Despite financial institutions having invested significantly in protecting their own organisations from attacks, more recent incidents have clearly demonstrated that risks have significantly shifted to third parties, supply chains and infrastructures that banks depend on.