Lanware supports clients with the technical side of cybersecurity, but many of the biggest challenges sit outside technology. Policies, procedures, and risk management frameworks are often where organisations struggle most. MD Henry Duncombe and CTO Dan O’Hara highlight the key non technical challenges including risk assessments and explore how sector specific tools and benchmarking can help.
Video transcript
The non-technical side of cybersecurity: Overcoming the risk assessment gap
Cybersecurity is an intensely technical field, and many firms rely on partners like Lanware to successfully manage their day-to-day technical and operational defenses. However, cybersecurity also includes a critical non-technical side—encompassing policies, procedures, and risk management frameworks—where many businesses struggle to find a clear solution.
The biggest gap: Annual risk assessments
For regulated businesses, such as those overseen by the Financial Conduct Authority (FCA), conducting an annual cybersecurity risk assessment is a mandatory requirement. Firms must not only identify vulnerabilities but also maintain a formal treatment plan to address them.
Because many boutique financial services and fund management firms operate as relatively small businesses, they lack the resources to employ a full-time Chief Information Security Officer (CISO) who specialises in Governance, Risk, and Compliance (GRC). This leaves a significant administrative gap when it comes to fulfilling annual regulatory obligations.
The hurdle of critical supplier reviews
A comprehensive risk assessment cannot focus solely on a firm's internal network; it must also evaluate key critical third-party suppliers. This requirement introduces substantial operational friction:
- Time-consuming compliance: Traditionally, third-party risk management relies on sending out exhaustive security questionnaires for vendors to complete manually.
- The "Bloomberg problem": Major global data providers like Bloomberg or market utilities are generally too large to respond to individualised questionnaires from smaller boutique firms, making manual assessment nearly impossible.
While many firms resort to tracking these vendors on fragmented spreadsheets, specialised risk assessment tools offer a far more sustainable solution. Automating this process with a tool that features a preloaded library of pre-assessed industry vendors addresses half the battle, allowing smaller firms to easily refresh and manage their wider information security program annually.
Sector-specific tools and the benefit of benchmarking
To be genuinely effective, these risk management platforms must be highly sector-specific, often tailoring their libraries precisely to the fund management ecosystem. Broad, generalist solutions simply cannot effectively track the specific web of vendors used within specialised financial sub-sectors.
Utilising a niche, sector-specific platform unlocks an invaluable asset: benchmarking data. Because cybersecurity risk appetite varies immensely across different industries, small firms consistently benefit from comparing themselves directly against their peers.
Furthermore, the FCA applies the principle of proportionality. Regulators do not expect a boutique fund manager to accept the exact same risks—or implement the identical bloated controls—as a massive tier-one investment bank. Utilising software that benchmarks your posture against peer firms with similar assets under management provides the data-backed confidence required to justify exactly which risks your business should or shouldn't accept.
