long — honestly — would it take to restore them?
- Can we explain our cyber risk to the board in business terms, not technical ones?
If any of those are hard to answer, you are not alone — and it is a far better moment to find out than the morning after an incident.
