Basil Jarrett | Cyber resilience : Why the next banking war will be fought over trust

For some time now, October has been recognised internationally as World Cybersecurity Awareness Month, a global effort to encourage people, companies and governments to take online security seriously. For 31 days, countries around the world, Jamaica included, staged campaigns, training exercises and simulations designed to test our preparation for the next major cyber incident.

But apparently criminals were also watching and, after hearing one too many experts brag about “resiliency” and “redundancies”, looked at one another thoughtfully and said, “Hold my beer.”

Because October 2026 may well go down as one of the most turbulent months in cybersecurity history as a wave of software vulnerability exploitation, supply-chain compromises and AI-assisted attacks exposed just how quickly the cyberthreat landscape is evolving. Criminals used advanced AI tools to identify system weaknesses at speeds that would have been unimaginable only a few years ago. In some cases, decades-old vulnerabilities buried deep inside widely used software have suddenly been exposed, forcing organisations around the world into emergency patching and incident-response mode.

But this isn’t about how technical teams and back-room cyber specialists spent sleepless nights patching servers and closing vulnerabilities trying to keep the internets running. Nor is it about hackers and the way AI has powered their ingenuity.

It’s about banks and financial institutions, one of the biggest targets of online hackers and cyber criminals. More specifically, it’s about whether banks are missing an enormous strategic opportunity in this complex, turbulent environment.

SAME BANK, DIFFERENT COLOUR

Strip away the logos, jingles, different-coloured debit cards and expensive advertising campaigns and most commercial banks today are selling variations of essentially the same thing. Savings accounts, chequing accounts, mortgages, credit cards, car loans, maybe some reward points and a slightly nicer lounge somewhere.

After a while, you could probably swap the logos on some banking advertisements and nobody would take notice. So, if everybody increasingly sells roughly the same products, where does meaningful differentiation come from?

Perhaps one answer is staring us directly in the face: Trust. And, increasingly, cybersecurity and cyber resilience may become one of the most valuable ways financial institutions can build or demonstrate it.

SECURITY AS A PRODUCT

Banks traditionally treat cybersecurity as something customers are not supposed to see.

It lives downstairs in the dungeon somewhere with the IT people. Firewalls. Encryption. Security operations centres. People staring at six computer screens while drinking coffee and speaking in ones and zeros.

But, perhaps cybersecurity should stop being treated simply as infrastructure and start becoming part of the customer proposition. Not by promising that the bank can never be hacked, mind you, but, instead, by saying that we have invested heavily in protecting your information and, if something does happen, we know exactly what to do next.

This is where cyber resilience becomes different from cybersecurity. Cybersecurity asks “How do we stop them from getting in, while cyber resilience asks “What happens when they do?” Can the organisation continue operating? Can it recover quickly? And, perhaps most importantly, can it preserve trust while the technical teams are still figuring out where on the map is Kazakhstan? This is key, especially in financial services where trust is the lifeblood of the sector.

TWO BANKS, SAME ATTACK

Imagine, if you will, two banks suffering essentially the same cyberattack. Bank A disappears into a black hole for hours. The website says nothing and customers receive no guidance. Even employees are unsure what to tell callers. Social media is replete with rumours and WhatsApp voice notes claim customer accounts have been emptied, complete with fake screenshot, of course. IT is still investigating and legal is once again stripping away every useful word from the carefully worded press release. By lunchtime, the public has already made up its mind and written the story.

Bank B suffers the same breach. But, within 20 minutes, it acknowledges the incident, tells customers what is known, what is not yet known, and what they should do next. Employees receive consistent instructions, regulators and key stakeholders are contacted and updates are issued at predetermined intervals. A senior executive appears publicly, calm and informed, reassuring customers that their data and, more importantly, their money, is safe. False information is corrected quickly and the bank is seen as responsive and available. Same attack, same day. But completely different brand outcome.

That difference is not luck. It’s preparation.

CYBER RESILIENCE BELONGS IN THE BOARDROOM

In its Cybersecurity Outlook 2026, PwC reported that 76 per cent of financial institutions expected to increase cybersecurity spending in 2026, while many still felt unprepared for major emerging threats. But spending more money on technology alone does not automatically make an institution resilient. Resilience also requires governance, and effective governance during a crisis requires clear, assured and credible communication. Who has authority to speak during an incident? What happens if corporate email is compromised? Who communicates with employees?

Does the communications team understand enough about cybersecurity to explain technical issues accurately? Does the technical team understand enough communications to recognise when a cyber problem has become a reputational one?

And, when was the last time anybody actually tested any of this? These are board-room, executive-level questions, not IT ones.

BREAK IT BEFORE SOMEBODY ELSE DOES

A serious financial institution should therefore be testing cyber resilience in much the same way it tests business continuity. That is where the value lies. Not in producing another impressive 80-page figurine on somebody’s bookshelf, but in building actual capability.

That means reviewing protocols, training executives, mapping stakeholders, preparing message frameworks, testing alternate communications channels and running realistic simulations before the crisis becomes real.

Done properly, that preparation does more than protect reputation. It becomes part of the brand.

THE NEW DIFFERENTIATOR

The banking wars of the future may therefore not be fought entirely over interest rates, reward points or whose mobile app has the nicest interface. They may increasingly be fought over which institutions customers believe will protect their information, which one will resume functioning the fastest, and which one will tell them the truth quickly.

For Jamaica, that question is becoming especially important, given that government and cyber experts have already acknowledged the scale and likelihood of a cyber attack. Banks should perhaps take a strategic approach that turns that threat into an opportunity for growth. In other words, stop thinking of cybersecurity merely as the cost of keeping criminals out, but rather as a reason to convince customers to stay in.

Major Basil Jarrett is the director of communications at the Major Organised Crime and Anti-Corruption Agency (MOCA) and a crisis communications consultant. Follow him on Twitter, Instagram, Threads @IamBasilJarrett and linkedin.com/in/basiljarrett.