By Roberto Marzocca, Head of Cybersecurity at Kirey
For some time now, there has been a growing awareness that cybersecurity can no longer be understood simply as the ability to secure a perimeter. After all, that perimeter no longer exists in the form we once knew it. Today, it encompasses cloud environments, applications, APIs, legacy components, human and machine identities, vendors, partners, and supply chains. It is a much broader and more interconnected ecosystem, in which risk rarely resides in a single, isolated element.
Meanwhile, cyberattacks are becoming increasingly sophisticated. Not so much because AI can invent entirely new threats, but because it is making many of the activities underlying a cyberattack faster, more scalable and more accessible: from information gathering to the creation of more convincing phishing campaigns, and even the identification of weaknesses in infrastructure and applications. Risk is therefore taking on a new dimension: the ability to operate in an environment where the attack cycle can be faster than many traditional detection, assessment and response processes. As a result, the time between the emergence of a vulnerability and the moment it can be identified, accessed and exploited is shrinking.
For the banking sector, this is not merely a technical detail. Every exposure window can put sensitive data, essential processes and customer-facing services at risk, ultimately threatening the trust that underpins relationships with the market. In an environment where operational continuity and compliance are fundamental requirements, banking cybersecurity is increasingly becoming a matter of response speed as well as protection. One of the fundamental questions that cybersecurity must address is changing: the focus is no longer on how many vulnerabilities have been detected, but on which of them could actually become an entry point into the most critical processes.
CTEM: an approach to continuously managing exposure
Not all weaknesses are equal: the priority is to identify those that can have a real impact on the business. To do so, however, organisations need the ability to continuously assess their exposure. In cybersecurity, Continuous Threat Exposure Management (CTEM) is emerging as a structured approach to identifying, assessing, and reducing exposure based on actual risk. It is not the same as traditional vulnerability management, nor can it be addressed simply by purchasing a new platform. Rather, it requires the integration of technologies, processes, responsibilities and business context into a methodology that makes it possible to focus resources and attention on the exposures that could compromise the most critical assets.
In other words, CTEM provides a framework for moving from a reactive approach to security signals to prioritisation based on actual risk. Its value lies in the continuity of the process, which can be summarised in five stages:
- Scoping: defining the scope of the analysis, from critical assets to data, cloud environments, identities, applications and third parties.
- Discovery: identifying vulnerabilities, misconfigurations, external exposures and risks associated with identities and access.
- Prioritization: ranking exposures according to their exploitability, potential impact and criticality to the business.
- Validation: verifying whether a scenario can actually be exploited, including through simulations and attack validation techniques.
- Mobilization: activating remediation activities, workflows and responsibilities, monitoring KPIs and driving continuous improvement mechanisms.
The specific challenges of banking: correlating technology, identities and critical processes
In the banking sector, complexity increases because exposure cannot be assessed solely in infrastructural terms. It is necessary to consider critical assets and applications, identities and privileges, configurations, cloud connections, APIs, suppliers and signals from threat intelligence. Above all, these elements must be linked to the processes that underpin a bank's operations, service continuity and customer protection.
Identities, in particular, represent a crucial point of observation. Users, administrative accounts, technical accounts, applications and suppliers can all serve as entry points to systems and data. Understanding who can access what, with which privileges and through which trust relationships has become just as essential as monitoring a network or applying a patch. In this context, artificial intelligence can be a valuable resource, supporting security teams in correlating large volumes of signals, identifying anomalies, prioritising exposures and orchestrating verification and response activities. In other words, it can help turn fragmented information into more timely decisions.
However, the use of AI systems and agents must not translate into indiscriminate delegation. In banking, any form of autonomy must operate within clearly defined boundaries: which data can be processed, which tools can be used, which actions can be initiated automatically and when human approval is required. Decision traceability, privilege management, role separation and escalation mechanisms are essential conditions for ensuring that greater speed does not come at the expense of control and accountability.
AI and cybersecurity: autonomy is only useful if it remains governable
The regulatory framework is also driving change in this direction. DORA, the AI Act and other applicable requirements do not simply call for additional controls; they also require organisations to strengthen and demonstrate the robustness of their processes, responsibilities, third-party management and response capabilities. Yet the growing regulatory focus on operational resilience, third parties, data and AI can also provide an opportunity to establish a common language across cybersecurity, risk, compliance, IT and business teams.
From this perspective, exposure management becomes a cross-functional capability that makes it possible to clarify priorities, assign responsibilities and document the actions taken in concrete terms.
In banking, the key cybersecurity metric will therefore not be the number of alerts handled, or vulnerabilities closed, but the time required to identify the most significant exposures, assess their exploitability and take action. Cyber resilience will increasingly depend on the ability to close the exposure window before it can be exploited. AI can help shorten that window by accelerating analysis and response, provided that its use ensures decision traceability, access management, visibility into impacts and clear accountability.
