Every few years, a shift happens in banking security that forces a fundamental question: is the way we’re running security actually fit-for-purpose anymore?
We’re at one of those moments now.
The threat landscape has changed. Regulatory concern is growing, testified by the Financial Stability Board Chair’s letter to G20 Finance Ministers and Central Bank Governors. The technology stack has grown more complex. And the people needed to manage all of it are increasingly hard to find and even harder to keep. These pressures are ones Accenture’s Banking Trends 2026 identifies as defining forces reshaping how banks operate across the board. Something has to give, and for a growing number of banks, that something is the operating model itself.
The question is no longer simply “how do we secure the bank?” It’s a more uncomfortable one: “what should we be doing ourselves, and what should we source from outside?”
In an environment where threats keep accelerating and the bar for resilience keeps rising, getting the operating model right is not a back-office concern. It’s a board-level one.
The status quo is harder to defend than it looks
Ask most security leaders, and they’ll tell you the same thing. Their teams are stretched. Alert volumes are up. Regulatory requirements keep expanding. And the talent market for experienced security professionals—cloud specialists, Security Operations Center (SOC) analysts, identity engineers—remains punishingly competitive.
SOC roles, in particular, are among the highest-pressure positions in enterprise IT. The work is demanding, the hours are unforgiving and burnout is common—with 67% reporting severe fatigue and annual turnover reaching 28% on average. Running 24×7 coverage with internal headcount alone is not just expensive, it perpetuates a structural problem that doesn’t go away when you hire more people.
Meanwhile, the business isn’t standing still. Banks are modernizing core platforms, partnering with fintechs, opening up APIs and launching new digital products at pace. Security has to keep up without becoming a bottleneck. This is forcing a genuine rethink of the security operating model.
The real question: What belongs in-house?
Managed Security Services (MSS) have been around for years, but for a long time the conversation was mostly about cost. Can we run the SOC cheaper?
framing is too narrow. Looking at managed services only through a cost lens can lead organizations to over-outsource (and lose control) or under-outsource (and stay stuck). The smarter question is not whether to use managed services, but which capabilities genuinely need to stay internal, and which might be better delivered by outside vendors.
Here’s a useful lens: internal teams should own what requires institutional knowledge, strategic judgment and accountability to the board. That includes security architecture, regulatory relationships, resilience strategy and risk decisions that sit close to the business. These are areas where context matters enormously and where a third party usually can’t fully substitute.
Everything else—high-volume, always-on operations like alert monitoring, triage, vulnerability scanning, patch management—is a strong candidate for managed delivery. Not because these things are unimportant, but because operational scale and 24×7 coverage are genuinely difficult to sustain internally, and because external providers, who run these functions across dozens of institutions, are often simply more efficient at them.
The hybrid model is where most banks are landing
The managed services market has also matured considerably. It’s no longer a binary outsource-or-not decision.
Shared models, where multiple organizations have access to a standard set of tools, remain the most cost-efficient entry point, and they work well for institutions prioritizing speed and consistency. Dedicated models often offer full customization and tighter regulatory control, and tend to suit large global banks with complex compliance requirements.
But most institutions don’t sit neatly at either end. A hybrid model is where the sector is increasingly landing, and for a good reason. It can capture the economics of shared infrastructure where standardization makes sense, while preserving dedicated capacity for functions that genuinely require it: incident response, regulatory reporting, threat hunting.
The logic is straightforward: not everything needs to be bespoke, but some things absolutely do. A well-structured hybrid model is built around that distinction.
AI has changed the economics on both sides
The AI dimension has added urgency to all of this, and not in a way that favors the defender by default.
Attackers are using AI to scale phishing, generate more evasive malware and accelerate how they find and exploit weaknesses. The window to act is rapidly shrinking. Leading AI systems have demonstrated up to 98.5% first-attempt success rate at discovering vulnerabilities.1 Meanwhile, the average time it takes for an attacker to move beyond an initial entry point has dropped to just 29 minutes.2 The assumption that security teams have days or weeks to respond is no longer valid. Accenture’s cyber resilience research found that 94% of banking executives assume critical downtime will be 10 days or less. In reality, recovery can average three to six months.
For internal teams, building AI-driven detection and response capabilities from scratch typically takes 18 to 24 months to reach production maturity, assuming the specialized talent to build them can even be hired. In an environment where threats move in hours, that lag is not just a gap. It’s a liability.
This is what’s making AI-driven managed security so compelling right now. Mature MSS providers are already deploying AI at scale: filtering alerts, identifying patterns, automating response workflows and updating detection models continuously. For many banks, consuming these capabilities through a managed service would be simply faster, more reliable and more cost-effective than building them internally.
The governance question, though, is worth taking seriously. AI models used in security triage and risk scoring need the same scrutiny banks apply to internal models: this means requiring transparency, explainability and bias controls. A miscalibrated detection model isn’t just a technical problem. In a regulated environment, it can become a compliance failure. Banks need to ensure that accountability frameworks extend to the AI capabilities they consume through third parties, not just the ones they build themselves.
What good looks like
When MSS is implemented well, the impact on internal teams is significant. When day-to-day operational load is lifted, security leaders report a tangible shift in where their people spend their time. Less alert triage. More architecture. Less patch chasing. More strategic engagement with the business and regulators. The work that genuinely requires institutional knowledge starts to get the attention it deserves.
That’s the real value proposition of the right operating model: not just running security more efficiently but enabling internal teams to actually advance it.
The bottom line
The security operating model conversation is no longer a fringe discussion for banks looking to cut costs. It’s a mainstream strategic question driven by regulatory pressure, talent constraints, AI-accelerated threats and the growing complexity of the digital environment.
The banks getting this right are not asking, “should we outsource?” They’re asking, “what is the right model for us, and are we structured to execute it?” That means being deliberate about what stays internal, rigorous about governance when things go external and clear-eyed about the role AI plays on both sides of the equation.
This operating model question is one piece of a much larger story. In January, our Banking Trends 2027 report will take a hard look at how AI is reshaping cybersecurity across banking and how banks need to adapt to stay ahead. Watch this space.
References:
- CyberGym Vulnerability Reproduction Benchmark, Frontier AI Cybersecurity Observatory, UC Berkeley, accessed September 13, 2026.
- CrowdStrike Global Threat Report, 2026
