Cyber security has become a key consideration when assessing investment platforms. Keith Phillips, Chief Executive of The Platforms Association, explains why firms are investing heavily in cyber resilience and what advisers should look for when carrying out platform due diligence.
For advisers, when selecting a platform for their clients, they’d historically assess investment range, pricing, service levels and technology. But there’s another critical factor that many have begun to incorporate into their due diligence: cyber security.
It’s a question that matters more than ever. Investment platforms collectively manage more than £1.4 trillion of UK retail investments. That scale makes them high-value targets for increasingly sophisticated cyber criminals. The good news? The industry has recognised this reality and is responding with significant investment and strategic focus.
In our recent sector-wide cyber security benchmarking report we identified an encouraging picture of how firms are responding. We found an industry investing heavily in cyber resilience, strengthening governance and, importantly, working together to tackle increasingly complex threats.
The threat landscape facing platforms has intensified significantly. Over the past year, 55% of firms reported an increase in cyber incidents. This increase doesn’t stem from a weakening of defences but because the volume and sophistication of attacks are growing exponentially. AI-powered phishing and social engineering attacks are becoming increasingly convincing. Ransomware and extortion remain persistent risks for the sector, while vulnerabilities anywhere within the technology supply chain can have consequences across the wider ecosystem.
In today’s world, no organisation can honestly claim to be immune from a cyber attack. That is no longer a realistic standard. The question is no longer if an attack will be attempted, but how effectively firms can detect, contain and recover from threats.
The pace of change is faster than any single organisation can track alone. Platforms have recognised this reality and are increasingly working together to stay ahead of emerging threats. Effective cyber resilience increasingly depends on collaboration, intelligence sharing and a willingness to learn collectively across the sector. When platforms share threat intelligence and best practices, the entire ecosystem becomes more secure.
Cyber security is becoming an increasingly important part of advisers’ due diligence. Alongside investment capability, service and financial strength, advisers are rightly asking how platforms are managing operational resilience and protecting client data.
The survey suggests this is now being reflected at the highest levels of decision-making. 78% of UK investment platforms employ a dedicated Chief Security Officer (CSO) or Head of Security, while two-thirds discuss cyber risk at board level every quarter. More than half of platforms increased their cyber security budget over the past year, and current spend per employee across the sector ranges from £1,600 to £4,000 annually.
When evaluating platforms, you can now reasonably expect to see dedicated cyber leadership, regular board oversight, and sustained investment in security capabilities. These should be baseline expectations, not differentiators.
Perhaps most importantly, this investment is increasingly being driven by long-term strategic priorities rather than simply regulatory compliance. That represents an important shift in how cyber security is viewed across the industry.
Investment is being directed towards the areas that matter most for client protection. Nearly nine in ten platforms are prioritising threat detection and response capabilities, enabling them to identify and contain threats more rapidly. Almost half are strengthening identity and access management, directly addressing the AI-enabled fraud attempts that could otherwise target clients’ accounts.
Platforms’ own investment is only part of the picture. One of the most encouraging developments we’ve seen is the willingness of firms to work together to strengthen resilience across the industry.
Cyber security is an area where competition should never prevent collaboration. Through the Platforms Association’s Cyber Security Working Group, members are developing practical mechanisms for collaboration, including threat intelligence sharing, joint incident response exercises and the promotion of consistent security standards.
This collective approach helps strengthen the resilience of the wider ecosystem. It also reflects an understanding that maintaining trust in investment platforms is a shared responsibility across the industry.
While the survey has shown encouraging progress, the industry is not looking to rest on its laurels. Firms must constantly adapt and strengthen their capabilities to stay ahead of threats on the horizon.
Developing the right cyber security expertise is becoming an increasingly important priority. Many firms report that specialist roles, particularly in areas such as threat detection and response and identity management, can take several months, to recruit, reflecting the wider competition for cyber talent across the economy.
Addressing this talent shortage requires concentrated efforts in industry-wide training, skills development, innovative recruitment, and the adoption of alternative service delivery models, including utilising AI-driven security tools, managed security services and offshore capabilities.
This benchmarking report reveals an industry that has matured significantly in its approach to cyber security. Cyber resilience is now treated as a strategic priority throughout the sector, discussed in boardrooms, backed by sustained investment and strengthened through collaboration across the sector.
Trust has always been fundamental to investing. Maintaining that trust requires constant attention, continued investment and an industry prepared to work together in the face of evolving threats.
The evidence is clear, investment platforms recognise the importance of cyber security and are acting on it.
