The resilience gap: why mid-tier financial firms are becoming prime targets

If you want to breach a bank, there are two ways to go about it. You can spend months probing a tier-one institution with a security budget the size of a small country's GDP, or you can find a building society, a challenger bank or a wealth manager holding much the same customer data and moving much the same money, defended by a fraction of the resource. It isn't a difficult choice, and increasingly attackers aren't making it. 

This isn't a story about small firms being careless. Most mid-tier financial institutions know exactly what they're up against and are working hard to keep pace. It's about a gap that's opening up between what's expected of them and what they're realistically resourced to deliver, and why that gap matters to the whole sector, not just the firms sitting in it. 

Same threats, different budgets 

Retail banking's biggest institutions have spent the best part of a decade building out security operations centres, threat intelligence functions and dedicated fraud teams. Mid-tier firms face broadly the same threat landscape without anywhere near the same firepower, while the threats themselves are getting harder to defend against. 

AI-enhanced phishing and social engineering are good examples. These attacks are now sophisticated enough to catch out staff who've been through proper security awareness training, which used to be the reliable first line of defence for firms that couldn't afford much else.  

Ransomware-as-a-service has had a similar levelling effect from the other direction. Criminal groups now rent out sophisticated attack tooling to anyone willing to pay, meaning a would-be attacker no longer needs real technical skill to go after a bank's online services or mobile app, just a subscription and a target. The barrier to attacking a mid-tier firm has dropped considerably faster than the resources most mid-tier firms have to defend themselves. 

The numbers back this up. The World Economic Forum’s Global Cybersecurity Outlook has tracked a widening gap between large and small organisations for three years running.  

• In 2024 it reported that the number of organisations maintaining minimum viable cyber resilience had fallen by 30% in a year, with SMEs showing a significant decline while large firms improved. 
• By 2025, 35% of small organisations rated their own cyber resilience as inadequate, a sevenfold rise since 2022, while the share of large organisations saying the same had nearly halved. 
• The 2026 edition finds 17% of organisations still fall short of minimum requirements, and smaller organisations are twice as likely as large firms to do so. All this while expectations from regulators and customers keep climbing. That’s not a gap that closes itself. 

Regulation doesn't come in a smaller size 

Part of the problem is structural. Operational resilience rules, Consumer Duty and the incoming third-party reporting requirements all apply to firms in proportion to their size and risk profile, but ‘proportionate’ doesn't mean ‘optional’, and it certainly doesn't mean less work in absolute terms. 

A small IT team at a regional building society has to answer largely the same regulatory questions as a bank with a security function ten times the size: what happens if a critical system goes down, how quickly can you recover, what's your exposure through third parties and how do you evidence all of this to a regulator on request. The tier-one bank answers those questions with a dedicated resilience function. The mid-tier firm answers them by pulling someone off business-as-usual work for a fortnight, hoping nothing breaks while their attention is elsewhere. 

This isn't a criticism of the people doing that work, who are often doing an impressive job with limited means. It's a structural mismatch between how regulation scales and how security budgets actually scale, and one that tends to get worse as regulatory expectations continue to grow. 

Why the gap actually exists 

Three things tend to drive it in most of the firms we talk to.  

The first is talent. Experienced security specialists are scarce and expensive, and a tier-one bank with a well-known name and a big pay packet will usually win that competition against a smaller, less visible employer. 

The second is tooling sprawl. It's common for mid-tier firms to end up with an assortment of security products bought at different times for different reasons. Some are barely configured, and few talk to each other properly, because the team never had the headcount to run them as a coherent whole. More tools without more people to run them properly doesn't add resilience, it just adds noise and licence costs. 

The third is legacy technology. Some challenger banks are genuinely cloud-native and benefit from that, but plenty of established mid-tier firms are running core banking systems that are older, and in some cases more fragile, than those you'd find at a large bank that's had the budget to modernise properly. 

Closing the gap without a tier-one budget 

None of this is unsolvable, and mid-tier firms don't need to match tier-one spending to materially close the gap. They need to spend what they have more deliberately. 

• Consolidating onto fewer platforms, properly configured and actually monitored, beats a shelf of underused licences every time.  
• Managed detection and response is worth serious consideration for firms that can't justify building a round-the-clock security operations centre of their own, effectively renting the capability rather than trying to build it from scratch.  
• Leaning on established frameworks – the FCA's own operational resilience guidance, the NCSC's Cyber Assessment Framework and Cyber Essentials Plus – gives smaller teams a sequenced way to prioritise investment, rather than trying to do everything at once and doing none of it particularly well.  
• Resilience testing deserves at least as much attention as prevention, because regulators are increasingly judging firms on how fast they recover from an incident, not just on whether they managed to avoid one. 

The mid-tier firms that close this gap fastest won't be the ones that try to outspend the big banks. They'll be the ones that accept they can't, and focus instead on knowing their own estate, testing it properly, and making every pound of security spend count twice. In a sector where attackers are actively hunting for the path of least resistance, that focus might turn out to be the better defence anyway. 

If you’re interested in finding out more about cyber resilience, contact your Softcat Account Manager or visit our dedicated Cyber security solutions and services page.