Building Incident Response readiness in Financial Services
From Qilin to Famous Chollima, and the unexpected.
Thu 3 Dec 2026 · 17:00-18:00 CET · Guest Speaker: Steve Harris, Sr. Director Global SOC, SS&C Technologies
The groups targeting banks and insurers are evolving. Make sure your teams can keep pace.
THE CHALLENGE
The next attack won’t look like the last one
Financial services is one of the most heavily targeted sectors there is, drawing everything from ransomware groups to nation-state actors.
Qilin has been one of the most active ransomware groups in the world since 2025 with a new victim named roughly every six hours. The group claimed to have stolen more than 2.5 terabytes of data from an international private bank.
North Korean groups stole a record $2.02 billion in digital assets in 2025. One of them, Famous Chollima, plants operatives inside banks and fintechs. In October 2026, the FBI named another, TraderTraitor, as the group behind the theft of about $6.3 billion from the crypto exchange Binance. All of them have targeted financial services for years and are still active. They also keep evolving. The threat actor landscape is never static, with cyber extortion and data-theft group n0n and ransomware-as-a-service group TheGentlemen making recent headlines for high profile attacks against the financial services sector. As threat actors proliferate, preparing for one name doesn't work, but practising the response does.
That’s why it’s essential for security teams in the sector to continuously stress-test their incident response, finding and addressing operational gaps and pairing adversary fluency with the instincts and muscle memory to respond as tactics change. Prevention will fail at some point, but with the right capabilities, teams can disrupt attacks, reducing the blast radius and minimising the damage.
BUILDING SUSTAINABLE READINESS
Testing your response more often, with less setup
Most banks and insurers already run red-team exercises, but each is a heavy lift to scope and resource. That overhead makes runways long and repeatability difficult. One or two big exercises a year isn’t enough to prepare for modern threats.
In this webinar, we’ll look at how to build readiness beyond one-off exercises, through realistic, repeatable drills that test team coordination and the full arc of response, with the performance data to make IR a measurable discipline.
WHAT YOU’LL TAKE AWAY
In this session, you’ll learn how to:
See where the threat is heading: what Qilin, Famous Chollima and emerging threat actors reveal about how financial-services TTPs are shifting, and why static playbooks fall behind
Pressure-test your readiness: find the gaps in your incident-response process and your team’s instincts before a real incident does
Build muscle memory: use realistic, repeatable drills to rehearse response, more than once a year
Make readiness measurable: take a consistent, data-driven approach so you can track improvement and prove it
Stay adaptable: develop the capability to respond whether the attack is familiar or not
WHO SHOULD ATTEND
This session is for security teams at banks, insurers, and financial institutions, including:
SOC leaders, SOC teams, and incident-response leads, practitioners, and analysts
CISOs and security leaders
Teams responsible for security training and readiness
P.S Can't join at this time? Sign up anyways and we'll send you the recording post-event.