Banks expand cyber defenses with penetration tests, team drills

Asia outpaces other regions in cybersecurity leaders reporting to CEOs.

Banks have increased spending in cybersecurity, with the proportion appointing chief information security officers (CISOs) rising to over 7 in 10 of banks surveyed by Moody’s Ratings.

Of 228 banks globally, 71% have appointed CISOs in 2025, compared to 68% two years earlier, the ratings agency found.

In Asia, nearly 2 in 5 or 37% of cybersecurity leaders report directly to CEOs or CFOs— a “significantly larger proportion than other regions,” Moody’s said.

Adoption of advanced cyber defense strategies, as Moody’s called it, is also more widespread amongst banks than the average for all sectors.

Banks make use of three key advanced defense practices: penetration tests that simulate real-world attacks to identify exploitable vulnerabilities in systems and applications, with 55% of survey respondents performing them at least quarterly.

Tabletop simulations are also popular. These structured, discussion-based exercises— designed to guide teams through hypothetical cyberattack scenarios to test their response coordination— are being done by 42% of large banks globally.

Red/purple team engagements are another strategy, involving adversarial simulations that test both offensive and defensive capabilities in real-time. This is done by 3 in 5 (64%) of large banks, and 4% of North American banks.