Cybersecurity experts from a variety of financial institutions including Lloyds, HSBC, and JPMorgan have taken part in a training exercise which the organisers have called an industry first.

Hosted by Lloyds Banking Group and cybersecurity training provider Hack the Box, the event pitted 33 teams of two against one another in a series of hacking challenges known as “capture the flags”. The harder the challenge, the more points it was worth, with the total for a challenge decreasing as more teams solved it.

Taking place at Google’s headquarters in London, the competition aimed to test the skills of the experts in a friendly competition.

The organisers said it was the first event of its kind to bring professionals from across the industry together in person.

Speaking to FStech, one organiser likened the event to sports practice. “You just don't show up on game day without showing up for practice three or four times a week,” she said. “The same goes here.” Her colleague suggested it was closer to a military training exercise.

This particular set of tasks were offensive, meaning the competitors were all trying to break systems rather than keep them safe. The organisers told FStech that they believed this was a vital skillset for both “red teams”, cyber professionals employed to hack into their own systems as stress tests, and “blue teams”, those tasked with building defences.

Matt Rowe, chief security officer at Lloyds, agreed, telling FStech in an interview that learning to “attack in order to defend” was a key skill not only for white-hat hackers, but also for those building cybersecurity defences at financial institutions.

“Getting in depth with the different opportunities and attack paths an attacker might have gives the defender a really great opportunity to think about different defensive strategies they can use to interdict them,” he added.
At the end of the two days, a team from Lloyds comprised of a senior penetration tester and a machine learning engineer took the top spot. Speaking to FStech after their victory, they said the biggest takeaway was the increasing power of AI in cybersecurity. “At times, [the event] felt like an AI race instead of a hack,” one said.

One such AI, Claude’s Mythos Preview, has sent shockwaves through the financial services industry in recent weeks, with governments across Europe and North America meeting with the heads of large banks to assess the impact it might have on the security of the sector.

---