Insider Threats in Banking: Balancing Security, AI, and Compliance

I had the honor of moderating a panel discussion at the Cyber Security Summit in Belgrade, focusing on a critical topic: Insider Threats in the Banking Sector - Balancing Security, AI, and Compliance.

Beyond IT: A Matter of Risk, Reputation, and Responsibility

Insider threats are not just an IT problem. They represent a fundamental challenge in risk management, reputation protection, and regulatory compliance. Whether driven by malicious intent, negligence, or compromised credentials, the consequences remain the same: operational disruption, erosion of trust, and costs that extend far beyond the technical realm.

In the highly regulated banking sector, where customer trust and data security are paramount, insider threats pose unique challenges that require a holistic approach combining people, processes, and technology.

Distinguished Panel of Experts

The discussion brought together leading voices in cybersecurity and banking regulation:

• Jelena Radovanović - Assistant Director, Centre for Information Systems Supervision, National Bank of Serbia
• Rajko Sekulović - Head of Operational Risk Management, Information Security & Business Continuity, Central Bank of Montenegro
• Radoslav Jovanović - CISO, Nova banka AD Banja Luka

Key Insights from the Discussion

1. The Human Factor in Security

Technology alone cannot solve insider threat challenges. The panel emphasized that comprehensive security programs must address the human element through:

• Regular security awareness training and education
• Clear policies and accountability frameworks
• Creating a culture of security consciousness
• Employee support programs that reduce motivations for malicious behavior

2. AI and Advanced Monitoring

The integration of artificial intelligence and machine learning in detecting anomalous behavior patterns offers powerful capabilities. However, the panel stressed the importance of:

• Balancing automated monitoring with privacy considerations
• Avoiding false positives that can create alert fatigue
• Ensuring AI systems are transparent and explainable
• Combining AI insights with human judgment and context

3. Regulatory Compliance and Beyond

While regulatory compliance provides a baseline, leading organizations go beyond minimum requirements:

• Implementing defense-in-depth strategies with multiple security layers
• Regular security audits and penetration testing
• Incident response planning and regular drills
• Continuous monitoring and improvement of security posture

The Path Forward

As banking continues to digitalize and threats evolve, organizations must adopt a proactive, comprehensive approach to insider threat management. This means moving beyond reactive measures to create robust frameworks that integrate technology, policy, and culture.

The conversation at the Cyber Security Summit underscored a crucial point: protecting against insider threats is not just about preventing incidents—it's about building resilient organizations that can detect, respond to, and recover from security events while maintaining trust and operational continuity.

Acknowledgments

I would like to extend my gratitude to Ana Komnenić and the entire conference team for their trust and the opportunity to be part of this exceptional event. The insights shared by our distinguished panelists will undoubtedly contribute to strengthening security practices across the banking sector.