Financial service organisations across Britain are feeling the pressures of expanding compliance and data protection regulations coming from both the UK authorities and those further afield, with compliance now the biggest challenge these firms face.

Fresh data from Bridewell Consulting’s Cyber Security in Financial Services 2025 Research Report found almost half (44%) of financial firms are worried about complying with the shifting regulatory requirements, with 39% are most worried about meeting stringent data protection and privacy rules.

A worrying number of organisations admitted that they were not confident in their ability to comply with UK data protection requirements, including the need for data breach notifications (35%), rules around data processing agreements and due diligence for third parties (35%), as well as cybersecurity measures needed for data protection (30%).

Despite a quarter of firms already spending 10% of their cybersecurity budgets on governance, risk and compliance for IT, 41% are feeling the pressure to improve their cyber maturity to meet the bulk of new regulations coming into force, including the NIS Regulations and National Cyber Security Centre’s Cyber Assessment Framework (CAF), as well as EU regulations like the DORA Act.

Aside from compliance, UK financial firms are also prioritising protecting their critical assets (37%) and managing cloud security (35%) in the face of constantly evolving cyber-threats.

Bridewell’s data shows that supply chain attacks have become the hardest and most time-consuming for financial services companies to respond to, with responses taking nearly sixteen hours, followed by data theft incidents, where firms are taking almost eleven hours to react.

However, the figures show that despite the current boom in ransomware attacks, financial organisations are managing to respond a lot more quickly to events, at just a shade over six hours.

Unsurprisingly, given the state of geopolitics, economic turbulence is the biggest external risk financial firms cited, although concern has dipped to 76% from 83% last year.

Recommended reading

• Are UK Businesses Ready for New ESG Rules?
• Cyber-threats and Fraud Costing Firms $100M Every Year
• VPN Security Fears Pushing Firms To ‘Zero Trust Everywhere’

Bridewell found that other external threats have also seen a drop in concern, particularly those linked to hostile nation states, with worries around Russian actors lower than last year, and concern over China-linked groups falling sharply, from 80% to 57%.

As ever, the burgeoning use of AI by threat actors is also increasing pressure on financial services organisations, much as it is in every industry, although unlike other sectors, financial firms perceive AI-driven social engineering as less threatening at 70% vs 77% across all Critical National Infrastructure organisations.

Rather, the top concerns of UK financial companies are AI-enhanced phishing attacks (89%), automated hacking (80%), polymorphic malware (78%), AI botnets (81%), and the use of deepfakes (78%), likely driven by incidents such as the Hong Kong worker employed by Arup who was allegedly tricked into sending more than $25 million to cybercriminals, after participating in a video conference with deepfake versions of his superiors.