Cyber threats to the financial sector are increasingly sophisticated and regulated. Fortgale protects banks, insurance, asset managers and fintech with 24·7·365 monitoring, DORA + NIS2 + PSD2 compliance and incident response from the Milan SOC. We already operate across banking, finance and insurance: this sector is a perimeter we defend every day, not a market to explore.
DORA, NIS2 and PSD2 have raised the bar. Sanctions up to 10% of revenue, mandatory CSIRT notifications within 24h, stricter supervisory audits. Financial detection rules are needed, not generic ones.
European SOC 24·7·365 with behavioural detection calibrated on financial actors. UEBA for anomalies on privileged users, wire transfers, clearing access, with ITDR on Active Directory and Entra ID. Triage in <15 min.
50+ specialised threat actors for the sector: APT-Finance, Carbanak, FIN7, Cobalt, banking-focused ransomware, insider groups, financial supply chain. MITRE-mapped IoCs/TTPs applied to the SIEM.
Full audit, gap analysis, remediation roadmap. Support for TIBER-EU, third-party risk, incident reporting to the national CSIRT, ECB, ESMA, national supervisors. Technical evidence for the board report.
Fast triage, specialised intelligence, continuous coverage, full compliance support.
We don't wait for damage. Detection, blocking and containment are activated at every kill-chain transition, from initial phishing to fraudulent wire transfer.
Targeted phishing on privileged operators, credential stuffing on banking apps, VPN/trading-desk account compromise. Detection: CTI IoCs, behavioural analysis, MFA fatigue patterns.
Escalation to administrative accounts via Kerberoasting, service account abuse, AD vulnerability exploitation. Detection: UEBA, privilege anomalies, hidden lateral movement.
Lateral movement to core banking, clearing, payment gateway systems. Detection: micro-segmentation, internal traffic anomalies, C2 beacons on non-standard ports.
Exfiltration of customer data, contracts, trading positions. Fraudulent wire transfers, order-book manipulation, payment API abuse. Detection: DLP, financial-flow anomalies.
Host isolation in seconds, transaction block, account disable, supervisory authority notification. <30 min median containment. Chain-of-custody forensics for authorities.
Four deliverables governed by a single European point of contact: DORA assessment, 24·7 monitoring, incident response from the Milan SOC, recovery & hardening.
Cybersecurity posture audit against DORA (ICT risk, incident reporting, TIBER-EU), NIS2 (24h CSIRT), PSD2 (SCA, liability). Gap analysis with prioritised remediation roadmap and compliance timeline.
European SOC 24·7·365 with behavioural detection calibrated on financial threats. UEBA for anomalies on privileged users, wire transfers, access to clearing systems. Sector-dedicated threat hunting.
Incident Response coordinated from the Milan SOC, containment <30 min. Forensics with chain of custody, support for national CSIRT notification within 24h, communication management with supervisory authorities (ECB, ESMA, national bank regulators). Assisted recovery without halting core banking.
Validation of post-incident transactions, secure system recovery, chain-of-custody audit, hardening of compromised systems, lessons learned, DORA plan update. Reporting for board and supervisory bodies.
On 7 July 2026 the ECB sent the CEOs of significant banks the letter «Addressing AI-enabled cybersecurity threats», asking for an action plan to be submitted to the Joint Supervisory Team by 31 October 2026. That deadline has passed: the next phase is the ECB horizontal analysis and the follow-up by each JST, with the IT Risk Questionnaire moved to February 2027. On 31 July 2026 the ESAs published statement JC 2026 25 on the governance of frontier AI model risks: no new obligation, but consistent supervisory expectations. The ESRB warning of June 2026 rates systemic cyber risk as severe. The legal base does not change: DORA remains the framework, including incident reporting and threat-led penetration testing. For the AI systems the institution itself adopts, see AI Security.
Board ownership of AI and cyber risk, contractual safeguards with ICT providers, an action plan with progress tracking.
Advisory and executive briefings for the board, Trust Center with the contractual evidence of Fortgale as an ICT third-party provider.
Identities and privileges, strong authentication, baseline configurations, segmentation.
ITDR: continuous monitoring of identities, MFA and privileges, with response from the SOC.
Asset inventory, exposed perimeter, services and domains reachable from the internet.
Attack Surface Management: continuous discovery and verification of the exposed surface.
Vulnerability and patch management cycle, with AI where appropriate.
Periodic Vulnerability Assessment and Advisory for remediation priorities.
Continuous detection and response, including traffic towards providers; AI where appropriate.
MDR and SOC 24·7·365 with detection <15 min and containment <30 min, CTI with 287 profiles of actors and tools.
Testing under DORA articles 24 and 25, TLPT where applicable.
Tabletop exercises with the board and control functions, TLPT scenarios with qualified partners.
The evidence we provide is technical: the adequacy assessment and the report to the board remain with the board and the control functions. Third parties are a cross-cutting theme in every area.
Banks, asset managers, insurance, fintech, payment providers and critical financial infrastructure. Different regulatory and technical needs, one European outpost.
Commercial banks, credit institutions. DORA + NIS2 essential entities. TIBER-EU obligation for significant banks (ECB).
Asset managers, pension funds. MiFID II + DORA compliance. Protection of trading systems and position data.
Insurance companies, brokers. DORA entities under national insurance supervisors. Customer-data protection, underwriting systems, claim management.
Payment institutions, e-money issuers. PSD2 + DORA compliance. Payment gateway, wallet, anti-fraud system protection.
Neobanks, lending platforms, robo-advisors. Cloud-native with DORA needs. API security, mobile app, KYC/AML cyber-integrated.
Trading desks, market makers, prop trading. Latency-critical, real-time protection of order books, pricing engines, execution venues.
PE/VC funds, family offices. Protection of data rooms, M&A transactions, confidential deal-flow. Threat intel on APT actors targeting the sector.
Clearing houses, central counterparties (CCPs), credit registries, financial market infrastructure. NIS2 essential entities with reinforced obligations.
The European outpost orchestrating monitoring, triage and response, with an L2/L3 team dedicated to the financial sector.
Discover SOC →EDR/XDR managed by the European SOC to detect and block threats in real time across endpoint, network, identity and cloud.
Discover MDR →Proprietary feeds on the 50+ financial actors active in Europe: APT-Finance, Carbanak, FIN7, Cobalt, banking-focused ransomware.
Discover CTI →DORA + NIS2 + PSD2 assessment, 24·7 monitoring with EDR/SIEM and behavioural detection calibrated on financial threats, proactive threat hunting, incident response coordinated from the Milan SOC, compliance support with national CSIRT notifications within 24 hours, digital forensics with chain of custody, assisted recovery, post-incident hardening. Coverage across endpoint, network, identity, cloud and APIs with proprietary intelligence on 50+ financial threat actors.
DORA is the EU framework for operational resilience: ICT risk management, incident reporting in three steps (initial notification within 4 hours of classification and in any case 24 hours of detection, intermediate 72 hours, final 1 month), TIBER-EU testing, third-party risk. NIS2 is the cyber security directive for essential operators (banks, clearing, markets): 24h CSIRT notification, mandatory audits. PSD2 governs payment service providers with SCA, data protection and liability framework. Fortgale supports compliance across all three frameworks.
We monitor sector-specific threats: wire transfer attacks and clearing houses, credential stuffing on banking and trading apps, payment gateway compromise, ransomware on settlement systems, social engineering against privileged operators, supply chain attacks on financial providers, DDoS, APTs on clearing, insider threats on trading desks. Proprietary intelligence tracks 50+ specialised actors in the sector.
For critical alerts (suspicious wire transfer, credential compromise, ransomware, payment gateway anomaly), the SOC responds in under 15 minutes with active investigation and immediate containment. For incidents requiring forensics or authority support, incident response is coordinated from the Milan SOC, with containment <30 min. Notifications follow DORA (initial notification within 4 hours of classification and in any case 24 hours of detection, intermediate 72 hours, final 1 month), NIS2 (24h to national CSIRT) and supervisory authority obligations.
Yes. We support banks in TIBER-EU audit preparation: threat intelligence alignment with the threat actors monitored by the ECB, detection rules to identify red teams during simulation, controlled APT attack simulations, forensics and technical reporting for the simulated incident timeline, post-test remediation support. The team knows ECB requirements, TIBER-EU standards and testing best practices.
For fintech and PSPs security must cover: real-time trading platforms, digital wallets, payment and settlement APIs, KYC/AML, blockchain/DLT, mobile app security. We offer specific monitoring on API gateway security, payment-flow anomalies, crypto supply chain, wallet compromise, DDoS on payment services. Includes intelligence on threat actors specialised in fintech, DORA compliance support and coordination with national supervisors and ESMA.
We profile PhishSurf Nebula, banking trojans, groups specialised in MFA bypass and BEC: campaigns observed on our European banking & finance clients, phishing infrastructures, attacks against SWIFT/SEPA providers. Intelligence applied to the perimeter we protect.
No exploit. No attachment. No phishing email. In this campaign the threat actor needs the victim to do exactly one thing: copy a command from an installation guide and paste it i…
Read article →
ABSTRACT The FBI recently issued an advisory on Kali365, a Phishing-as-a-Service platform that abuses legitimate Microsoft OAuth flows to bypass multi-factor authentication. Kali…
Read article →
Intelligence · Phishing Kit · Q1 2026 April 24, 2026Fortgale CTI14 min readRPT-26-0424 Observation of the quarter The 2026 phishing ecosystem has outpaced traditional defenses. M…
Read article →
In the high-stakes world of venture capital and corporate funding, where millions hang in the balance and sensitive financial data flows freely, a new breed of cyber threat is em…
Read article →
In February 2026, the Fortgale Incident Response team investigated a multi-stage intrusion attributed to Mora_001, a Russian-origin threat actor exploiting Fortinet vulnerabiliti…
Read article →
UPDATES: 27.11.2024: As mentioned by TrustWave, "Supercar Phishing Kit" has an high level of overlapping with the most recent update of "Rockstar 2FA Phishing-as-a-Service" 26.09…
Read article →An AiTM attack against senior executives during an investment round was intercepted before compromise. No access was gained.
Read the case →In Operation Storming Tide the Fortgale team detected and contained a multi-stage intrusion (actor Mora_001) at a European logistics organisation: data exfiltration and ransomware prevented.
Read the analysis →DORA is in force. NIS2 applies to the financial sector. PSD2 mandates SCA and the liability framework. A 4-week audit maps your posture across the three frameworks, with a roadmap and the technical evidence for the board report. You'll receive the report on your financial segment.
No nurturing sequences, no auto-replies. One of our analysts calls you back within one business day.
The full Report (executive summary · operational IoCs · technical runbook) is restricted. Share two details and one of our analysts contacts you with access and a short technical briefing.
Response in 30 minutes, containment in 1–4 hours. Even if you are not a Fortgale customer.
