‘For fintech companies, sustainable growth depends on embedding cyber resilience into every stage of innovation’

In the burgeoning fintech space, rapid innovation is creating significant opportunities, but also new vulnerabilities. Building cyber resilience through robust risk management is a winning strategy for high-performing organisations.

Leann Moroney, cyber practice lead with Aon Ireland, says the best-performing organisations view resilience not as a barrier to growth, but as an enabler of it.

“For fintech companies, sustainable growth depends on embedding cyber resilience into every stage of innovation,” she says. “As firms scale digital products, adopt emerging technologies and expand their third-party ecosystems, robust risk management helps them understand and quantify exposure, align decisions with risk appetite, and build security and recovery capabilities into services from the outset.”

Cyber attacks have been the top risk facing businesses in Ireland since 2021, according to Aon’s Global Risk Management Survey. Risks are also more connected than ever, Moroney adds. “A single cyber incident can quickly become a business interruption, a regulatory issue, a reputational hit and a financial loss – that calls for a joined-up approach to managing risk.”

Moroney says combining secure-by-design development, effective oversight of critical providers, scenario testing and proportionate risk transfer allows fintechs to pursue growth while protecting customers, capital and trust. This inevitably positions them for long-term success.

“At Aon, we help organisations take a connected view of risk, enabling leaders to make better decisions around technology investment, operational resilience and risk transfer,” she explains. “The most resilient businesses embed risk management into strategic decision making, understand their critical dependencies and develop robust response and recovery capabilities.”

Moroney also points out that risks tend to become more complex as a business grows. “A scaling fintech typically relies more on cloud services, outside suppliers and partners,” she explains. “Every one of those connections is a potential point of exposure, so governance and resilience planning need to keep pace with growth.”

Fintech providers and financial services organisations operate in a highly regulated space – that’s because an outage or breach can quickly affect customers and, in some cases, the wider financial system. Regulations such as DORA and NIS2 are raising the bar, but they are also an opportunity, Moroney believes. “A cyber incident can bring lasting financial and reputational damage long after systems are back up and running,” she says. “But leaders that get resilience right can use it to build trust with customers.”

When it comes to cyber preparedness, Moroney affirms that organisations should focus on getting the fundamentals right. “Strong access controls, multifactor authentication and secure backups remain some of the most effective defences available.”

Yet cybersecurity is not solely a technology issue – people often remain an organisation’s weakest link, with social engineering and phishing attacks among the most common attack vectors. Aon research, Moroney points out, shows that AI-powered attacks are increasing both the frequency and sophistication of these threats.

“That makes investing in staff just as important as investing in technology,” she says. “Regular training and phishing simulations help, but the real goal is a culture where people feel confident spotting and reporting anything suspicious. Every employee has a part to play.” Organisations also need to look beyond their own networks and consider third-party risk, she adds. “Leaders need to know who their organisations depend on, check how resilient those suppliers are and test their contingency plans regularly.”

Experts agree that cyber resilience is no longer confined to the IT department and is now firmly a boardroom issue. “Directors and senior executives face increasing scrutiny from regulators, investors and customers over how cyber risks are governed and managed,” Moroney says.

Aon’s latest Global Cyber Risk Report found that large enterprises suffer an average 9 per cent decline in shareholder value following a major cyber incident. “More importantly, significant cyber events often trigger difficult questions about board oversight, governance and risk management.”

Against this backdrop, directors’ and officers’ (D&O) insurance has become an increasingly important safeguard. “D&O insurance protects directors and officers from personal liability arising from claims alleging failures in governance, oversight or decision making,” says Moroney. “In a cyber context, this can include shareholder actions, regulatory investigations or allegations that reasonable steps were not taken to identify, mitigate or manage known risks.”

While cyber insurance protects the business against incident and recovery costs, Moroney explains, D&O insurance protects the individuals responsible for leading it. “Together, they form a critical part of a modern cyber resilience strategy.”

Find out how Aon can help your organisation strengthen cyber resilience and manage evolving governance risks at aon.com