Risk Scenarios

Customer data breach

Unauthorized access to customer PII results in regulatory penalties and reputational damage.

Change management failure

Unauthorized or poorly tested changes cause production incidents on critical platforms.

Facility physical security lapse

Unauthorized physical access to secure areas compromises equipment or data.

Privileged access misuse

Excessive or orphaned privileged accounts enable unauthorized changes to critical systems.

Cloud misconfiguration exposure

Misconfigured cloud storage or network rules expose internal data to the internet.

Mobile channel account takeover

Weak device binding or session controls allow account takeover in the mobile channel.

Payment processing error

Manual intervention in payment runs introduces duplicate or misdirected settlements.

Wire fraud via social engineering

Fraudulent wire instructions bypass callback verification through staff social engineering.

AML monitoring coverage gap

Monitoring scenarios fail to cover new products or channels, missing suspicious activity.

Critical vendor failure

A critical outsourced servicer fails operationally, interrupting customer-facing obligations.

End-user computing sprawl

Critical calculations live in unmanaged spreadsheets outside system controls.

Vendor concentration risk

Multiple critical services depend on a single vendor, amplifying failure impact.

Ungoverned generative AI output

GenAI assistant produces inaccurate policy guidance that staff act upon without review.

Credit model fairness exposure

Automated underwriting produces disparate outcomes without adequate fairness testing.

AI copilot data leakage

Staff paste confidential data into AI tools that retain or expose the content.