Open Ledger — Financial Services Sector Cyber Exposure & Supply Chain Intelligence
Based on ThingsRecon scans of 5 financial services organisations across the Netherlands, Belgium, UK & Luxembourg
Why financial services attack surfaces carry unique systemic risk
Financial institutions are custodians of trust. Banks, insurers, wealth managers, fund administrators, and professional services firms handle client assets, personal financial data, and highly sensitive transaction records. Their external digital estate — every subdomain, API endpoint, third-party script, and cloud-hosted portal visible from the public internet — is a primary target for attackers seeking financial gain, data theft, or reputational damage.
The complexity of modern financial services infrastructure makes this attack surface difficult to control. Wealth platforms integrate with custody banks and data providers. Fund administrators operate portals spanning dozens of fund structures. Insurance platforms connect to claims processors, actuarial tools, and partner networks. Each integration point, hosted application, and third-party library extends the external footprint — often without the security team's knowledge.
This report draws on simultaneous scans of five financial services organisations across the Netherlands, Belgium, United Kingdom, and Luxembourg — spanning an ethical bank, an insurance group, a wealth management platform, a global fund administrator, and a professional accounting firm. The findings reveal a sector where email authentication failures expose client-facing domains to impersonation, where software supply chain risks are universal, and where seven technology suppliers are embedded in every organisation's external estate. One organisation stands out with a B rating — demonstrating that strong external security posture is achievable in this sector.
All organisations in this report are anonymised. Technology suppliers and infrastructure providers are named as they appear on the external attack surface.
How do financial services organisations compare?
ThingsRecon scanned five financial services organisations simultaneously — from a Dutch ethical bank to a Luxembourg-based global fund administrator. Four of five received an overall score of C; one achieved a standout score of B. The sector's most alarming single indicators are Email F ratings at two organisations — one a UK wealth management platform, one a global fund administrator — meaning the domains of these financial firms can be impersonated to send spoofed emails to clients and counterparties. Additionally, one insurance group carries both a Header F and Software F rating, indicating the most severe category-level exposure in the benchmark.
Structural vulnerabilities across the financial services digital estate
The patterns below appear consistently across financial services organisations regardless of sub-sector, size, or geography. They reflect the accumulated digital complexity of organisations that have layered new client-facing platforms on top of legacy infrastructure — creating an external surface that grows faster than security teams can track.
Discovery. Prioritisation. Monitoring.
Financial services organisations manage external estates that span client portals, regulatory reporting interfaces, partner APIs, custody integrations, and mobile banking applications — all growing continuously and all holding or transmitting client financial data. ThingsRecon maps every publicly visible asset and supplier connection from a single seed domain, with no agents required and no access to internal systems.
Continuous Discovery
Financial digital estates expand with every new product launch, acquired entity, or partner integration. ThingsRecon discovers every subdomain, cloud-hosted service, third-party script, and certificate — including email authentication configuration — continuously. Email F ratings, dangling DNS records, and unmanaged legacy portals are identified the moment they appear on the external surface.
Risk Prioritisation
With 120 Fix Now items across five organisations, financial security teams cannot address everything simultaneously. ThingsRecon scores every finding by exploitability and proximity to client-facing assets — enabling teams to remediate Email F domains, patch vulnerable client portal libraries, and fix application-level weaknesses before lower-priority hygiene issues consume security capacity.
Supply Chain Monitoring
Seven technology suppliers appear in every financial services organisation scanned. ThingsRecon monitors every supplier connection for changes — new scripts, CDN routing changes, certificate rotations, unexpected subdomain appearances — the moment they occur on the external surface, before they become ICT incidents requiring notification under DORA or FCA operational resilience expectations.
The suppliers inside every financial services digital estate
ThingsRecon maps the technical supply chain — every third-party component detected on the external attack surface via scripts, certificates, DNS, ASN routing, and HTTP headers. These are the suppliers that standard TPRM questionnaires miss because they were never deliberately onboarded: they arrived embedded in web platforms, analytics tools, CMS themes, and acquired digital estates. In financial services, where client-facing portals carry authenticated sessions, investment positions, and payment data, the risk profile of this invisible supply chain is directly tied to client financial harm.
Microsoft is the most deeply embedded technology supplier across every financial services organisation in this benchmark — present at an average digital proximity of 60%, with a peak of 64% at the sector's best-performing organisation. In practice, this means Azure Active Directory controls identity for every client-facing and internal application, Microsoft 365 handles all staff and client communications, and Azure hosts financial workloads, compliance tooling, and client data platforms. For financial entities, the implication is critical: a misconfigured Entra ID application registration, an overpermissioned OAuth scope, or an undeclared Azure-hosted service creates a path from the public internet to client financial records. Under DORA Article 28, Microsoft qualifies as a critical ICT third-party service provider — requiring documented risk assessment, contractual resilience provisions, and continuous monitoring of the connection. ThingsRecon detects every Microsoft touchpoint on the external estate, maps its proximity to client-facing applications, and monitors for configuration changes that may not trigger internal change management controls.
Aggregated risk signals across all scanned organisations
The following findings reflect patterns observed across all five financial services organisations. Individual organisation-level findings with full asset detail are available through a full ThingsRecon engagement.
- Fix NowEmail domain spoofing exposure (Email F) — Two organisations have no effective DMARC enforcement on their primary email-sending domains. Any attacker can send emails appearing to originate from these financial entities, targeting clients and counterparties with fraudulent communications. Immediate DMARC policy enforcement at reject mode is required.
- Fix NowSoftware F — known-vulnerable libraries on client-facing applications — One insurance group carries an F rating for software risk, with 18 Fix Now software findings indicating known-exploitable component versions present on live web applications. Client authentication portals and claims submission interfaces running vulnerable JavaScript dependencies are directly exposed to CVE-documented exploits.
- Fix NowApplication-level Fix Now findings across the fund administrator estate — The fund administrator carries 48 total Fix Now items including 24 application-level Fix Now findings across 206 web applications. Applications graded D and F within the estate include live investor-facing portals handling fund positions, NAV reporting, and document exchange for institutional clients.
- Fix SoonHTTP Security Header F at insurance group — The insurance group's external estate lacks fundamental browser security controls across 23 online applications. Absence of Content-Security-Policy and HSTS enforcement on authenticated insurance portals exposes policyholders to cross-site scripting, clickjacking, and man-in-the-middle attacks on authenticated sessions carrying personal financial and health data.
- Fix SoonCookie D ratings across three organisations — Poorly configured session cookies appear at three of five financial services organisations, with D-rated cookies detected on authenticated portals. Missing Secure, HttpOnly, and SameSite cookie attributes on client investment portals and account management interfaces expose authenticated sessions to theft and replay attacks without any server compromise required.
- Fix SoonDomain C ratings at wealth platform and fund administrator — Domain risk indicators at both the wealth management platform and the global fund administrator suggest misconfigured or dangling DNS records within complex domain portfolios. Fund administrators and wealth platforms frequently operate large numbers of branded client-access subdomains — unclaimed or misconfigured records within these portfolios create subdomain takeover exposure on exactly the URLs clients trust for portfolio access.
- MonitorSeven universal technology suppliers — undeclared in TPRM registers — Microsoft, Amazon, Cloudflare, Google, GitHub, the OpenJS Foundation, and Meta are each present in all five financial services organisations. Under DORA Article 28, critical ICT third-party service providers require formal risk assessment and contractual resilience provisions. The technical connections detected by ThingsRecon frequently represent undeclared dependencies invisible to standard vendor management processes.
- MonitorNetwork B rating at the fund administrator — One organisation, the Luxembourg fund administrator, is the only entity in this benchmark to receive a non-A network risk rating. A B-rated network profile indicates publicly visible network-level findings — potentially open ports, service banner disclosures, or network-accessible management interfaces — on an estate spanning 65 IP addresses and 407 FQDNs. Given the fund administrator's global institutional client base, network perimeter hygiene requires close monitoring.
- TrackSSL/TLS configuration issues across all five organisations — SSL B ratings appear across all five financial services entities, with Fix Now SSL findings at two. Financial portals that handle client authentication, investment transactions, and document exchange rely on TLS integrity — weak cipher configurations, certificate mismanagement, and outdated TLS versions represent a persistent hygiene risk requiring structured remediation programmes and ongoing monitoring.
Your organisation's external attack surface — mapped in 24 hours
This sector report shows patterns across five anonymised organisations. A full ThingsRecon engagement gives you the complete asset inventory, supplier proximity map, and prioritised remediation backlog for your own estate — with no agents, no network access, and no internal onboarding required.