IARM Information Security

full-stack cybersecurity | consulting. professional services. managed security. industrial ot security. | phishprep | siemmax | sbomapp |

[IARM Information Security @iarminfo]

12/12 📖 We mapped every major banking regulator — country by country.
FFIEC. MAS. RBI. DORA. APRA. OSFI. FCA. FSA. OJK. BSP. SAMA. CBUAE.
Full breakdown here 👇
https://t.co/ddls2A0skU
RT if your bank operates across multiple jurisdictions 🔁
#BankingCompliance #PhishingSimulation #CyberSecurity #RegTech #DORA #APRA #iarminfo #phishprep

[IARM Information Security @iarminfo]

9/12 🇮🇩 Indonesia
OJK and Bank Indonesia require banks to: ✅ Test transaction approval controls ✅ Validate employee fraud awareness ✅ Verify response mechanisms work in practice
Phishing simulation is increasingly the compliance standard in digital banking.
#OJK #IndonesiaBanking #CyberRisk

[IARM Information Security @iarminfo]

11/12 🌐 The global pattern is identical across every regulator:
✅ Human behaviour = core attack surface ✅ Test controls — don't just train staff ✅ Use realistic threat scenarios ✅ Show measurable improvement over time
Every regulator. Every region. Same expectation.
#BankingCompliance #CyberRisk #PhishingSimulation

[IARM Information Security @iarminfo]

8/12 🇯🇵 Japan
FSA expects banks to test procedures that rely on: ✅ Authority verification ✅ Human judgement ✅ Escalation processes
Scenario-based phishing and impersonation exercises are the recognised validation method.
#FSA #JapanBanking #CyberSecurity

[IARM Information Security @iarminfo]

Phishing simulation is no longer optional for banks.
It's a regulatory requirement across 12 countries.
Here's what every major banking regulator expects — country by country 🧵👇
#BankingCompliance #PhishingSimulation #CyberRisk

[IARM Information Security @iarminfo]

7/12 🇦🇺 Australia
APRA CPS 234 is one of the most explicit standards globally.
It directly requires testing of controls dependent on human behaviour.
That makes phishing simulation a compliance mechanism — not a nice to have.
#APRA #CPS234 #AustraliaBanking #iarminfo

[IARM Information Security @iarminfo]

6/12 🇨🇦 Canada
OSFI Guideline B-13 requires federally regulated banks to test realistic cyber and human-driven threats.
Not theoretical. Not annual. Realistic and regular.
Phishing simulation is the direct validation tool regulators look for.
#OSFI #CanadaBanking #CyberCompliance

[IARM Information Security @iarminfo]

5/12 🇬🇧 United Kingdom
PRA and FCA frame phishing under operational resilience.
Banks must test severe but plausible disruption scenarios.
Social engineering and impersonation attacks are explicitly on that list.
No simulation = no evidence = examination risk.
#FCA #PRA #UKBanking #iarm

[IARM Information Security @iarminfo]

4/12 🇪🇺 European Union
DORA is live. EBA guidelines are binding.
Phishing is explicitly listed as a credible ICT risk scenario.
EU banks must conduct evidence-based testing — not just document their controls.
Regulators want proof. Not paperwork.
#DORA #EBA #OperationalResilience

[IARM Information Security @iarminfo]

3/12 🇮🇳 India
RBI treats phishing as a key operational risk — not just an IT issue.
Supervisory reviews now check whether banks: ✅ Test payment authorisation controls ✅ Protect credentials under realistic conditions ✅ Show measurable learning from simulations
#RBI #IndiaFinance #BankingCompliance #iarminfo

[IARM Information Security @iarminfo]

2/12 🇸🇬 Singapore
MAS Technology Risk Management guidelines are clear.
Banks must prove through practical exercises that employees can: ✅ Recognise phishing ✅ Validate requests ✅ Follow escalation procedures
Policy documents are not enough.
#MAS #Singapore #CyberRisk #iarm

[IARM Information Security @iarminfo]

1/12 🇺🇸 United States
FFIEC. OCC. FDIC. Federal Reserve.
All expect banks to evidence that employees respond correctly to social engineering — not just complete annual training.
Training certificates won't pass examination. Simulation results will.
#FFIEC #BankingCompliance #iarminfo

[IARM Information Security @iarminfo]

🚨 Just published on X: Phishing Is Now the Most Significant Cyber Threat to Singapore Businesses 49% spike in 2024. Deepfake scams. Voice impersonation. AI-generated emails. A finance director nearly lost US$499K to a deepfake Zoom call. This is happening now. Read the full analysis →

https://t.co/MV10pnaEGg #Cybersecurity #Singapore #InfoSec #phishprep #iarminfo #phishing #vishing #deepfake

[IARM Information Security @iarminfo]

https://t.co/pdp2dxXxps

[IARM Information Security @iarminfo]

https://t.co/pdp2dxXxps

[IARM Information Security @iarminfo]

the saas lobby: "you can't run your own infrastructure"

you: "watch me"

full data ownership
zero dependency
complete control

that's the move

https://t.co/oT3rweXOhp

#Cybersecurity #CISO #iarminfo #phishing #phishprep

[IARM Information Security @iarminfo]

One phone call. $25M lost.
AI cloned the CFO's voice perfectly.

Vishing attacks ↑ 442% in 2024.
Most companies never test for it.

Is yours one of them?

Read this 👇
https://t.co/PBBChUwdLl

#Vishing #Deepfake #CyberSecurity #PhishPrep #InfoSec

[IARM Information Security @iarminfo]

AI phishing volume is up 1,265% since 2022.

40% of attacks now go beyond email — Teams, Slack, SMS & voice.

Is your simulation keeping up?

Read this blog 👇
https://t.co/ECE65VbhsZ

#AIPhishing #CyberSecurity #PhishPrep #InfoSec #Deepfake #iarminfo

[IARM Information Security @iarminfo]

91% of breaches start with a phishing email.

Does your team know what to do when one lands in their inbox?

PhishPrep simulates real attacks — email, SMS, voice & deepfake — before hackers get the chance.

AI-powered. Compliance-ready. On-premise or cloud.

Free demo 👉 https://t.co/nipaJGMiAB

#PhishingSimulation #CyberSecurity #PhishPrep #InfoSec #IARM #iarminfo

[IARM Information Security @iarminfo]

I just published Strengthening Software Supply Chain Security with SBOMs https://t.co/J5nk3oDXXd #sbom #softwaresecurity #cybersecurity #freewebinar #iarminfo