With risks evolving and multiplying, senior leadership and technology experts at financial services firms realize it’s no longer a question of if an attack will happen, but whether their organization will be ready when it does. In making that assessment, many firms are coming to the conclusion that their reliance on legacy technology platforms could be leaving them at risk. Approximately 45% of the more than 500 financial services technology and operations executives participating in Broadridge’s 2025 Digital Transformation & Next-Gen Technology Study say legacy technology and systems are limiting their resiliency strategy.

Firms are planning substantial investments to shore up resulting vulnerabilities. Almost 90% of financial services firms in that study are planning to make moderate to large investments in cybersecurity this year. Now the question becomes: How can organizations spend that money most effectively to enhance cybersecurity and operational resilience? 

Outdated Systems and Data Silos: Risks and Remedies 

Firms looking for security and resilience can achieve some of the highest returns on investment by directing resources to digital transformation efforts that modernize the overall technology stack, in addition to investing in cyber resilience. More than a third of financial services firms still do not have cybersecurity technologies built into their core operational infrastructure. That lack of built-in security often stems from the fact that organizations are running on outdated technology platforms, instead of modern, secure-by-default applications, and have not invested in cyber recovery preparedness or regular penetration testing.

From a security standpoint, firms that find themselves in this situation will have to make both short-term and long-term plans to remedy the issue. In the short term, these firms must invest in cybersecurity technology that can deliver immediate protection. Firms should also ensure they are meeting minimum levels of security and resilience by creating cyber recovery playbooks and conducting regular resilience testing and compliance audits for the Digital Operational Resilience Act (DORA) and other regulations.

These short-term fixes, while necessary, won’t be enough. To truly drive resilience in tandem with transformation, firms need a resilience-first mindset in their technology and operations transformation. That means understanding that organizations will not be able to achieve the level of cybersecurity and operational resilience needed today with outdated legacy systems that keep operational processes and data fragmented across the organization. According to the Broadridge Study, nearly half (47%) of financial services firms are wrestling with the challenge of data “silos.” When critical data is fragmented across disparate systems, business units, or applications, it creates both operational inefficiencies and potential cyber risks. From a cybersecurity perspective, it results in inconsistent access controls, reduced visibility into vulnerabilities and threats, and inconsistent data classification. From a cyber resilience and recovery perspective, it fragments and weakens the ability to respond and recover in real time. These shortcomings are driven by a combination of a fragmented view of the threat landscape across systems, an inability to map the true business impact of cyber incidents, uncertainty regarding data integrity, fragmented incident response playbooks across systems, and weaker resiliency testing.

Transforming outdated platforms, breaking down silos, harmonizing data across systems, and achieving true interoperability — through unified architectures, governance, and controls — enhances cybersecurity defenses, resilience against disruptions, and the ability to recover confidently and quickly when incidents happen. While it is not an easy undertaking, the benefits make the effort more than worthwhile. An unimpeded data flow simultaneously enables both improved business decision-making and operational resilience, while also allowing for the integration of new technologies like AI and machine learning (ML). For that reason, cybersecurity and resilience strategies should be part of broader, long-term digital transformation efforts that modernize technology infrastructure and data management in pursuit of a much wider range of business goals. 

Preparing for an AI-Driven Future

Over the next three to five years, emerging technologies such as AI, ML, Generative AI (GenAI), and Distributed Ledger Technologies (DLT) will transform both operations and data security.  Approximately 80% of financial services firms are investing in AI this year, and 72% are investing in GenAI. These investments will enhance data security by providing advanced analytics and predictive capabilities to identify and mitigate potential threats. Approximately 70% of financial services firms are investing in DLT projects that have the potential to deliver secure and transparent data management solutions, reducing the risk of data breaches and enhancing trust in data transactions. 

Financial services firms will need all these new technologies to protect themselves against threat actors who are themselves adopting every new innovation. For most firms, the first step in unleashing the power of these novel defenses will be modernizing the legacy technology systems that are holding back their digital transformations and could be leaving them at risk. Think of emerging technologies like AI as the new state-of-the-art engine in your Transformation car, and Cybersecurity and Resilience as the brakes. You need reliable brakes to have the confidence to go fast — without it your state-of-the-art engine is of little use. The more conviction firms have in their cyber resilience posture, the faster they will be able experiment, transform and differentiate.