Incident Response Honed in the Global Financial Sector—Taking Japanese Financial Institutions’ Response Capabilities to the Next Level

In an era where system failures and cyberattacks threaten business continuity, financial institutions’ incident response must not only ensure rapid recovery but also meet standards that stand up to audits. What steps should be taken to achieve a more advanced incident response?

Our guest for this episode is Alex Sayle, who has worked in platform and security roles at some of the world’s largest financial institutions—including Goldman Sachs, Morgan Stanley, and JPMorgan—and currently serves as Head of Security & Platform at Fujitsu Launchpad. In a conversation with SIGQ CEO Takaaki Kanetsuki, we explore the approach to incident response honed in the global financial sector and the areas where Japanese financial institutions need to strengthen their capabilities.

What Is the Standard for Incident Response at Global Financial Institutions?

Kanetsuki: If there is one aspect of security and incident response practices at global financial institutions that sets them apart from other industries, what would it be?

Alex: What really stuck with me was being repeatedly told, “Never cover up a problem.” For example, when it comes to fraud prevention, we don’t hold the person who discovered and reported the fraud accountable; instead, we treat it as an issue for the entire organization. The key is not to look for a scapegoat, but to focus on the systems and structures that allowed the fraud to occur, so that we can uncover larger instances of fraud and prevent recurrence. This applies equally to incident response and is a common approach across all aspects of risk management in the financial sector.If you notice signs of an incident, promptly report the situation, step forward, and speak up. That way, even if you were the direct cause of the incident, the focus shifts from holding an individual accountable to a “problem vs. us” framework.

Kanetsuki: Many Japanese companies tend to hold individuals accountable, but this approach is fundamentally different, isn't it?

Alex: Yes. In the world of global finance, the focus is on “What” and “When,” not “Who.” For example, if someone accidentally presses a dangerous button, we don’t blame the person who pressed it; instead, we view the fact that the button was in a state where it could be pressed as the problem itself. This mindset—learning from the system rather than blaming individuals—is similar to what we see in modern SRE, but it has been deeply ingrained in the financial industry for about 20 years.

Kanetsuki: What is the key difference between incident response at large financial institutions and that at commercial companies?

Alex: First, the organization operates on the premise that incidents “always happen.” There is a 24-hour command center, and the system is structured with the assumption that responsibilities will be handed off between staff members. Second, rather than aiming to eliminate risk entirely, there is a culture of responding to issues by prioritizing them while operating under the assumption that something is always broken.Third, processes are designed on the premise that mistakes will inevitably occur. Financial regulators rigorously scrutinize the causes of incidents and the measures taken to prevent recurrence. Simply saying “We’ll be more careful next time” isn’t enough, so we need to institutionalize our response.

Kanetsuki: I see. If there is a reporting obligation to regulatory authorities in addition to reporting to management, that certainly complicates the incident response process . Moreover, while handling these external reports, the on-site team must also proceed with technical responses such as investigating the cause and restoring systems. How do you manage such a complex incident response process?

Alex: First and foremost, the most important step in the initial response is to accurately assess the current situation. We determine the full extent of the impact, including the party responsible for the incident, those affected by it, and even the customers downstream. A major role of the command center is to bring together the stakeholders necessary to accomplish this.

Next, under the direction of the command center, clearly separate the personnel responsible for communicating with stakeholders from those responsible for recovery operations. This is because if recovery personnel are tied up handling communications with stakeholders, they cannot focus on the actual recovery work. If the communications team establishes a clear timeline—for example, by stating, “The next status update will be in one hour”—it will help curb inquiries until then, allowing the recovery team to concentrate on their work.

In addition, the command center has the authority to summon the personnel needed for the response. For example, if specialized knowledge is required during the response, the command center will identify and assign the appropriate personnel. Thus, in large-scale incident response, the command center plays a critical role in facilitating the overall effort.

Kanetsuki: Incidents can be broadly categorized into security incidents and system failures. Is the response process I mentioned earlier the same for both, or do you differentiate based on the type of incident?

Alex: The initial response is the same. This is because, when an incident occurs, it’s often unclear whether it’s security-related or a system failure. However, if it turns out to be a security incident partway through, the first milestone changes. While the goal for a typical incident is recovery, the goal for a security incident is containment. In that case, collecting logs, identifying the point of entry, and preserving forensic evidence become even more critical.Even though the starting point is the same, the next steps in the response process change depending on the milestone.

Kanetsuki: There’s a term called “audit-ready incident response,” and I believe it’s particularly important in the financial industry . In a financial context, what exactly does “audit-ready” mean? For example, could you explain the level of detail with which you document the response timeline, audit trails, and the decision-making process?

Alex: The two key points are that people who weren’t there at the time can trace what happened afterward, and that there is a record showing that certain procedures were followed, even in an emergency.

Reports submitted to regulatory authorities require a very detailed timeline. Specifically,

• Event and Time

• Scope of Impact

• Details of the Restoration Work

• Time of Restoration

• Personnel Responsible for the Work and Their Authorizations

You must record information at that level of detail. Naturally, you’ll need to keep detailed work logs.

Another point that requires special attention is the need to clearly document emergency response procedures in advance and ensure they are followed. In a medical context, saving lives takes priority, and there may be situations where deviations from standard procedures are permitted. However, this is not the case in the financial sector. Since fraud involving the pretense of an emergency is possible, it is essential to follow established procedures even in an emergency.

That is precisely why keeping systems—which are intended to be used only in emergencies—ready for use at all times is the key to incident response in the financial sector.

Tasks Left to AI vs. Human Judgment: Incident Response in the Age of AI

Kanetsuki: We’re starting to use AI agents for incident response. As a security manager, where do you draw the line between what can be entrusted to AI and what should be handled by humans?

Alex: When it comes to business processes that involve collaboration with AI, there are two approaches: “human-on-the-loop,” where AI performs tasks autonomously under human supervision, and “human-in-the-loop,” where a human must make a decision at a certain stage.Security and incident response are still based on the premise of the latter approach, where human intervention is mandatory. In other words, tasks such as gathering and organizing information, as well as presenting options, can be left to AI. However, decisions involving risk must be made by humans.

Kanetsuki: On the other hand, AI agent technology is evolving rapidly. How do you think the approach to incident response will change in the future?

Alex: Whether we can achieve a “human-in-the-loop” approach in incident response ultimately depends on whether we can hold AI accountable. In reality, however, not only technical challenges and integration into business processes but also the impact of laws and regulations will likely play a significant role.

For example, even as the use of AI advances in the medical field, the principle that doctors make the final decision still holds true at this point. Given this situation, it remains to be seen whether the financial industry will be the first to reach the point where it can say, “It’s acceptable to leave the decision to AI.”

Kanetsuki: On a related note, one of the key use cases for AI agents in incident response is reporting. For example, is it possible to use AI-generated reports and timelines for audits or when reporting to regulatory authorities?

Alex: Under the current protocol, the final report must be submitted as having been reviewed by a human. In other words, the requirement to leave a record of approval or evidence that it has been “reviewed by a human” is one of the bottlenecks in utilizing AI.

To change this situation, the government must first allow AI-generated reports within certain limits. For example, it could accept AI-generated preliminary reports, provided that the sources underlying the conclusions are clearly identified. Building on that, the reporting parties could begin by submitting AI-generated preliminary reports, and then transition to a phased process of AI utilization, such as having humans review the content of the final report and make any necessary corrections.

Kanetsuki: What about use cases where AI agents assist humans? Major financial institutions have established 24/7, 365-day incident response systems. On the other hand, I’ve heard that it’s often difficult for FinTech companies and regional banks to build similar operational frameworks. For these organizations, is AI a practical tool for raising the standard of incident response?

Alex: There is great potential for utilizing AI.This is because incident response is a task that tends to rely heavily on individual expertise. The quality of that work depends on the quality of the work environment and the quality and quantity of experience an individual has accumulated. However, in small organizations, it’s often the case that inexperienced staff members are suddenly tasked with handling incidents. It is precisely for these individuals that providing best practices through AI is valuable. By organizing information, presenting options, and supporting human decision-making, AI should enable even small teams to carry out more sophisticated responses.

Kanetsuki: That’s what’s commonly referred to as an “AI harness,” isn’t it? I also thought it was an important point that the level of incident response depends heavily on the environment in which one has worked and the managers under whom one has gained experience.

Alex: People who have been part of a good team—even just once—tend to be better at handling situations. However, in Japan, not only is the pool of people with such experience small, but low workforce mobility is also a challenge.

At financial institutions overseas, it is common for people to build their careers by moving between multiple banks, and the valuable insights and experience gained at one organization are passed on to the next through job changes. In Japan, however, the low mobility of the workforce creates a structure that makes such a cycle difficult to achieve.

That is precisely why we need to bridge the gap in experience by leveraging AI to widely share best practices and insights, don’t you think?

Enhancing Incident Response Capabilities: What Japanese Financial Institutions Should Do

Kanetsuki: For major financial institutions that already have a certain level of incident response capability in place, what areas should they focus on strengthening next, with an eye toward meeting global standards and adapting to the AI era? In particular, I believe that even major Japanese financial institutions—despite having established advanced response systems—still rely heavily on vendors in many areas. Compared to overseas markets, where in-house development is the norm, what challenges do you think they face?

Alex: Actually, regardless of whether a system is developed in-house or by an external vendor, the more advanced and complex it is, the more inevitable siloing becomes.Making these “black box” areas transparent and clarifying where responsibility lies is a key challenge for every organization moving forward. To achieve this, it’s essential for individual vendors and teams to develop AI systems and documentation that can explain their own systems, thereby creating interfaces that are easy for AI to understand. When a problem arises with a system, instead of immediately calling the person in charge, you first consult the AI. The AI then assesses the situation and connects you to the person in charge only when absolutely necessary.

Especially when vendors are involved, communication spans multiple companies, so some people may hesitate to reach out because even a simple inquiry could end up wasting time and money. Additionally, companies may end up passing the buck back and forth. By leveraging AI, we might be able to reduce these kinds of organizational complications.

Kanetsuki: However, in projects involving multiple vendors, it’s practically difficult to get other vendors to use an incident management tool developed by a specific vendor, isn’t it?

Alex: I think that’s difficult. On the other hand, precisely because it’s a tool provided by a third-party startup like Incident Lake, it has no vested interest with any specific vendor, which means it can function as a neutral platform for the benefit of customers, don’t you think?

Kanetsuki: On the other hand, there are financial institutions that find it difficult to secure the same level of investment and personnel as major players. Given their limited resources, where do you think they should prioritize their efforts—in defense or recovery?

Alex: Organizations with limited resources need to consolidate data in order to leverage AI. However, if they hesitate over “what data to provide to the AI and to what extent” every time an incident occurs, it will lead to delays in response. To achieve advanced AI-driven incident response, it is essential to prioritize organizing data classifications and scope of use, and to clearly define the criteria for what data the AI can access.

Kanetsuki: Alex has stated that “compliance is not a hindrance but a tool.” On the other hand, the benefits of investing in incident response are hard to see if nothing happens. As a result, I imagine some people will ask why we should spend money on something that may or may not happen. What is needed to help senior management understand the necessity of such investments and get them on board?

Alex: The terminology and concerns differ between the front lines and senior management. That’s why it’s necessary to learn how to communicate with senior management.

Management generally wants to keep costs down. Rather than simply presenting technical or system-related details as they are, you must be able to explain them from a business perspective—for example, by addressing questions such as, “What risks will we face if we don’t take action?” and “What new markets can we enter by taking action?”

For example, the significance of compliance and security changes depending on a company’s stage of growth. When a startup enters the enterprise market, customers will begin to expect the company to address security and compliance issues. At that point, if the company has already taken the necessary steps and can demonstrate that it has “documented evidence,” it can move forward with business negotiations faster than its competitors. In other words, compliance becomes a tool for accelerating growth.

On the other hand, as a company grows in size, the question regarding incidents shifts from “whether they will occur” to “when they will occur.” This risk is increasing, particularly with the spread of advanced offensive AI. Without adequate preparations, companies face significant risks, such as reputational damage and the resulting financial losses.

In summary, for small organizations, compliance is a tool for growth, while for large organizations, it is a shield to protect the company from unavoidable risks.

To help others understand the need to invest in security and incident response, it is essential to make your case using this kind of business-oriented language.

Kanetsuki: Finally, please share a message for our readers who are involved in incident response at Japanese financial institutions and the vendor companies that support them.

Alex: I hope you’ll start small and stick with it without compromising. Begin by understanding where your data is, how it’s used, and how up-to-date it is. These three points—starting small, automation, and consistency—are key to preparing for incidents in the age of AI.

The priority should be to identify the core operations that cannot be interrupted and to clearly establish the necessary framework—including decision-makers in the event of a failure, emergency contact networks, and recovery procedures. Once that foundation is in place, a practical approach would be to integrate AI into the phases involving high-load tasks such as information aggregation and coordination.

The key is to ensure that data does not remain merely as isolated “points.” If you collect data continuously, those points will connect to form “lines.” As you continue to collect data, various “lines” of data will combine to form a “surface.” Once you can view the data as a surface, it becomes easier to see the big picture—such as where vulnerabilities or problems lie, and where information leaks originated.

Kanetsuki: That was very informative. Thank you very much for today!