Trending Cyber Security

Cyber Security

Build cyber security that holds up under scrutiny, from regulators, from auditors and from attackers. We work with financial institutions and regulated businesses to turn security from a set of policies into a capability you can evidence.

Talk to an expert

Scott Beange

Head of Data Management

Contact me

The threat landscape facing financial services has changed, and so has what supervisors expect.

Under DORA, NIS2, the FCA and PRA operational resilience regime, CBEST and TIBER-EU, you now have to show not just that controls exist, but that they work as intended. The question has moved from “do we have a policy?” to “does our security posture actually protect us?”

Our cyber security practice works with you across five connected domains: governance, risk assessment, security, threat intelligence and testing. Together they form a complete capability, from strategy through execution to continuous improvement, combining strategic governance, hands-on technical engineering, rigorous adversarial testing and continuous threat awareness. It is the full lifecycle that regulators, auditors and independent assessors expect to see in place.

talk to an expert Get in touch

How we work with you

Effective cyber security starts at the top. We work with you to define and formalise the structures needed to manage cyber risk with clear accountability, from cyber security strategy and policy frameworks to the standards and processes beneath them. We support executive engagement so boards and senior management can make informed decisions, design target operating models that place security at the centre of the business, including CISO organisation design and end-to-end identity and access management (IAM) transformation, from assessment through design to implementation coordination, build training and awareness programmes that create a risk-aware culture, and integrate DevSecOps so development and operations move in step with your security objectives.

Understanding your risk profile is the prerequisite for managing it. Together we identify the assets that need protecting, benchmark your current posture against the NIST CSF 2.0 and CRI Profile, and analyse third-party and supply-chain risk, the exposure that often sits beyond your direct control. We define the controls and key risk indicators that give management a clear view of residual risk, and we support the design and review of your security operations centre as you build or mature detection. Supervisors expect you not only to be compliant, but to demonstrate it clearly and consistently, and a structured risk assessment is the foundation for both.

We support you across the full spectrum of technical security: system integration, cloud security architecture, network design, identity and access management, and privileged access management. We advise on data protection and cryptographic encryption to meet confidentiality requirements under GDPR and sector-specific obligations. And when incidents occur, our incident management support helps you respond quickly, limit the impact and meet regulatory notification requirements.

Knowing what you are up against matters as much as knowing where you stand. Our threat intelligence work includes horizon scanning to keep you ahead of emerging attack vectors and regulatory developments, information sharing through trusted sector networks, and industry engagement to connect you to the intelligence that fits your risk profile. We also draw on our own fraud intelligence capability, giving you direct insight into emerging fraud typologies and financial crime patterns, rather than generic threat feeds.

Policies and controls only matter if they work, and testing turns assurance into evidence. We carry out threat-led penetration testing, vulnerability scanning and network security assessments calibrated to the frameworks you operate under, including DORA’s requirements for digital operational resilience testing. We run tabletop exercises and scenario testing to stress-test your response, assess third-party IT security arrangements, support business continuity planning and advise on alignment with the relevant ISO standards.

Observations and recommendations should not stay confined to a report. They need to become concrete, feasible and testable improvement actions that fit your context and capabilities, and that principle shapes how we work across all five domains. We do not hand over findings and disengage. We stay involved until you have a clear picture of what needs to change, a prioritised roadmap for getting there, and the confidence that your controls will hold up when tested, whether by regulators, by auditors or by attackers.

Why Projective Group

We don’t stop at recommendations. From assessment through target operating model design to implementation, we help you close the gap between what regulators expect and what your organisation can demonstrate, with the confidence that controls will hold up when tested.

We combine deep cyber security expertise with our data, risk and compliance, transformation and payments capabilities, so you get a single team that understands both the technical controls and the regulatory context they sit in. And our threat intelligence is backed by our own fraud intelligence capability, giving you insight into real fraud typologies, not just generic threat feeds.

20+ years supporting financial institutions with cyber and operational resilience programmes
200+ client engagements delivered across cyber security and operational resilience
End-to-end Cyber Security Training design, covering controls, risk and the business across a three-lines-of-defence model, from broad staff-wide training to bespoke e-learning module development

Ready to strengthen your cyber security posture?

Speak to one of our experts today

Talk to an expert

Insights

Why vulnerability management is now a board-level operational resilience issue

This article looks at why supervisors and directors now expect vulnerabilities to be found, prioritised and fixed as a matter of governance, not just good housekeeping. Read it to see what that shift means for how your organisation manages, and evidences, its security posture.