Stay ahead of cyber threats in the financial sector

Financial services is the second most expensive sector for breaches, at $5.56M per incident in 2025 (IBM Cost of a Data Breach 2025). Banks, fintech firms and insurance companies hold the combination of credentials, credit files, KYC data and contracts that give attackers the highest immediate payoff. A wide third-party supply chain multiplies the attack surface. Every breach triggers regulatory sanctions (GDPR, DORA, NIS2), operational disruption and reputational damage that is hard to recover from.

EU Regulation 2022/2554 (DORA), in force since January 17, 2025, requires financial institutions to ensure the confidentiality, integrity and availability of critical data across the full ICT lifecycle. Articles 6 and 8 explicitly include AI systems in the ICT risk scope. In practice: encryption at rest and in transit, verifiable access audit trails, documented third-party risk management, periodic resilience testing and protections proportionate to future risk, including the quantum computing threat. For the Bank of Italy's operational guidance, see its December 2024 communication.

stops working the moment a file reaches its destination. File-centric DLP encrypts the document at creation: protection stays with the file regardless of where it goes or how it was transmitted. A bank using FileGrant can revoke access to a document that has already been sent, verify who opened it and from where, and block screenshots and downloads. The file is unusable even if exfiltrated from the network.

FileGrant encrypts every document with AES-256 and CRYSTALS-Kyber post-quantum encryption (NIST FIPS 203, August 2024). Permissions can be revoked retroactively, even on files already delivered. RemoteGrant blocks transfers to unauthorized processes, including copy-paste to public generative AI tools, and secures workstation access from any endpoint. AIGrant keeps AI inside the banking perimeter: employees query sensitive data without exposing it to cloud systems. Every action is logged in an immutable audit trail available for DORA and NIS2 audits.

Quantum-safe encryption uses algorithms designed to resist attacks from quantum computers. CRYSTALS-Kyber, standardized by NIST as FIPS 203 (ML-KEM) in August 2024, is the post-quantum standard CyberGrant has adopted. The immediate risk for banks is harvest now, decrypt later: attackers collect today's encrypted data to decrypt it once quantum computers become commercially viable. For long-lived credit files, multi-year contracts and strategic plans, that vulnerability window is already open. DORA requires protections proportionate to future risk; CRYSTALS-Kyber addresses that requirement.

AIGrant is an on-premise RAG (Retrieval-Augmented Generation) system that lets bank employees query business documents with an AI assistant, without any data leaving the bank's infrastructure. It blocks the primary Shadow AI vector: employees sending confidential documents to ChatGPT, Microsoft Copilot or similar cloud services. Document classification runs entirely within the bank's environment, in line with DORA Articles 6 and 8 on AI within the ICT risk perimeter.

DORA (EU Regulation 2022/2554), from January 17, 2025: encryption, audit trails, ICT resilience and third-party risk management. NIS2 (EU Directive 2022/2555), in force in Italy since October 16, 2024: security measures for essential and important entities, with operational implementation due by October 2026. GDPR (EU Regulation 2016/679): encryption and traceability as adequate measures under Article 32, RBAC, post-sharing revocation for the right to erasure under Article 17. PSD2 and Bank of Italy / ECB regulations on ICT internal controls.