Contrast Security has published the Modern Heist Bank Report 2025, which indicates a significant rise in cybersecurity threats targeting the financial sector. According to the report, 64% of financial institutions reported experiencing cybersecurity incidents in the past year, with respondents highlighting a notable increase in zero-day attacks.

Tom Kellermann, Cybersecurity Advisor for Contrast Security, stated, “Our research found that the financial sector is facing increasing threats with a noticeable uptick in zero-day and destructive attacks.” The report reveals that APIs, cloud environments, and applications have become primary attack vectors. Cybercriminals are shifting their strategies away from merely targeting data to hijacking organizations' digital transformations to launch attacks against their customers and partners.

The report shows that 71% of respondents view zero-day attacks as their chief security concern regarding applications and APIs, while 43% pointed to dwell time and 38% to a lack of visibility into the application layer. The rise of zero-day exploits is attributed largely to state-sponsored efforts from nations including China and Russia.

Legacy technology poses additional challenges, with 82% of institutions overly reliant on web application firewalls (WAFs), despite only 61% believing these defenses are effective. The report reveals that fewer than 25% of institutions are confident their security measures can adequately address zero-day threats. Notably, two-thirds of institutions reported having experienced a cyber incident within the last year.

Key findings of the report include:

  • 12.5% increase in destructive cyberattacks launched to obliterate data.
  • Over two-thirds faced attacks aimed at stealing non-public market information for unlawful trading activities.
  • More than half had experienced a supply chain attack.
  • 60% reported that their investments in extended detection and response (XDR) do not provide visibility into behavioral anomalies at the application layer.

The urgency for improved application security measures is clear, as financial institutions are encouraged to adopt application defense and response (ADR) solutions to protect against the evolving threat landscape. These tools are designed to offer real-time application and API security, empowering organizations to preemptively block attacks and secure their entire software infrastructure.

The full report is available for download at the Contrast Security website.