Point-in-Time Is Running Out of Time: Why FSI Security Is Moving to Continuous Assurance

In 2024–25, the Australian Signals Directorate (ASD) recorded more than 120 incidents involving attacks on edge devices. 96% were successful.

That number should give pause to anyone who has signed off a risk as “accepted”: the open-source backlog in a platform too critical to touch, the supplier last reviewed a year ago, the audit opinion that describes a single moment but is relied on for twelve months.

The challenge is not that these decisions were wrong. It is that the environment around them is changing faster.

Vulnerabilities are emerging at greater speed, technology estates are becoming more interconnected, and third-party dependencies are harder to isolate. For financial services organisations operating under increasing regulatory scrutiny, assurance can no longer be treated as an event. It needs to become an ongoing discipline.

Tolerance is a decision, not a default

Few institutions can claim a clean open-source backlog. Core payments, policy administration and member platforms often depend on components that cannot simply be replaced overnight. Upgrading them may require a programme of work, a change window and a level of operational risk the business is unwilling to accept.

So the backlog is triaged, documented and carried in the risk register. That is a sound decision when it is made, but it rests on assumptions about how hard a vulnerability is to find, how quickly it can be exploited and who is looking for it. When those assumptions shift, the decision needs to be revisited rather than renewed by default.

The risk can move faster than the review cycle

ASD's Annual Cyber Threat Report 2024–25 reported a 28% increase in publicly reported vulnerabilities. It also noted that state-sponsored actors such as APT40 can exploit vulnerabilities within hours or days of a proof of concept becoming available.

AI adds another dimension to that acceleration. ASD assesses that artificial intelligence is almost certainly enabling malicious actors to operate at greater scale and speed.

For security teams, the implication is not that every vulnerability suddenly becomes critical. It is that the window for understanding which vulnerabilities matter — and why — is becoming shorter, and that changes the nature of an accepted-risk decision.

A tolerance established when exploitation might take months cannot simply be carried forward when the conditions around it have changed. The backlog becomes less of a static list and more of a live exposure that needs to be continually assessed.

The same technologies can work in the defender’s favour. AI-assisted analysis can help security teams identify what is genuinely exploitable, prioritise remediation and accelerate the work required to reduce exposure. The advantage will go to whichever side applies those capabilities to a given estate first.

Your vendor review may already be out of date

Third-party exposure presents a similar challenge. APRA's CPS 234 assessments identified limited assessment of third-party information security capability among the recurring control gaps found across regulated entities. APRA has also made clear that regulated entities remain responsible for understanding the security capability of third parties whose services support their operations.

CPS 230 has raised the operational-risk expectations around material service providers, including ongoing management of service-provider arrangements, concentration risk and the risks associated with fourth parties. Against that standard, an annual questionnaire is a limited form of assurance.

For banks, insurers and superannuation funds relying on a relatively small number of major cloud platforms, core technology providers and SaaS services, a supplier passing its last review says little. What matters is whether the organisation can see when the risk profile of that relationship changes.

A supplier may change its infrastructure, subcontractors, ownership, technology stack or control environment long before the next scheduled review. The evidence therefore needs to move with the risk.

Board reporting that moves with the risk

Most boards receive regular cyber reporting. Much of it still measures activity: controls implemented, training completed, audit findings closed.

Those measures have value, but they do not tell a board whether exposure is within tolerance, or how quickly the organisation would know if that changed.

Continuous assurance provides a different evidence base. In practice, that means three things:

• Live visibility of the estate. Understanding what is running, where it came from, what it depends on and where exploitable exposure exists — rather than rebuilding the picture for each audit.

• Evidence generated through delivery. Capturing integrity, provenance and control evidence through development and deployment processes, so assurance exists as part of the operating model rather than being reconstructed afterwards.
  

• A shared evidence base across the three lines. Security, risk and internal audit working from consistent information, rather than repeatedly testing the same controls at different points in time.

This makes assurance more useful because it can be connected to outcomes and tolerances. Boards can ask how quickly exploitable vulnerabilities in critical operations are being remediated, whether material supplier exposure is changing, how much of the technology estate can be traced to trusted components, and how quickly a significant change in third-party risk would be identified. Those are measures of exposure, not measures of activity.

From annual assurance to continuous confidence

None of this requires financial institutions to replace every legacy platform or force disruptive upgrades onto critical applications. The practical path is to reduce risk around them: strengthen vulnerable components, govern open-source intake, improve visibility across technology dependencies and treat supplier oversight as an ongoing process.

The bigger shift is in how assurance is treated. It cannot remain something that happens once a year and produces a point-in-time statement about an environment that continues to change.

Accepted risk stays acceptable only while someone keeps checking it.

Join us to explore this further at CISO FSI ANZ Online on 1 December 2026. Security and risk leaders from organisations including AIA Australia, NAB, Commonwealth Superannuation Corporation, NGM Group, TSB Bank New Zealand, HUB24 and Northern Trust will examine what cyber governance boards can trust and what continuous assurance looks like in practice.