| No SIEM platform |
Critical |
No centralised log visibility across payment systems, cloud apps, or endpoints. Financial fraud and unauthorised transactions can go undetected for weeks. |
Blusapphire SIEM & SOC (Phase 2) |
Missing |
| No 24/7 SOC / MDR |
Critical |
Payment fraud and account takeover attacks peak outside business hours. No coverage means extended breach dwell time and regulatory breach notification failures. |
Sophos MDR + Lumora 24/7 MSSP monitoring (Phase 1 → Phase 2) |
Missing |
| No data loss prevention |
Critical |
Customer payment data, card details, and transaction records can leave the environment via email, Teams, or USB with no controls or alerts in place. Direct PCI DSS and CBUAE violation. |
Microsoft Purview DLP (Phase 1), Zscaler ZIA CASB (Phase 2) |
Missing |
| No PCI DSS / compliance framework |
Critical |
A fintech processing payments with no formal compliance framework cannot demonstrate due diligence to payment networks, banking partners, or the CBUAE. |
NIST CSF 2.0 + PCI DSS alignment programme (Phase 2) |
Missing |
| No incident response plan |
Critical |
No playbook for financial fraud, ransomware, or data breach. CBUAE requires notification within 72 hours of a material incident. Without a plan, this timeline is impossible to meet. |
IR plan design & tabletop exercise (Phase 2) |
Missing |
| No PAM for admin accounts |
High |
Admin credentials for payment infrastructure, cloud environments, and banking integrations are unvaulted and unmonitored. Privileged account compromise is the leading entry point in fintech breaches. |
BeyondTrust PRA, Privileged Access Management (Phase 1) |
Missing |
| No SSO for cloud apps |
High |
Staff maintain separate credentials across payment platforms, accounting tools, and SaaS apps. Credential sprawl increases phishing exposure across every application. |
Entra ID P2, SSO + Conditional Access (Phase 1) |
Missing |
| No EDR/XDR on mobile devices |
High |
Staff access payment dashboards and customer data on personal and corporate mobile devices with no endpoint protection. BYOD devices are a common vector for credential theft in fintech environments. |
Sophos MDR with ITDR, full device coverage (Phase 1) |
Partial |
| No MDM for device management |
High |
No central device inventory or compliance enforcement. A lost or stolen device with access to payment systems has no remote wipe capability. |
Microsoft Intune MDM, device enrolment (Phase 1) |
Missing |
| No quarterly user access reviews |
High |
Over-provisioned accounts accumulate as the team grows. Former employees or contractors may retain access to payment systems and customer data. |
Entra ID governance + access review automation (Phase 1) |
Missing |
| No ZTNA for device connections |
High |
No zero-trust posture enforcement. Any device with valid credentials can access payment infrastructure, regardless of device health or location. |
Zscaler ZIA ZTNA (Phase 2) |
Missing |
| Backup recovery not tested |
High |
Cloud backup is running but recovery has never been validated. In a ransomware event against payment systems, untested backups frequently fail at the worst possible moment. |
Quarterly DR testing, RPO/RTO definition (Phase 1) |
Partial |
| No brand / domain impersonation monitoring |
High |
Fintech brands are high-value targets for typosquatting and fake payment portals. No monitoring means customers could be actively defrauded before the company is aware. |
iZoologic Brand Protection (Phase 2) |
Missing |
| No MSSP SLA-backed support |
High |
No contractual security support SLAs or defined escalation path. Security incidents have no guaranteed response time, increasing financial and reputational exposure. |
Lumora MSSP Service Agreement (Phase 1) |
Missing |
| Microsoft Defender: Plan 1 only |
Medium |
Defender for Office 365 Plan 1 provides baseline protection but lacks automated investigation, attack simulation, and advanced threat hunting available in Plan 2. Insufficient for a fintech environment. |
Upgrade to Defender for Office 365 Plan 2 (Phase 1) |
Partial |
| DMARC not enforced |
Medium |
DMARC is configured but not at p=reject. Attackers can spoof the company domain to send fraudulent payment instructions to clients and banking partners. |
PowerDMARC managed DMARC enforcement (Phase 1) |
Partial |
| Security awareness: annual only |
Medium |
Staff trained once per year on a team where everyone has access to payment systems and customer data. Social engineering tactics targeting fintech staff evolve continuously. |
Sophos Phish Threat continuous micro-training (Phase 1) |
Partial |
| No phishing simulations |
Medium |
No baseline measurement of staff susceptibility to targeted phishing. Finance and executive teams are primary BEC targets in payment companies. |
Sophos Phish Threat simulations (Phase 1) |
Missing |
| No dark web monitoring |
Medium |
Staff credentials from third-party breaches appear on dark web markets within hours. No visibility means compromised accounts are only discovered after an incident. |
Dark web intelligence monitoring, Lumora MSSP (Phase 2) |
Missing |
| No browser security |
Medium |
Staff accessing payment dashboards and banking portals via unprotected browsers. Malicious extensions and web-based credential theft remain unchecked. |
Fortinet FortiSASE Browser Security (Phase 1) |
Missing |
| Firewall: NGFW features unused |
Low |
Perimeter firewall is active but IDS/IPS, SSL inspection, and advanced threat prevention features are not configured. Leaves gaps in detecting lateral movement and C2 traffic. |
NGFW feature activation and CIS hardening (Phase 2) |
Partial |
| No reactive geo-login blocking |
Low |
Anomalous login locations are investigated reactively after alerts. No conditional access policies block high-risk geolocations from accessing payment systems proactively. |
Entra ID Conditional Access geo-blocking (Phase 1) |
Partial |
| No browser security |
Medium |
Employees access cloud apps via unprotected browsers. Malicious extensions and credential theft unchecked. |
Fortinet FortiSASE Browser Security (Phase 1) |
Missing |
| No brand protection monitoring |
Medium |
No active monitoring for fraudulent social media profiles, fake websites, or brand impersonation. |
iZoologic Brand Protection (Phase 2) |
Missing |