Cyber Security Regulations Are Breaking the Bank for UK Financial Service Organisations

Rhea-AI Summary

Rubrik's new research reveals significant financial and operational impacts of cybersecurity regulations on UK financial services. Nearly half (47%) of UK financial organizations spent over €1 million in the past two years implementing regulations like DORA and PRA, while 28% spent between €501,000-€1,000,000.

The study highlights that ransomware remains the primary threat (46%) to financial organizations, followed by third-party compromise (20%) and software supply chain issues (19%). Notably, 79% of CISOs report mental health impacts from these challenges, and 77% feel their IT budget doesn't align with board objectives for meeting regulatory requirements.

The European Digital Operational Resilience Act (DORA), effective from January 17th, 2025, will introduce an enforced universal framework focusing on ICT risk management. Despite implementation challenges, 73% of UK CISOs express confidence in cloud security for sensitive data.

Positive

• 73% of UK CISOs confident in cloud security for sensitive data
• Implementation of new regulatory framework (DORA) to enhance cybersecurity standards

Negative

• 47% of UK financial firms spent over €1M on regulatory compliance in past two years
• 77% of CISOs report IT budget misalignment with board objectives
• 79% of professionals report mental health impacts from cybersecurity challenges
• Ransomware remains primary threat (46%) to financial organizations

Insights

Financial Regulatory Analyst

The implementation costs of DORA and PRA regulations reveal a significant financial burden on UK financial institutions, with €1 million+ spending by 47% of organizations. This represents a substantial operational expense that could impact profitability and shareholder value. The regulatory compliance landscape is becoming increasingly complex and expensive, potentially creating barriers to entry for smaller financial institutions and favoring larger, well-capitalized firms.

The disconnect between board-level funding and regulatory requirements (77% of CISOs report inadequate budgets) suggests potential compliance risks and future capital allocation challenges. This misalignment could lead to increased regulatory scrutiny and possible FCA fines, affecting stock performance and investor confidence. The mandatory provisions for digital resilience testing and third-party risk management will likely drive additional technology investments throughout 2025.

Cybersecurity Expert

The persistence of ransomware as the top threat (46%) despite substantial regulatory investments indicates a concerning gap between compliance spending and actual security effectiveness. The high proportion of CISOs (73%) confident in cloud security for PII data suggests a positive outlook for cloud-based solutions, potentially benefiting cloud security vendors and service providers.

The emphasis on third-party risks (20%) and software supply chain vulnerabilities (19%) highlights the need for comprehensive security solutions beyond mere compliance. This creates opportunities for integrated security platforms and managed services providers. The high mental health impact on security professionals (79%) could lead to increased turnover and operational risks, potentially affecting organizational stability and security posture.

Market Research Analyst

The research reveals a growing market for regulatory compliance solutions in the financial sector. With nearly half of UK financial institutions spending over €1 million on compliance, this indicates a substantial addressable market for technology vendors and consulting services. The implementation deadline of January 17th, 2025, creates immediate revenue opportunities for companies providing ICT risk management solutions.

The reported mental health impact on CISOs (79%) suggests potential market opportunities for automated compliance tools and managed services that can reduce operational burden. The gap between board objectives and IT budgets (77%) indicates a market education opportunity and potential for growth in board-level cyber risk management solutions.

• Nearly Half (47%) of UK Businesses Reported Spending Over a Million Euros in the last two years.
• Ransomware remains the greatest cyber threat to the UK’s finance and banking sector.
• Costs also deteriorated employee wellness; regulations put enhanced pressure on over half (58%) of UK CISOs.

LONDON--(BUSINESS WIRE)-- Although the European Digital Operational Resilience Act (DORA) and other Prudential Regulation Authority (PRA) measures offer increased resilience to organisations, new research from Rubrik today finds that compliance also comes with significant costs to businesses and their employees.

The report by Rubrik Zero Labs—commissioned by Rubrik (NYSE: RBRK) and conducted by Wakefield Research—finds that nearly half (47%) of financial and banking organisations in the UK reportedly have spent more than one million euros over the last two years on the implementation of regulations such as DORA and PRA, with over a quarter (28%) reporting spending between €501,000-€1,000,000. Despite implementation efforts, threats still loom, with ransomware remaining the greatest threat (46%) to financial organisations. One in five (20%) CISOs cited third-party compromise and 19% citing software supply chains as posing significant threats to security.

Equally concerning is the fact that 79% of these professionals report that it has had an impact on their mental health, highlighting the need for a more empathetic approach to these challenges.

Taking effect from January 17th 2025, DORA will introduce an enforced universal framework, including a focus on Information and Communication Technology (ICT) risk management. This framework could transform the financial services and banking sector, given it typically holds some of the most sensitive data across all markets, and data.

“Given the increasing threat of ransomware and third-party compromise, the implementation of regulations is required and expensive. Understanding what data is the most critical, where that data lives, who has access to it, is essential to identifying, assessing, and mitigating ICT risks. If good hygiene practices like these are not followed, organisations can now receive fines from the Financial Conduct Authority (FCA),” said James Hughes, VP of Solutions Engineering and Enterprise CTO at Rubrik.

There also appears to be a major disconnect with the rest of the C-suite when it comes to prioritising cyber resilience, as over three-quarters (77%) of UK CISOs feel that their IT budget is not completely reflected by their board’s objectives to meet regulatory requirements.

“There is a critical gap between board-level understanding and reality. While regulators are increasingly stringent, many CISOs feel their budgets don't adequately reflect the board's commitment to compliance. This disconnect jeopardises not only organisations' security posture but also their ability to meet evolving regulatory demands,” added Hughes.

DORA mandates key provisions such as contractual safeguards and contingency plans to minimise dependencies and are in place to mitigate risks from partners. To ensure best practices regarding operational resilience, regular testing of digital resilience and attack simulations, as directed by DORA, will feed into cyber resilience plans and reassure CISOs.

Despite this, UK CISOs have more confidence in the cloud than their European counterparts with nearly three-quarters (73%) of UK CISOs feeling that their client, customer, partner and employee PII is secure in cloud environments.

CISOs, boards, and other stakeholders must work together to ensure that cyber resilience priorities are clearly defined, adequately funded, and effectively implemented to meet the evolving regulatory landscape and safeguard the industry’s future.

To find out more on EU data regulations, tune in to CISO conversations hosted on Rubrik’s YouTube channel.

Report Methodology

This research report was commissioned by Rubrik and conducted by Wakefield Research among 350 CISOs working at companies with a minimum of 500 employees, in the finance and banking sectors, excluding holding companies. Respondents comprised five markets: UK, Germany, France, Italy, The Netherlands, between November 21 and December 3, 2024.

About Rubrik

Rubrik (NYSE: RBRK) is on a mission to secure the world’s data. With Zero Trust Data Security™, we help organizations achieve business resilience against cyberattacks, malicious insiders, and operational disruptions. Rubrik Security Cloud, powered by machine learning, secures data across enterprise, cloud, and SaaS applications. We help organizations uphold data integrity, deliver data availability that withstands adverse conditions, continuously monitor data risks and threats, and restore businesses with their data when infrastructure is attacked.

For more information please visit www.rubrik.com and follow @rubrikInc on X (formerly Twitter) and Rubrik on LinkedIn.

View source version on businesswire.com: https://www.businesswire.com/news/home/20250116491449/en/

Media Contact:

Graham Day

Graham.Day@rubrik.com

Source: Rubrik

FAQ

How much are UK financial firms spending on cybersecurity regulations compliance?

Nearly half (47%) of UK financial firms spent over €1 million in the past two years on regulatory compliance, while 28% spent between €501,000-€1,000,000.

What are the main cybersecurity threats facing UK financial organizations according to Rubrik (RBRK)?

According to Rubrik's research, ransomware is the greatest threat (46%), followed by third-party compromise (20%) and software supply chain issues (19%).

When will DORA regulations take effect for RBRK and other financial organizations?

The European Digital Operational Resilience Act (DORA) will take effect from January 17th, 2025.

What percentage of UK CISOs report budget misalignment with regulatory requirements?

77% of UK CISOs feel their IT budget is not completely reflected by their board's objectives to meet regulatory requirements.

How do UK CISOs view cloud security compared to European counterparts?

73% of UK CISOs feel confident about their client, customer, partner and employee PII security in cloud environments, showing higher confidence than their European counterparts.