What's Happening?
The European Supervisory Authorities (ESAs) have released a report on the first year of major incident reporting under the Digital Operational Resilience Act (DORA). The report highlights that cybersecurity-related incidents accounted for only 10% of total
major incidents in 2025, suggesting effective safeguards are in place. However, Distributed Denial of Service (DDoS) attacks and data exfiltration were the most common cybersecurity techniques. The ESAs emphasize the need for financial entities to maintain high cybersecurity standards, especially as AI technologies pose new risks. The report also notes that system failures and third-party dependencies are significant drivers of major incidents.
Why It's Important?
The findings underscore the importance of robust cybersecurity measures in the financial sector, particularly as AI technologies evolve. Financial entities must continue to invest in cybersecurity to protect sensitive data and maintain operational resilience. The report's emphasis on third-party risk management highlights the interconnected nature of the financial industry and the potential for cascading failures. This is crucial for maintaining trust and stability in financial markets, as well as for protecting consumer data and financial transactions.
What's Next?
Financial entities are expected to enhance their cybersecurity defenses and third-party risk management frameworks. The ESAs plan to introduce a new IT tool in 2026 to improve incident reporting and data quality. This will likely lead to more stringent oversight and better preparedness for future incidents. Financial institutions will need to adapt to these changes to ensure compliance and safeguard against emerging threats.
