









































Pa
ge

 
1



Pa
ge

 
75

American Journal of  
Geospatial Technology (AJGT)

From Reactive to Proactive: Engineering a Next-Generation Cyber Threat Response 
Emergency Operations Center (EOC) for Financial Institutions
Sk Monirul Islam Mahadi1, Shuvo Kumar Mallik2*, Nahid Raza Shatu3, M Abeedur Rahman4

Volume 4 Issue 1, Year 2025
ISSN: 2833-8006 (Online)

DOI: https://doi.org/10.54536/ajgt.v4i1.5355
https://journals.e-palli.com/home/index.php/ajgt

Article Information ABSTRACT

Received: May 17, 2025

Accepted: June 20, 2025

Published: July 24, 2025

The financial sector remains one of  the most targeted domains for cyberattacks, demanding 
advanced and adaptive cybersecurity strategies. Traditional Emergency Operations Centers 
(EOCs) are predominantly reactive, leaving financial institutions vulnerable to sophisticat-
ed and rapidly evolving threats. This paper proposes a transformative approach: designing 
a next-generation, proactive Cyber Threat Response EOC explicitly tailored for financial 
organizations. By synthesizing insights from case studies, expert interviews, and industry 
surveys, this study introduces a conceptual framework that integrates predictive analytics, 
threat intelligence, automation, and collaborative defense models. The framework aims to 
enhance early threat detection, reduce response times, and build organizational resilience 
against emergent cyber threats.

Keywords
Cyber Threat, EOC, Financial 
Institutions, Next-Generation

1 Department of  Cybersecurity at Rowan University, Glassboro, New Jersey, USA.
2 Department of  Economics, Southeast University, Dhaka, Bangladesh.
3 Senior Executive MI and Operations Credit Control Service, HSBC Banglades.

4 Assistant Professor, Department of  Economics, Southeast University, Dhaka, Bangladesh.
* Corresponding author’s e-mail: nextgenresearch.info@gmail.com

INTRODUCTION
The financial sector stands at the frontline of  the 
global digital economy, serving as a critical backbone 
for commerce, investment, and individual wealth 
management (George, 2024). However, its centrality and 
reliance on vast, interconnected digital infrastructures 
have also rendered it one of  the most targeted industries 
for cyberattacks. In recent years, cyber adversaries 
have grown increasingly sophisticated, evolving from 
opportunistic actors who deploy simple malware or 
engage in fraud to well-organized, persistent threat groups 
that execute coordinated ransomware campaigns, deploy 
banking trojans, orchestrate phishing schemes, and even 
engage in state-sponsored cyber espionage (Bardin, 2025). 
This rapidly shifting cyber-threat landscape demands a 
fundamental transformation in how financial institutions 
detect, respond to, and anticipate cyber incidents. 
Historically, Emergency Operations Centers (EOCs) 
within financial organizations have operated on reactive 
models (Jiang et al., 2025). These traditional setups are 
typically designed to detect breaches and mobilize incident 
response teams in the event of  an attack. While effective 
in specific legacy scenarios, this approach is no longer 
sufficient in today’s rapidly evolving digital environment. 
Modern cyber threats occur at machine speed, exploiting 
vulnerabilities before they can be patched and leveraging 
automation to amplify damage across systems. In this 
context, time is of  the essence. Delayed responses to 
cyber incidents can exacerbate the scale of  the breach, 
leading to prolonged system downtime, substantial 
financial losses, regulatory penalties, and irreparable 
reputational damage (George et al., 2024).
Despite increased investments in cybersecurity 
technologies ranging from advanced firewalls to threat 
intelligence platforms, many financial institutions remain 

constrained by reactive mindsets and siloed operational 
models. These organizations often face challenges 
such as fragmented situational awareness (SA), lack 
of  coordination across departments, limited access to 
real-time data, and insufficient predictive capabilities. 
Consequently, cyber incidents are often addressed in 
isolation, with critical decisions made based on incomplete 
or outdated information. This hampers the institution’s 
ability to mount an effective, timely, and holistic response 
(Smidt et al., 2024).
A key weakness in traditional EOCs is the lack of  
integration between cyber situational awareness (CSA), 
incident response processes, and business continuity 
planning. As threat actors deploy increasingly advanced 
tactics, financial institutions require more than just 
reactive tools. They need the foresight and agility to 
anticipate, prepare for, and neutralize threats before 
they cause harm. This necessitates a paradigm shift from 
reactive containment to proactive orchestration of  cyber 
defense (Arora, 2025).
The envisioned transformation centers on the development 
of  a next-generation Cyber Threat Response Emergency 
Operations Center (EOC), a dynamic, intelligent, and 
agile hub that can predict threats, assess risks in real time, 
and coordinate cross-functional responses across the 
enterprise. This advanced EOC would be underpinned 
by a robust technological architecture featuring artificial 
intelligence (AI) driven predictive analytics, automated 
threat detection, and real-time data integration (Nazir 
et al., 2025). Equally important is the adoption of  
shared intelligence frameworks that foster collaboration 
between internal teams and external partners, including 
government agencies, cybersecurity firms, and other 
financial institutions.
Such an evolution calls for an interdisciplinary approach, 



Pa
ge

 
76

https://journals.e-palli.com/home/index.php/ajgt

Am. J. Geo Spat. Technol. 4(1) 75-83, 2025

drawing insights from cybersecurity, data science, risk 
management, and systems engineering. It also requires a 
cultural shift within organizations, promoting a mindset 
of  continuous learning, simulation-based preparedness, 
and cross-departmental collaboration. Proactively 
building cyber resilience is not merely a technological 
challenge; it is a strategic imperative for survival in an era 
of  relentless digital threats.
This research proposes a comprehensive model for 
engineering a next-generation Cyber Threat Response 
EOC explicitly tailored for the financial sector. By 
integrating cyber situational awareness (CSA) frameworks 
with team situational awareness, this model aims to 
enhance decision-making, reduce response times, and 
elevate the overall cybersecurity posture of  financial 
institutions. Through this shift from reactive to proactive 
operations, organizations can not only mitigate risks 
more effectively but also safeguard the trust and stability 
essential to the global financial ecosystem (Vasiliu-Feltes, 
2024).

Research Questions
This study aims to investigate the transformation 
necessary for financial institutions to transition from a 
reactive to a proactive cyber threat response posture. The 
core research questions are:

• What are the defining characteristics of  a next-
generation, proactive cyber threat response EOC?

• How can predictive analytics and threat intelligence 
be optimally integrated into EOC workflows?

• What technological and architectural innovations are 
essential for building future-ready EOCs?

• What organizational models and staffing strategies 
best support proactive cybersecurity operations?

• How can the performance and return on investment 
(ROI) of  such EOCs be effectively evaluated?

Research Objectives
• Define and validate the key features and functions of  

a next-generation proactive EOC.
• Construct a conceptual framework that enables 

real-time cyber situation awareness (CSA) and threat 
mitigation.

• Identify the enabling technologies, processes, and 
interdisciplinary skill sets required.

• Recommend implementation strategies and 
performance metrics that can guide organizations in 
transitioning to and maintaining proactive cyber defense 
operations.

LITERATURE REVIEW
The rapid digitization of  financial institutions has 
significantly transformed the cybersecurity landscape, 
bringing both unprecedented opportunities and 
heightened risks (Vasiliu-Feltes, 2024). As financial 
organizations increasingly rely on interconnected digital 
infrastructure, cyber threats have become more complex 
and frequent, necessitating a shift from reactive to proactive 
cyber threat response mechanisms. This literature review 

explores critical perspectives on situational awareness 
(SA) in teams, cyber situational awareness (CSA), 
information sharing, and risk management, highlighting 
gaps and opportunities for engineering a next-generation 
Cyber Threat Response Emergency Operations Center 
(EOC) tailored for financial institutions in Bangladesh.
Situational awareness is foundational for effective 
cyber defense. Within team contexts, SA from multiple 
perspectives: individual awareness, shared awareness 
among members, and a combined collective awareness 
that supports coordinated action. Individual SA refers to a 
person’s understanding of  relevant environmental factors, 
whereas shared or team SA involves communication and 
mutual understanding across team members to form a 
coherent operational picture. In cybersecurity teams, this 
distinction is crucial since threat detection and incident 
response require rapid assimilation and interpretation of  
evolving information (Naseer et al., 2024).
Research has emphasized that effective team SA depends 
heavily on communication processes that enable the 
construction of  shared mental models (Carraro et al., 
2025). These shared models would allow teams to interpret 
data consistently, coordinate responses effectively, and 
make informed decisions promptly. In high-stakes 
environments, such as cyber defense, where information 
overload is common, maintaining synchronized team 
situational awareness (SA) is challenging but essential to 
avoid gaps in threat detection and mitigation.
Despite significant work on Team SA in fields like 
military operations, transportation, and emergency 
response, there is a limited exploration of  Team SA 
explicitly tailored to the financial sector (Samunderu, 
2024). Financial institutions face unique challenges due 
to their high-value targets, complex threat actors, and 
the regulatory environment in which they operate. This 
gap highlights the need for research on how team SA 
manifests in cyber threat response units within financial 
institutions, particularly in emerging economies such as 
Bangladesh.
Cyber situational awareness (CSA) extends traditional 
situational awareness (SA) concepts into the cyber 
domain, encompassing the perception of  network events, 
comprehension of  their significance, and projection 
of  potential future impacts. CSA frameworks often 
build upon Endsley’s three-level model of  perception, 
understanding, and projection, but operationalizing these 
levels in cybersecurity environments remains an ongoing 
challenge (Hawash et al., 2024).
Studies reveal that cyber defense analysts primarily focus 
on event detection and orientation corresponding to the 
first two levels of  SA. Detection involves recognizing 
deviations from normal network states, while orientation 
pertains to understanding the context and implications 
of  these events. However, there is a notable gap in 
explicitly incorporating predictive analytics (projection) 
into operational CSA. Analysts seldom articulate a need 
for forward-looking information to anticipate threat 
evolution and prepare preemptive responses, which 



Pa
ge

 
77

https://journals.e-palli.com/home/index.php/ajgt

Am. J. Geo Spat. Technol. 4(1) 75-83, 2025

suggests an area ripe for advancement in EOCs.
Information requirements for effective CSA span multiple 
dimensions, ranging from technical indicators such as 
intrusion detection system alerts and malware signatures 
to broader intelligence on adversary tactics, techniques, 
and procedures (TTPs). Successful CSA frameworks 
integrate these layers to form a comprehensive 
understanding that supports strategic, operational, and 
tactical decision-making (Alsamhi et al., 2024).
A common operational picture (COP) is a shared 
framework that presents unified situational data to 
decision-makers, enabling them to have aligned awareness 
and coordinated action. In multi-agency or multi-team 
cyber incident response, a COP helps overcome challenges 
related to geographical dispersion, organizational silos, 
and diverse expertise.
Effective COPs rely on technological solutions that 
aggregate and structure information, but equally 
important are shared institutional, cultural, and 
experiential backgrounds among decision-makers. Such 
commonality ensures that data is interpreted consistently, 
facilitating uniform understanding and joint prioritization 
of  threats.
In the financial sector, particularly in contexts such 
as Bangladesh, where public-private partnerships are 
evolving, COPs can foster enhanced cooperation among 
banks, regulators, and law enforcement agencies. Yet, 
current practices show limited mechanisms for real-
time collaborative information sharing, which hinders 
proactive threat detection and unified response efforts. 
The development of  integrated platforms supporting 
dynamic COPs remains an essential objective for next-
generation EOCs (Cespedes-Cubides & Jradi, 2024).
Financial institutions traditionally emphasize risk 
management as a core operational function. While 
credit and market risks have long dominated attention, 
operational risks, including cyber risks, have gained 
prominence alongside increasing technological 
dependence. Cyber risks are multifaceted, stemming from 
human error, system vulnerabilities, process failures, and 
external threat actors.
Operational cyber risk management involves identifying 
critical information assets, assessing vulnerabilities, 
and deploying safeguards. However, the complexity of  
cyber threats challenges conventional risk quantification 
methods, prompting the need for more adaptive and 
intelligence-driven approaches. Emerging models 
advocate incorporating intelligence beyond purely 
technical indicators, extending to organizational 
behaviors, threat actor motivations, and the broader cyber 
landscape. This holistic perspective supports both single-
loop learning focused on immediate corrective actions 
and double-loop learning, which facilitates strategic 
changes in policies, workflows, and security postures 
(Auqui‐Caceres & Furlan, 2023).
For financial institutions in Bangladesh, strengthening 

cyber risk management through advanced CSA and 
threat intelligence integration is vital. Institutional 
learning and adaptation must keep pace with the evolving 
threat environment to reduce vulnerabilities and enhance 
resilience. Threat intelligence has evolved into a multi-
layered discipline encompassing strategic, operational, 
tactical, and technical information. Strategic intelligence 
supports long-term risk management, while operational 
intelligence focuses on imminent threats. Tactical 
intelligence details attacker methods, and technical 
intelligence provides granular indicators of  compromise 
(Yu et al., 2023).
Despite the richness of  threat intelligence frameworks, 
financial sector EOCs often underutilize automation 
tools that could accelerate threat lifecycle management. 
Security Orchestration, Automation, and Response 
(SOAR) platforms have emerged to automate repetitive 
tasks, integrate disparate data sources, and orchestrate 
coordinated responses across tools and teams. However, 
the adoption of  SOAR and predictive analytics within 
financial institutions remains inconsistent, particularly 
in developing markets. The limited integration of  these 
technologies hinders the ability of  EOCs to transition 
from reactive firefighting to proactive threat anticipation 
and mitigation (Negi et al., 2024).

MATERIALS AND METHOD
This study employed two complementary data collection 
methods to explore the design and development of  
a next-generation cyber threat response Emergency 
Operations Center (EOC) tailored for financial 
institutions in Bangladesh. The first method involved 
distributing a structured questionnaire to participants 
engaged in a national-level cyber incident management 
exercise within the financial sector. The second method 
consisted of  in-depth interviews with key leaders who 
facilitated coordination and cooperation conferences 
during the same exercise. Each dataset was analyzed 
separately before being combined for joint interpretation 
and analysis. The findings were then compared with 
existing theories to draw relevant conclusions.
The questionnaire was administered during a dedicated 
debrief  session held several weeks after the exercise. 
Approximately 70 individuals participated in this session, 
which also included training elements. However, not all 
attendees were present during the distribution of  the 
questionnaire. Before completing the survey, participants 
were informed about the study’s objectives. Printed 
questionnaires were distributed, which took approximately 
20 minutes to complete. In total, 42 responses were 
collected, although some questionnaires were only partially 
completed. Towards the end of  the session, one of  the 
researchers provided a brief  presentation on emerging 
concepts related to common operational pictures (COP) 
and cyber situational awareness. Participation in the study 
was voluntary, and no compensation was provided.



Pa
ge

 
78

https://journals.e-palli.com/home/index.php/ajgt

Am. J. Geo Spat. Technol. 4(1) 75-83, 2025

Figure 1: The distribution of  the participating 
organizations (N = 42).

Figure 2: The distribution of  the different roles of  the 
participants (N = 42).

The questionnaire consisted of  ten open-ended questions 
designed to address two primary research goals. The first 
seven questions aimed to identify essential information 
elements for a financial sector cyber threat response 
COP, clarify intended users, and understand information-
sharing practices. The last three questions focused on 
exploring current systematic practices related to the 
creation and maintenance of  a cyber threat Command 
and Control (COP). These questions were carefully 
developed to capture a broad range of  perspectives and 
reflect real-world practices within the financial sector.
The questions asked included the following

1. What types of  information are critical to include in 
a common operational picture for cyber threat response?

2. Which roles or positions within your organization 
are intended to use this operational picture?

3. What types of  decisions should be supported by the 
situational awareness provided by the operational picture?

4. What information does your organization contribute 
to shared operational pictures?

5. Which external organizations could benefit from 
your organization’s shared operational picture data?

6. How does your organization track cyber-related 
issues that could impact your operations?
No formal definitions of  key terms, such as “cyber 
threat” or “common operational picture,” were provided 
in the questionnaire, allowing respondents to express 
their interpretations of  these concepts. 
Respondents represented a diverse range of  organizations 
within the financial sector, and their roles predominantly 

reflected strategic and managerial levels, as the exercise 
was designed as a tabletop scenario rather than a technical 
simulation. Many participants identified with risk 
management, crisis management, security, or information 
security functions.
For data analysis, responses were divided among the 
research team members, who independently coded 
answers by noting the frequency of  recurring themes. 
Responses were categorized into three levels based 
on mention frequency: (i) frequently mentioned, (ii) 
occasionally mentioned, and (iii) rarely mentioned. Unique 
or outlier responses that provided valuable insight were 
also noted. The team then held multiple collaborative 
discussions to reach a consensus on the interpretation and 
documentation of  the results. As part of  the evaluation 
process for developing a next-generation Cyber Threat 
Response Emergency Operations Center (EOC) tailored 
for financial institutions in Bangladesh, participants were 
also asked whether they were willing to engage in future 
phases of  the research. Their institutional affiliations 
and organizational roles are summarized in the visual 
data (see Figures 2 and 3). Two important points must 
be noted for interpreting the reported roles. First, the 
exercise was conducted in a tabletop format and did not 
involve live simulations of  cyberattacks or technical drills 
within Network or Security Operations Centers (NOCs/
SOCs). Instead, the participants targeted were from 
management-level positions, emphasizing strategic rather 
than operational perspectives.
Second, role classifications were based on self-
identification. Although the questionnaire included 
predefined categories (such as Organizational 
Management, Public Relations, Cybersecurity, and Legal), 
most participants selected the ‘Other’ category. They 
provided their descriptors, such as Risk Management, 
Crisis Management, Security, and Information Security. 
These variations highlight the fluidity in role perceptions 
and should be taken into account when analyzing the data. 
For instance, those identifying as Security or Information 
Security did not categorize themselves under Cybersecurity, 
raising questions about the overlap and boundaries among 
these labels. It is apparent, however, that the predominant 
group comprises individuals engaged in risk management, 
aligned with definitions relevant to the financial sector 
context previously discussed.
To analyze the collected feedback, the responses were 
divided among the research team. Each team member 
subjectively categorized answer frequencies into three 
strata: frequently mentioned, occasionally mentioned 
or infrequently mentioned. Additionally, some unique 
insights, though mentioned by only one or two participants, 
were preserved for their potential value in informing 
EOC development. Consensus was achieved through 
collaborative discussion. The research team held several 
meetings to review and harmonize their interpretations, 
ensuring that the final documented outcomes reflect 
a balanced and agreed-upon understanding of  the 
participants’ inputs.



Pa
ge

 
79

https://journals.e-palli.com/home/index.php/ajgt

Am. J. Geo Spat. Technol. 4(1) 75-83, 2025

Interviews
During the one-day strategic simulation, sector-specific 
coordination sessions were held twice, once at the 
beginning and again at the end of  the exercise. These 
sessions were organized by institutional groupings 
relevant to the financial sector of  Bangladesh. Five 
distinct forums were established: (i) for representatives 
from commercial banks, (ii) for stakeholders from 
microfinance institutions, (iii) for senior officials from 
the insurance sector, (iv) for representatives from capital 
market entities, and (v) for key actors from financial 
regulatory bodies and infrastructure operators. The heads 
of  each of  these five forums were interviewed (N = 5) 
to gain deeper insights into the challenges associated with 
building a shared Common Operational Picture (COP) 
and achieving Collective Situational Awareness (CSA) 
during the simulation. These interviews served as the 
primary source of  data for understanding how cyber 
threats are currently perceived within different branches 
of  the financial system.
Each interview was scheduled to last between one and one 
and a half  hours and was conducted by two members of  
the research team in a semi-structured format. Interviews 
were conducted on-site at the respondents’ offices. One 
researcher led the questioning, while the other primarily 
documented responses; however, both roles were shared 
to ensure thorough coverage. Following each session, 
interview notes were sent to the respective interviewees 
for validation and correction, ensuring the accuracy of  
recorded information. The interviews were conducted in 
the weeks immediately following the exercise, beginning 
the day after and concluding within a few weeks. The 
final session was held in early January. All questions from 
the exercise’s original questionnaire were also presented 
during the interviews, offering an opportunity to enrich 
and clarify the broader data collection with more nuanced 
perspectives where needed.

RESULTS AND DISCUSSIONS 
This section presents findings derived from both surveys 
and interviews conducted with stakeholders in the 
financial sector. The analysis is structured to address two 
research questions: (1) What information elements are 
critical for an effective–Common Operational Picture 
(COP) or Cyber Situational Awareness (CSA)? and (2) 
How is cyber threat perception and response framed in 
the financial sector?

Essential Information Elements in a Cyber COP (N 
= 42)
Most respondents (31 of  42) emphasized the importance 
of  including reliable, verified information sourced from 
trusted channels. While rumors and unverified data were 
considered valid, there was a strong consensus on the need 
to differentiate them clearly. Many respondents (15 of  42) 
also emphasized the importance of  incorporating current 
sub-goals and strategies related to crisis management, 
which are aligned with broader strategic objectives and 

the organizational ethos. A significant portion (10 of  42) 
emphasized the value of  having a communications plan 
that details internal versus external information-sharing 
guidelines. Additionally, many participants called for 
documenting both past and planned actions, identifying 
stakeholders, and tracking collaborations. One respondent 
advocated for integrating triggers and indicators to assess 
evolving threats preemptively. Many expressed interests 
in predictive analyses, including normal and worst-case 
scenario forecasts. Interview feedback echoed these 
themes and emphasized the need for forward-looking 
perspectives and prompt management of  rumors.

Target Audiences for a Cyber COP (N = 42)
The most frequently identified recipients were crisis 
management teams (29 of  42), including both central and 
regional units in larger organizations. Senior management, 
particularly CEOs and second-in-command executives, 
were also commonly cited (28 of  42), alongside incident 
and risk management teams, public relations officers, and 
various department heads. Some respondents proposed 
sharing the COP with all internal stakeholders and even 
external decision-makers. Interviewees added that contact 
information and predefined crisis-transition thresholds 
are crucial.

Decision-Making Supported by a Cyber COP (N = 
40)
Most respondents (23 of  40) cited communications 
and public relations decisions as key outcomes. Many 
emphasized the importance of  strategic alignment and 
prioritization of  action, particularly under resource 
constraints. Some respondents highlighted operational 
choices such as workforce reallocation, trading 
suspensions, and IT infrastructure management. One 
respondent recommended proactively planning for 
post-crisis recovery. Interviews highlighted the value of  
principles-based decision-making and the central role of  
IT services in this context.

Information Contributions to External COPs (N = 
41)
Respondents identified several types of  valuable 
contributions: confirmed facts, situational assessments, 
internal resource status, actions taken, financial expertise, 
and forecasts. These inputs essentially correspond to the 
early phases of  the established COP framework. Some 
respondents also emphasized the importance of  strategic 
decision-sharing and coordination practices. Interviewees 
reinforced that the method and intent of  communication 
are as critical as the data itself.

External Beneficiaries of  Shared COP Information 
(N = 42)
Two main categories of  beneficiaries were identified: 
financial sector stakeholders and governmental 
authorities. Nearly all respondents (40 of  42) mentioned 
financial institutions such as regulatory bodies and 



Pa
ge

 
80

https://journals.e-palli.com/home/index.php/ajgt

Am. J. Geo Spat. Technol. 4(1) 75-83, 2025

industry associations. Many (32 of  42) also referenced 
civil authorities, such as the police and government 
ministries. Interviewees added that payment system 
actors and media should also be included.

Required External Information for Internal COPs 
(N = 42)
Respondents sought similar categories of  information 
from others as they offered themselves: confirmed facts, 
situational awareness, system/resource statuses, actions 
taken, and strategic decisions. A notable distinction was 
a stronger demand for external factual data and less 
emphasis on acquiring domain expertise. Interviewees 
supported the necessity of  factual insights and situational 
updates.

Key Information Providers (N = 41)
Government agencies, industry associations, and central 
financial entities were primary sources. The Swedish 
Civil Contingencies Agency, the Security Service, and 
the financial supervisory authority were frequently 
mentioned. Some responses also pointed to service 
providers and specific banks. Many acknowledged 
that information needs vary with situational context. 
Interviewees confirmed the necessity of  involving 
different actors depending on the nature of  the crisis.

Systematic COP Practices (N = 38)
Out of  38 respondents, 29 confirmed that they had 
systematic practices, while nine did not. Some stated 
they lacked clarity on what constitutes a systematic COP 
approach.

Implementation Methods (N = 29)
COP implementation strategies included technical tools 
(monitoring systems, penetration tests), organizational 
structures (security departments, cross-functional teams), 
external collaboration (forums such as FIDI-FINANS 
and NFCERT), and procedural frameworks (the quadrant 
model, incident management protocols). Interviews 
provided more profound insight into organizational roles 
and inter-sector collaboration.

Tracking Cyber Threats (N = 41)
Approaches included internal teams (security and 
risk departments), partnerships with IT vendors and 
consultants, participation in external forums, and 
collaboration with authorities. Repeated references to 
answers from Section 5.1.9 suggest overlap in practices 
for COP maintenance and threat tracking. Interviews 
confirmed the diversity of  mechanisms and highlighted 
the sector’s dependency on continuous information 
exchange and dedicated personnel.

Perceived Cyber-Threats Interview Results
During in-depth interviews with cybersecurity 
professionals and executives within financial institutions 
in Bangladesh, participants consistently identified cyber 

threats as a primary concern. Their responses reflect a 
shift from general awareness to a more acute recognition 
of  specific vulnerabilities that could impact the trust, 
continuity, and stability of  the financial ecosystem.

Two primary types of  cyber threats were emphasized
1. Continuity Disruptions – These include incidents 

such as denial-of-service (DoS) attacks, ransomware 
infections, and disruptions to core banking services, 
which could result in prolonged service outages or 
transactional rollbacks.

2. Data Breaches and Information Leaks – These are 
viewed as highly damaging, not only due to the financial 
implications but also because they could significantly 
undermine public confidence in the digital banking 
environment.
Interviewees also noted a dual-layered exposure to cyber 
risk. On the one hand, financial institutions must protect 
their IT infrastructure; on the other, they increasingly 
assume responsibility for managing or insuring against 
cyber threats on behalf  of  their customers, particularly 
in institutions exploring cyber insurance or managed 
services.
When asked about the most serious cyber threats, 
responses varied

• Infrastructure Attacks: Some highlighted threats 
to the country’s financial infrastructure—particularly 
real-time gross settlement systems, national payment 
switches, and mobile banking platforms—as potentially 
catastrophic.

• Social Engineering: Several respondents highlighted 
social engineering as a significant threat. Phishing, fake 
banking apps, and vishing scams are on the rise, preying 
on customer trust and the sector’s rapid shift to self-
service banking.

• Insider Threats: There was widespread concern about 
employees misusing access, whether intentionally or 
unintentionally, particularly in back-office operations or 
during remote work arrangements. This was often cited 
as an underestimated risk.
The role of  human error was consistently identified 
as a root vulnerability. With the widespread adoption 
of  mobile and internet banking in Bangladesh, many 
consumers are vulnerable to scams, as weak digital literacy 
compounds the risk. Some stakeholders stressed that “the 
weakest link in cybersecurity is no longer the firewall, but 
the finger that clicks ‘allow.’”
When discussing threat actors, respondents grouped 
them into four main categories

1. Financially Motivated Criminals: These actors use 
malware, fraudulent websites, and data scraping tools to 
steal directly from consumers or institutions.

2. Hacktivists and Ideologically Driven Actors: Though 
perceived as having limited capability in the region, their 
potential to disrupt or deface financial websites was 
acknowledged.

3. Insiders: Internal staff  with elevated privileges or 
access to sensitive data were flagged as a critical risk, with 



Pa
ge

 
81

https://journals.e-palli.com/home/index.php/ajgt

Am. J. Geo Spat. Technol. 4(1) 75-83, 2025

background screening, behavior monitoring, and activity 
logs suggested as countermeasures.

4. State and State-Sponsored Actors: While no specific 
examples were cited, several participants recognized 
these actors as a latent strategic threat, underscoring the 
importance of  collaboration with national intelligence 
and defense agencies.
There was also widespread agreement that cyber 
threat intelligence sharing remains underdeveloped in 
Bangladesh. Financial institutions operate in silos, and 
industry-wide collaboration is minimal. This lack of  
coordinated situational awareness and mutual defense 
hinders proactive response and rapid adaptation to 
emerging threats.
The consequences of  cyber incidents both intentional 
and accidental were described as potentially severe and 
cascading. Respondents stressed that disruptions to digital 
payment systems could cripple consumer confidence and 
daily commerce, particularly in an economy where digital 
transactions are rapidly replacing cash. One participant 
noted that, if  forced to triage during a cyber crisis, 
institutions would prioritize keeping mobile payment 
systems online over mortgage processing systems due to 
societal impact.
Several participants expressed concern about regulatory 
deadlines for digital transformations being too aggressive, 
often leading to rushed IT projects. Such hurried 
deployments were perceived as inadvertently introducing 
security flaws, bugs, and configuration errors, thereby 
opening doors for exploitation.
Ultimately, the interview results paint a picture of  a 
financial sector that is aware of  its exposure but still 
developing the tools, coordination, and culture needed for 
a proactive response. The traditional view of  cybersecurity 
as a reactive IT function is slowly evolving into a strategic, 
risk-informed discipline—but gaps remain in real-time 
monitoring, threat actor attribution, and cross-sector 
coordination. These insights directly inform the design 
priorities for a Next-Generation Cyber Threat Response 
EOC tailored to the needs and challenges of  Bangladesh’s 
financial sector.

Discussion
This section first revisits our methodological approach 
and discusses the findings in light of  existing theoretical 
insights relevant to cyber risk management in the 
financial sector. We then outline the potential limitations 
of  the study, as well as considerations around validity 
and reliability. Our study aims to deepen understanding 
of  cyber risk management practices in Bangladesh’s 
financial institutions, focusing particularly on the types 
of  information required to build an effective common 
operational picture (COP) and perceptions of  cyber 
threats. The data was gathered through surveys and 
interviews with key stakeholders across the financial 
sector, conducted alongside a multi-stakeholder cyber 
crisis simulation exercise (Mallik & Rahman, 2024).
Although digital transformation is widely recognized 

across the sector, the true gravity of  cyber risks has only 
recently gained full appreciation. Interview responses 
revealed a strong demand for information that aligns with 
fundamental situational awareness needs such as current 
system status, impact assessment, and plausible future 
scenarios while awareness around adversary behavior and 
the root causes behind incidents remains limited. This 
suggests that while technical monitoring and penetration 
testing are actively employed, a more comprehensive, 
strategic understanding of  cyber threats remains 
underdeveloped. Respondents frequently rely on external 
information-sharing forums or trusted individuals for 
threat intelligence rather than systematic internal analysis 
of  their technical data. This gap highlights a significant 
challenge: the lack of  processes to translate raw system 
events into actionable, higher-level insights that can 
inform risk management and decision-making in real 
time (Mallik, 2024).
A key finding is the widespread recognition of  the critical 
role that trust plays in the financial system. Maintaining 
public confidence during a cyber crisis is considered vital, 
with many interviewees emphasizing the importance of  
managing communications carefully and ensuring that 
accurate and truthful information reaches both internal 
and external audiences. Trust in the financial system, 
often fragile and complex, can erode quickly when 
cyber incidents become publicly known, posing systemic 
risks that extend beyond technical damage (Mallik et 
al., 2025). Interestingly, few participants focused on the 
motives or tactics of  adversaries or questioned how 
specific situations arose. This may reflect the general 
crisis management mindset within financial institutions, 
which often centers on isolated or natural incidents 
rather than sustained, intelligent cyberattacks. However, 
understanding adversary strategy is crucial to anticipating 
threat evolution and making informed, strategic decisions.
Our findings also reveal a desire to improve information 
sharing among stakeholders and with the media, recognizing 
that transparent and coordinated communication is key to 
preserving system-wide trust during cyber incidents. Yet, 
the absence of  robust collaborative mechanisms remains a 
challenge that a Next-Generation Cyber Threat Response 
EOC must address. Regarding threat perceptions, many 
of  the significant cyber risks identified globally including 
credential theft, data breaches, and disruptive malware—
were also recognized by respondents in Bangladesh’s 
financial sector. However, emerging concerns, such as 
the exploitation of  novel technologies or disinformation 
campaigns, were not prominently mentioned, potentially 
reflecting differing threat landscapes or varying awareness 
levels among stakeholders (Mallik & Rahman, 2024).
Notably, cyber risk management responsibilities are often 
distributed: individual institutions tend to handle real-
time intrusion detection, while intelligence gathering 
about threat actors is generally delegated to external 
agencies such as law enforcement. This division of  labor 
underscores the need for an integrated EOC that can 
coordinate across institutions and agencies, enabling a 



Pa
ge

 
82

https://journals.e-palli.com/home/index.php/ajgt

Am. J. Geo Spat. Technol. 4(1) 75-83, 2025

proactive and unified cyber defense posture. In summary, 
this study reveals a financial sector that is transitioning 
from reactive responses to a more proactive approach 
to cyber risk management. However, gaps remain in 
strategic situational awareness, adversary intelligence, and 
collaborative information sharing. Addressing these gaps 
through the design of  a dedicated, next-generation Cyber 
Threat Response EOC will be vital to strengthening 
Bangladesh’s financial sector resilience against evolving 
cyber threats.

CONCLUSIONS 
This section summarizes conclusions related to the 
study’s two primary research questions and offers 
recommendations for enhancing cybersecurity and risk 
management within Bangladesh’s financial sector. The 
first research question focused on identifying the critical 
information elements needed to establish an effective 
Common Operational Picture (COP) for cyber situational 
awareness within financial institutions.
Analysis of  stakeholder inputs revealed that information 
demands broadly align with key situational awareness 
requirements, such as understanding the impact of  cyber 
incidents, monitoring how situations evolve, assessing 
plausible future developments, and ensuring the reliability 
and quality of  underlying data.
However, several essential observations stand out

• There was limited interest in detailed information 
about adversary behaviors or the causal links between 
events and outcomes. This gap hinders the ability to 
develop a deeper understanding of  the cyber threat 
landscape, which is essential for anticipating future 
threats posed by strategic adversaries.

• A strong emphasis on technical details was evident, 
even among senior management. While technical data is 
vital at the operational level, leadership should also focus 
on higher-level questions, such as who the adversaries 
are, what their objectives might be, and why and how 
incidents occur. This shift is critical for strategic decision-
making.

• Information management emerged as a priority, 
with respondents highlighting the need for systematic 
approaches to handling, prioritizing, and communicating 
information. Given the financial sector’s heavy reliance 
on public trust, carefully structured communication 
strategies are essential to maintaining confidence during 
cyber incidents.
The second research question examined how cyber 
threats are perceived by financial sector actors in 
Bangladesh. There is a broad consensus that cyber threats 
constitute a significant concern in risk management. The 
primary assets at risk include the availability of  critical IT 
services and the confidentiality of  sensitive information, 
both of  which have direct implications for public trust 
in individual institutions and the sector as a whole. The 
perception of  cyber threats varies across subsectors. For 
example, insurers face a dual layer of  risk: safeguarding 
their IT infrastructure and managing the cyber risks they 

underwrite on behalf  of  their clients. Among the most 
serious threats identified are attacks targeting financial 
infrastructure, with social engineering techniques where 
attackers manipulate individuals to gain unauthorized 
access seen as the most dangerous vector. The erosion 
of  public trust resulting from successful attacks is widely 
regarded as the most severe consequence. Common 
threats such as theft and fraud, often facilitated by social 
engineering, were frequently noted. Insider threats, 
originating from trusted individuals abusing their 
legitimate access, were also considered significant. The 
threat actors are generally viewed as financially motivated 
criminals, although politically or ideologically driven 
activists are also recognized as potential risks.

REFERENCE
Alsamhi, S. H., Kumar, S., Hawbani, A., Shvetsov, A. V., 

Zhao, L., & Guizani, M. (2024). Synergy of  human-
centered ai and cyber-physical-social systems for 
enhanced cognitive situation awareness: applications, 
challenges and opportunities. Cognitive Computation, 
16(5), 2735-2755.

Arora, A. (2025). The Future of  Cybersecurity: Trends and 
Innovations Shaping Tomorrow’s Threat Landscape. SSRN 
5268161.

Auqui‐Caceres, M. V., & Furlan, A. (2023). Revitalizing 
double‐loop learning in organizational contexts: A 
systematic review and research agenda. European 
Management Review, 20(4), 741-761.

Bardin, J. S. (2025). Cyber Warfare. In Computer and 
Information Security Handbook (pp. 1345-1380). Morgan 
Kaufmann.

Carraro, M., Furlan, A., & Netland, T. (2025). Unlocking 
team performance: How shared mental models drive 
proactive problem-solving. human relations, 78(4), 407-
437.

Cespedes-Cubides, A. S., & Jradi, M. (2024). A review of  
building digital twins to improve energy efficiency in 
the building operational stage. Energy Informatics, 7(1), 
11.

George, A. S. (2024). Finance 4.0: The Transformation of  
Financial Services in the Digital Age. Partners Universal 
Innovative Research Publication, 2(3), 104-125.

George, A. S., Baskar, T., & Srikaanth, P. B. (2024). 
Cyber threats to critical infrastructure: assessing 
vulnerabilities across key sectors. Partners Universal 
International Innovation Journal, 2(1), 51-75.

Hawash, B., Mokhtar, U. A., Jeong, J. J., Maynard, S. B., 
Shukur, Z., Abdullah, S. N. H. S., ... & Ahmad, A. 
(2024). Cyber Situational Awareness in Security 
Operation Centres.

Jiang, P., Rowsell, J., & Schmidt, S. (2025). Crisis-
ready telecom: Global approaches to emergency 
management in telecommunications. Telecommunications 
Policy, 49(4), 102914.

Mallik, S. K. (2024). Analyzing Banking Sector Risk and 
Capital Allocation: A Study on the Improvement 
of  Risk-Weighted Assets and CRAR Compliance in 



Pa
ge

 
83

https://journals.e-palli.com/home/index.php/ajgt

Am. J. Geo Spat. Technol. 4(1) 75-83, 2025

2023.
Mallik, S. K., & Rahman, M. A. (2024). An analysis of  

business students learning styles to improve the 
effectiveness of  teaching methods.

Mallik, S. K., & Rahman, M. A. (2024). Smart agriculture 
as a driving technology for sustainability in intensive 
greenhouse production within smart manufacturing 
systems.

Mallik, S. K., Ali, M. R., Nahiduzzaman, D. M., Shoumik, 
S. C., & Torikul, M. (2025). Sustainable textile industry: 
Balancing growth and environmental concerns in 
Bangladesh.

Naseer, H., Desouza, K., Maynard, S. B., & Ahmad, A. 
(2024). Enabling cybersecurity incident response 
agility through dynamic capabilities: the role of  real-
time analytics. European Journal of  Information Systems, 
33(2), 200-220.

Nazir, A., Hussain, A., Singh, M., & Assad, A. (2025). 
A novel approach in cancer diagnosis: integrating 
holography microscopic medical imaging and deep 
learning techniques—challenges and future trends. 
Biomedical Physics & Engineering Express, 11(2), 022002.

Negi, P., Pathani, A., Bhatt, B. C., Swami, S., Singh, R., 
Gehlot, A., ... & Sikarwar, V. S. (2024). Integration 

of  Industry 4.0 Technologies in Fire and Safety 
Management. Fire, 7(10), 335.

Samunderu, E. (2024). Challenges and Complexities 
Affecting African Air Transport Market Development: 
A Skills, Competency, and Capacity-Building 
Perspective. In The Economic Effects of  Air Transport 
Market Liberalisation: A Perspective Analysis of  the Single 
African Air Transport Market (SAATM) (pp. 499-639). 
Cham: Springer Nature Switzerland.

Smidt, H., Johansson, J., & Richter, T. (2024). Civil society 
under attack: The consequences for horizontal 
accountability institutions. Studies in Comparative 
International Development, 1-30.

Vasiliu-Feltes, I. (2024). Safeguarding financial resilience 
through digital trust and responsible innovation. 
Journal of  Risk Management in Financial Institutions, 
17(2), 130-141.

Vasiliu-Feltes, I. (2024). Safeguarding financial resilience 
through digital trust and responsible innovation. 
Journal of  Risk Management in Financial Institutions, 
17(2), 130-141.

Yu, Z., Wang, J., Tang, B., & Lu, L. (2023). Tactics and 
techniques classification in cyber threat intelligence. 
The Computer Journal, 66(8), 1870-1881.


