WhitepaperRansomware Readiness: A Field Playbook for East African Enterprises
The decisions that determine whether a ransomware event is a bad week or an existential one — and which of them have to be made before the encryption starts.
Cybersecurity for
Banks and Financial Institutions
Core banking, payment rails and customer channels, secured to the standard a supervised institution is actually held to — with the evidence your regulator and your board both ask for.
Banking
What Security Means
In Banking
Protecting the money and the trust behind it.
A bank carries an unusual combination of pressures: an attacker motivated by direct financial gain, a customer base that will leave over a single loss of confidence, and a supervisor entitled to ask how you know your controls work. Security that satisfies only one of the three is incomplete.
Our banking work concentrates on the paths money and credentials actually move along — payment initiation and authorisation, core banking interfaces, the vendor connections into both, the privileged access that operations staff hold, and the digital channels customers use. These are where losses originate, and they are also the areas where supervisory questions are most specific.
We work to the expectations set out in the Central Bank of Kenya’s Guidance Note on Cybersecurity for the Banking Sector, alongside the control frameworks your auditors will reference — ISO/IEC 27001:2022, PCI DSS for card environments, and the SWIFT Customer Security Controls Framework where you are connected to the network.
Threat Picture
Where Banking
Actually Gets Hit
Payment fraud through compromised email
Business email compromise remains the most common route to a material loss, and it needs no malware. A phished mailbox, a forwarding rule and a hijacked invoice thread are enough — which is why out-of-band verification of payment-detail changes is a control we test for first.
Third-party and vendor access
Core banking platforms, switch providers, agency-banking aggregators and managed service providers all hold access into your environment. Each is a trust relationship you did not build the controls for, and each is a path we assess independently.
Privileged insider access
Operations and support tooling that combines lookup with adjustment, used by a wide group, logging to a system the same group administers, is the configuration behind most insider cases we investigate. Separating read from write is usually the single highest-value change available.
Ransomware against the banking estate
The institutions that recover without paying are the ones holding a backup copy production credentials cannot delete, with a restore time they have actually measured. Both are verifiable in advance, and both are routinely assumed rather than tested.
Digital channel and card fraud
Mobile and internet banking applications, card-present terminals and ATM estates each present their own abuse paths — business-logic flaws, authorisation gaps between steps, SIM-swap-enabled account takeover and physical tampering among them.
Credential phishing against staff
Multi-factor authentication enabled in policy but bypassable through a legacy protocol, a service account or a conditional-access exclusion left in place "temporarily" is the recurring finding in our assessments of bank identity estates.
How We Engage
Built Around
Your Constraints
The sequence below is what a banking engagement looks like in practice — shaped by what your environment can and cannot tolerate.
Talk to our Banking team01
Scope against the money, not the asset list
We start from how value and instructions move through your institution and work outward to the systems that carry them, rather than testing an inventory top to bottom. It produces a shorter list of findings that matter more.
02
Test the channels and the processes together
Technical testing of core interfaces, digital channels and payment integrations runs alongside assessment of the human processes around them — payment authorisation, vendor onboarding, privileged access approval and customer verification.
03
Produce regulator-ready evidence
Every engagement closes with findings mapped to the control frameworks you report against, so the work feeds your supervisory submissions and internal audit cycle instead of sitting beside them as a separate document.
04
Stay on for the response
Incident response retainers put the commercial arrangement in place before you need it, with named contacts on both sides and an agreed first-hour sequence — so the first call is technical rather than contractual.
Obligations
What You Are
Held To
Each of these is a published instrument you can read. We map findings to them directly, so an assessment feeds your audit and supervisory cycle instead of sitting beside it.
- CBK Guidance Note on Cybersecurity for the Banking Sector
- Sets the Central Bank of Kenya’s expectations for governance, risk assessment, control implementation and incident reporting across supervised institutions. Board-level accountability is explicit.
- Data Protection Act, 2019
- Governs customer personal data end to end — lawful basis, retention, data subject rights and breach notification to the Data Commissioner within seventy-two hours of becoming aware.
- PCI DSS v4.0
- Applies wherever cardholder data is stored, processed or transmitted. Scope reduction through segmentation is usually the cheapest route to compliance, and the one most often left undone.
- SWIFT Customer Security Controls Framework
- Mandatory and advisory controls for institutions on the SWIFT network, with annual attestation. The local SWIFT infrastructure zone is assessed as a separate environment.
- ISO/IEC 27001:2022
- The management-system standard your auditors and larger counterparties will reference. Useful as the structure a banking security programme is organised around.
Services
Where We Start
In Banking
Research
Reading For
Banking Teams
Whitepaper
WhitepaperThe Kenya Data Protection Act: An Engineering Checklist
What the Data Protection Act, 2019 actually asks engineering and security teams to build — translated out of legal language and into controls, logs and retention rules.
Research ReportMobile Money Fraud: Control Patterns That Hold
How fraud actually enters mobile money and agent-banking platforms — social engineering, SIM swap, agent collusion, API abuse — and the control patterns that stand up to each.
Questions
What Banking Clients
Ask First
Yes. Core and payment-adjacent testing is scoped carefully, agreed in writing, and run against non-production environments or inside maintenance windows where production is in scope at all. We define the stop conditions with you before we begin.
Our reports are written to be read by technical teams, internal audit and supervisors, with findings mapped to the relevant framework controls and a remediation plan carrying owners and dates. We also support the follow-up questions a submission generates.
Retainer clients reach an engineer immediately and we begin triage on the same call. Without a retainer we respond as capacity allows, which is why we recommend putting the agreement in place while nothing is happening.
Other Sectors