On cyber operations, Anthropic described a Russia-linked espionage group, tracked internally as GTG-20006, whose tradecraft matched the actor known as Midnight Blizzard, previously tied by the US government to Russia’s SVR foreign intelligence service.

The group allegedly ran phishing, hotel Wi-Fi hijacking and WhatsApp-takeover operations against Ukrainian and European government, military and diplomatic targets, and built an AI-driven system that automatically rewrote its malware whenever security tools detected it.

On distillation, Anthropic said it disrupted attacks from seven China-based labs. It named Alibaba, Moonshot, DeepSeek and Xiaomi among them.

Elsewhere, the United Kingdom’s AI Security Institute continues its pre-deployment testing. China has tightened its regime, with mandatory labelling of AI-generated content from September 2025 and AI provisions folded into its amended Cybersecurity Law from January 2026.

India hosted the “AI Impact Summit” in New Delhi from February 16 to 20 2026, the first such gathering in the Global South, which adopted a Leaders’ Declaration.

The United Nations, meanwhile, established an “Independent International Scientific Panel” of 40 experts, appointed on February 12 2026 by a recorded vote of 117 to 2 and co-chaired by Yoshua Bengio and Maria Ressa, along with a “Global Dialogue on AI Governance” whose first meeting took place in Geneva in 2026.

Will anything change?
Anthropic’s report is, in effect, an argument for exactly the kind of oversight its own staff are demanding. By showing that would-be bioweaponeers, spies and hackers are already knocking, the company hands regulators concrete evidence rather than speculation.

Whether that shifts policy is another matter. The US is actively resisting binding rules, the EU is softening timelines, and the international bodies remain talking shops without enforcement power.

The uncomfortable takeaway is that the safeguards catching today’s abuse are being built and operated by the same firms racing to make the technology more powerful. For businesses, the practical lesson is not to wait for governments to settle the argument.

Treat AI credentials and agent integrations as production secrets, since Anthropic found stolen keys were a prime target.

Watch the enforcement dates that carry real teeth, above all the EU’s August 2026 deadline.

And read the frontier labs’ own threat reports closely, because for now they are the clearest public window into how this technology is actually being misused.

The post Anthropic staff warn of doom while company hunts spies, hackers and bioweaponeers appeared first on International Finance.

Camus’ statement comes amid European banks voicing concerns that they could lag their American counterparts in terms of accessing the most advanced cybersecurity-focused AI models, potentially creating significant operational and resilience gaps between the financial landscapes on both sides of the Atlantic.

“The speed and scale at which AI systems can now identify flaws marked a fundamental shift for cybersecurity teams, adding that the immediate challenge is a practical one,” Camus noted.

“There is a lot of noise in the ⁠market on Mythos and the fact that Mythos is accessible or not accessible for some banks, particularly European banks,” he observed at a joint press conference with French startup Mistral.

American AI company Anthropic’s Mythos model, unveiled in April 2026, has been designed to identify vulnerabilities across software systems at unprecedented speed and scale. However, a section of the financial circle has raised the red flag by stating that such innovation could also be used to enable a wider range of cyberattacks on institutions.

“The game changer is the speed at which we have to address vulnerabilities and the scale. There are lots of them discovered at once. So, we need to prepare ourselves for that, and that’s something we are really working ‌on ⁠very, very hard. Cybersecurity teams are now facing the need to process and fix large volumes of vulnerabilities in parallel,” Camus said.

BNP and Mistral have been in a partnership since 2023. And the scope of operations has expanded now, with Corentin Petit, Mistral’s global head of solutions, stating that the venture, through its tie-up with BNP Paribas, was focusing ⁠on benchmarks relevant to regulated industries such as banking. Mistral engineers and data scientists have been embedded within BNP teams to co-develop and scale various AI-powered projects.

“BNP uses Mistral for internal tools ⁠and virtual assistants for clients in France and Belgium, as well as compliance at its Belgian Fortis business,” said Sophie Heller, chief transformation officer at BNP’s retail and consumer division.

“At BNP’s investment banking unit, ⁠other deployments support document extraction, equity research and internal knowledge retrieval for tens of thousands of staff,” remarked Charles Holive, chief AI officer at the division.

The post BNP Paribas-Mistral partnership to focus on AI defences appeared first on International Finance.

International Finance discussed the issue with Kamran Chaudhary, who is a 25-year veteran who specialises in Governance, Risk, and Compliance (GRC) frameworks and cybersecurity. Kamran serves as Vice-President of Solutions Engineering at VikingCloud where he is responsible for solution scoping, alignment, training, and demos.

Kamran has collaborated with a diverse range of industries, from finance and healthcare to technology and government, leveraging a deep understanding of risk management to build tailored solutions that address unique challenges.

In an exclusive interview with International Finance, Kamran Chaudhary explains how VikingCloud simplifies PCI compliance for SMBs through continuous monitoring, proactive updates, and AI-driven insights. He also addresses risks and closes compliance gaps, ultimately helping clients achieve success in global operations.

What sets VikingCloud apart from competitors when supporting small and mid-sized businesses with PCI DSS compliance?

What really sets us apart is that we don’t look at SMBs as just a smaller version of an enterprise problem. Our Continuous Compliance Management (CCM) approach takes the PCI burden completely off the merchant’s plate so they can focus on running their business and delivering a great guest experience, something truly unique to VikingCloud. We’ve developed dedicated solutions for small and mid-sized businesses that are built to deliver rapid, cost-effective, and uncomplicated compliance for businesses that may not have their own internal security resources. On top of that, we bring 25-plus years of PCI expertise and our Asgard Platform, which provides clients with real-time visibility of their compliance status. More than 4 million businesses around the globe trust us because we show up as a partner, not just a vendor.

As PCI DSS requirements continue to evolve, what strategies are in place to ensure clients are prepared before new standards become mandatory?

We monitor the guidance put out by the PCI SSC and ensure that we are already ahead of any changes before they are required, not after. For instance, when the PCI DSS 4.0 came out, we were already ahead of it, and 4.0.1 since then. We also take the information provided in the updates and make sure that we’re communicating it in a way that’s easy to understand so that clients aren’t surprised by any changes, and we offer webinars and other direct communication to ensure that we’re walking them through exactly what’s changing and what needs to be done. We want to make sure that compliance is an ongoing process, not a fire drill every time a new version is released.

Many small businesses underestimate the risks of non-compliance. What approaches are used to educate and engage clients who may not initially prioritise PCI compliance?

To be honest, the biggest change comes when we make it real and tangible for them in terms of non-compliance. The reality for small business merchants is that they often simply check ‘yes’ for all PCI requirements without truly understanding what’s required to become compliant. Non-compliance fees start small at $50 to $100 per month, but can quickly escalate into thousands. Business owners who aren’t PCI compliant are also personally responsible for the costs associated with a potential data breach. VikingCloud simplifies the entire process by educating business owners about their specific requirements and delivering turn-key programmes that take the guesswork out of PCI, and with ransomware now making up 88% of small business attacks, the stakes couldn’t be higher. We lead with those numbers, but we also lead with making it accessible for them so it doesn’t feel so daunting for business owners who are already trying to wear ten hats at once. Once we make it accessible to them, then we have their attention.

Which compliance gaps are most frequently identified in small businesses, and what steps are typically taken to resolve them efficiently?

The most common gaps we see with Level 4 small business merchants are log retention — PCI requires one year of logs with daily reviews, which is expensive to set up independently — security awareness training, where PCI requires proof of training upon hire and annually for all in-scope employees, and secure remote access with two-factor authentication. Many SMBs simply aren’t aware these requirements exist until they’re flagged. We start with a vulnerability scan and a scoping exercise to get clarity on the gaps, and then develop a remediation plan where we address the high-risk gaps first. We use the platform to track everything so nothing falls through the cracks. Time is of the essence.

How does the company maintain strong security controls while minimising operational disruptions for businesses that process payments daily?

Security must be a friend rather than a foe to the business because, if we make it too difficult, people will work around it. We operate on a model of continuous background monitoring rather than disruptive assessments, running 24/7 with our Asgard Platform, detecting threats and highlighting them before they can cause damage. We’ll actually schedule in remediation when it can be done during peak times, so it doesn’t interfere when it can least be afforded. We’ll also remove the burden from our internal teams so that we can continue to serve our customers while we handle the security behind the scenes.

Where does automation or AI contribute most effectively in monitoring, reporting, and maintaining PCI compliance across global operations?

That’s where the scale problem pays off, though, because AI earns its keep here. We process over six billion online events per day, so no human team can manually review all of those events. Modern AI, and other machine learning before that, has helped us shift from a reactive model to a predictive model, detecting anomalies and new threats before they become incidents. On the compliance side, AI provides audit-ready documentation, tracks status in real-time, and points out gaps to aid the real people responsible, ultimately speeding the time to reporting. For clients who span multiple locations or even countries, this level of consistency matters: same level of rigour, everywhere, all the time.

Since VikingCloud operates in over 70 countries, how do regional regulations or cultural differences impact the compliance strategy?

PCI DSS is a worldwide standard, but the world around it is not necessarily so. In the EU, clients are also dealing with GDPR. In APAC and Latin America, clients are dealing with local payment regulations, in addition to their PCI requirements. We have in-region expertise that can help clients understand how these areas intersect, so clients don’t have to be experts in each area. Cultural nuances also come into play, such as how we communicate compliance needs to a large retail client in Germany versus a growing hospitality business in Southeast Asia. Localising is not just desirable; it is what makes it work.

What does cross-functional collaboration look like among compliance, sales, product, and support teams to deliver a seamless client experience?

We strive to ensure the client experience does not slip through the cracks between teams. Our compliance team, product team, and support teams all have feedback loops that feed directly into the way we build and improve our product. Our sales team is trained to ensure the client has the right expectations at the beginning, so they are not surprised down the road. We use internal visibility to ensure we can identify client health and address any potential issues promptly. A contract is not the end result; a compliant, protected, and secure client is.

Beyond PCI certification, what metrics or indicators are used to evaluate long-term client success and risk reduction?

Certification is a milestone, not the destination. We monitor things like the reduction in total vulnerability count over time, the average time taken to detect and respond to threats, and the ratio of high-risk issues resolved compared to the number still open. We also monitor whether the client is doing the controls in between cycles and not just preparing for the audit season. Clients who are engaging with the platform are in a much healthier security state. But at the end of the day, the real measure is whether the client has had fewer issues and has reduced their overall risk posture.

Which traits or skills distinguish the most successful team members who support businesses navigating complex compliance environments?

While technical knowledge is important, it’s not the only factor. The people who make the most impact are the people who, given something complex, are able to make it clear and understandable to a person who runs a pharmacy or a hotel chain, not a security expert. Curiosity is a huge factor because the threat space never stops changing. The best people in this space are always curious, always learning. And then, beyond all of those, I think it’s just a matter of empathy, of patience, because compliance only works if the person on the other side of the conversation trusts you, so gaining their trust is as important as any other factor.

The post PCI certification is a milestone, not the destination: Kamran Chaudhary appeared first on International Finance.

The model is called Claude Mythos Preview. By every available metric, it is the most capable AI system ever evaluated. It can find hidden flaws in software that human programmers missed for decades. It can break into computer systems the way a seasoned hacker would, step by step, adapting as it goes. It can chain together multiple separate vulnerabilities to seize complete control of a server. And it can do all of this faster, cheaper, and at a scale that no team of human experts could match.

Anthropic decided that releasing this to the public would be, in their own estimation, too dangerous. Anthropic warned: “AI models have reached a level of coding capability where they can surpass all but the most skilled humans at finding and exploiting software vulnerabilities,” adding that such advances could pose significant threats to economic stability, public safety, and national security.

Instead, they handed access to a closed group of roughly 40 of the world’s largest corporations, gave them USD 100 million worth of computing credits, and called the whole thing Project Glasswing. The stated goal is to use Mythos to find and fix security flaws in the world’s most critical software before someone with bad intentions gets their hands on similar technology.

What follows is an attempt to explain what exactly Mythos can do, why it was locked away, who got the keys, and why none of this is quite as clean as Anthropic would like you to believe.

What Makes Mythos Different

To understand the alarm, you have to understand how AI models are normally tested. Researchers use benchmarks, essentially standardised tests, to compare one model against another. Most previous AI models were good at solving packaged coding problems neatly, the kind you might find in a textbook.

Mythos operates differently. It excels at the messy, poorly documented, real-world environments that software engineers and hackers actually deal with. On a benchmark called SWE-bench Pro, which assesses a model’s capacity to autonomously complete complex software engineering tasks through multiple steps, Mythos achieved a score of 77.8%. The previous best model scored 53.4%. That’s not a small jump.

On a benchmark called Capture the Flag, which simulates the kind of adversarial hacking challenges used to train professional cybersecurity researchers, the previous best AI model scored below 1%. Mythos scored 73%. That is not an incremental improvement. That is a different category of capability.

“AI capabilities have crossed a threshold that fundamentally changes the urgency required to protect critical infrastructure from cyber threats, and there is no going back. Our foundational work with these models has shown we can identify and fix security vulnerabilities across hardware and software at a pace and scale previously impossible. That is why Cisco joined Project Glasswing: this work is too important and too urgent to do alone,” explains Anthony Grieco, SVP & Chief Security & Trust Officer at Cisco.

The benchmark that made people most uneasy is called CyberGym. It measures a model’s ability to reproduce and trigger known cybersecurity vulnerabilities, flaws in real software that real attackers exploit. Mythos scored 83.1%. The world’s existing security scanning tools didn’t just fall behind. They became, overnight, dramatically less relevant.

What It Found During Testing

Benchmark scores are abstract. The actual discoveries Mythos made during internal testing are not.

The first was a 27-year-old security flaw in OpenBSD, an operating system that has a global reputation for being exceptionally secure. OpenBSD is used to protect critical network infrastructure around the world. This flaw had been sitting there since the late 1990s, invisible to every human auditor and automated tool that ever looked at it.

The second was a 16-year-old flaw in FFmpeg, a piece of open-source software embedded in a staggering number of applications that handle video, from streaming platforms to video editing tools. Automated testing tools had run through the relevant code pathway over five million times without triggering the flaw. Mythos found it by understanding the logic of the code, not just running tests until something broke.

The third, and the most troubling, was something more than an isolated bug. Mythos found multiple separate vulnerabilities in the Linux kernel and connected them into a chain. Starting with zero special access, it escalated its own privileges step-by-step until it had root control of a server. Complete control. This is the kind of attack that typically requires months of work by a skilled human team. Mythos did it autonomously.

This is where the alarm becomes existential rather than technical. The traditional timeline for a cyberattack involves extensive reconnaissance, careful planning, and skilled human labour at every step. Mythos compresses that timeline to minutes. It doesn’t just assist attackers. It could, in the wrong hands, replace them entirely.

The Government Weighed In

Before any of the Project Glasswing decisions were made, Anthropic allowed the United Kingdom’s AI Safety Institute, a government body set up precisely to evaluate these kinds of risks, to put Mythos through its paces independently.

The institute used a simulation called The Last Ones, a 32-step corporate network attack that starts with a hacker on the outside and ends with them in complete control of a company’s entire digital infrastructure. For a skilled human expert, completing this simulation takes roughly 20 hours.

Mythos became the first AI system in history to complete it from start to finish on its own. In their final report, the institute said the model ‘could execute multi-stage attacks on vulnerable networks and discover and exploit vulnerabilities autonomously’.

To be fair, the institute included important caveats. Mythos was tested against small, lightly defended networks. No active human defenders were watching for intrusions.

In a simulation involving industrial control systems for physical infrastructure, Mythos got confused and failed.

An AI that makes a lot of noise and triggers every alarm is more like a sledgehammer than a scalpel. Against a hardened, actively monitored enterprise network, its real-world effectiveness remains unproven.

Who Gets The Keys

Anthropic named the initiative after the glasswing butterfly, a species with transparent wings that allow you to see flaws hiding in plain sight. The metaphor is deliberate. The idea is to use Mythos to illuminate vulnerabilities before attackers can exploit them.

The company explained on its blog, “The same capabilities that make AI models dangerous in the wrong hands make them invaluable for finding and fixing flaws in important software. Project Glasswing is an important step toward giving defenders a durable advantage in the coming AI-driven era of cybersecurity.”

The launch partners include Amazon Web Services, Google, Microsoft, Apple, Cisco, Broadcom, NVIDIA, CrowdStrike, Palo Alto Networks, JPMorganChase, and the Linux Foundation. These are not scrappy startups. They are the companies that own the infrastructure on which the internet runs.

Anthropic also donated $4 million in cash directly to open-source software foundations. This matters because the most vulnerable part of the internet isn’t Google or Microsoft. It’s the small, underfunded volunteer teams maintaining foundational open-source libraries that billions of devices quietly depend on.

The logic Anthropic is working from is fairly straightforward. Offensive AI capabilities will proliferate. The only viable response is to arm defenders first, patch as many vulnerabilities as possible before attackers arrive, and hope the window of advantage holds long enough to matter.

The Problem Nobody Wants To Say Aloud

Here is the uncomfortable truth sitting under all of this. Finding vulnerabilities is not the hard part anymore. Fixing them is.

Mythos can surface thousands of previously unknown security flaws in a very short time. The Linux kernel alone has millions of lines of code, and patches to foundational code have to be written carefully and deployed across millions of systems. That work is slow and manual. Within the security community, the consensus is grim. Finding vulnerabilities is no longer the hard part. The bottleneck is now human. If Mythos floods the pipeline with thousands of flaws, we simply don’t have enough qualified humans to fix them before attackers reverse-engineer the public patch notes.

The $4 million in donations helps, but it’s a bandage on a structural wound. There’s also a harder question buried here. Who decided that Google, Microsoft and JPMorganChase should be the guardians of the world’s digital security? Handing them exclusive access means they can protect their own products first, their competitors last, and everyone else not at all.

The Anti-Trust Problem

Legal scholars noticed immediately. By restricting access to Mythos to a hand-picked group of 40 corporations, Anthropic has created what critics are calling the “AI Avengers,” a private club with an insurmountable competitive advantage.

Section 1 of the Sherman Antitrust Act prohibits agreements between competitors that restrain trade. Madhavi Singh, Deputy Director of the Thurman Arnold Project at Yale, warns, “While the cybersecurity risks are serious, we must ensure that the consortium doesn’t become a front for a cartel, or entrench incumbents by gatekeeping access to advanced AI capabilities.”

Take browsers as a concrete example. Google’s Chrome and Apple’s Safari are inside the consortium. Their teams can use Mythos to patch vulnerabilities before those flaws are public. Independent browser developers are not in the consortium. Their products will objectively be less secure, not because their engineers are worse, but because they were not invited to the party.

Sam Altman Calls It Fear Marketing

Not everyone accepts Anthropic’s framing. OpenAI CEO Sam Altman has been the most public and blunt critic. On a podcast, he described the strategy in terms that didn’t leave much room for ambiguity: “It’s like telling someone you’ve built a bomb, you’re about to drop it on their head, and you’re now selling them a USD 100 million bomb shelter.”

Altman argues that Anthropic is deliberately inflating the perceived danger of Mythos to create artificial scarcity and sideline independent developers. Safety, in this reading, is a marketing strategy.

Anthropic CEO Dario Amodei has not been quiet in response. Internal communications leaked to the press showed Amodei describing OpenAI’s criticisms as tactics designed to undermine Anthropic’s regulatory standing. His core argument is that these dangerous capabilities emerged as a by-product of the model becoming generally smarter. If that’s true, then restricting the model isn’t theatre. It’s the only rational response.

The Breach

None of this discussion about containment has aged especially well, because the model was breached within weeks of the announcement.

Bloomberg reported that a small group of unauthorised users on a private Discord server had successfully accessed Claude Mythos Preview. They used the credentials of a contractor working for a third-party data labelling firm, cross-referenced with data leaked from a staffing startup called Mercor.

The group hasn’t used Mythos to hack anything yet. According to Bloomberg, they are more interested in ‘playing around’ with the tech than causing trouble. A claim that has been corroborated via screenshots and a live demonstration of the model.

“We’re investigating a report claiming unauthorised access to Claude Mythos Preview through one of our third-party vendor environments,” stated Anthropic.

But the symbolic damage is significant.

The chain is only as strong as its weakest link, and the weakest link is not Google’s security team. They’re low-paid freelancers in third-party companies who may not even know how valuable the access they hold actually is.

What Comes Next

The Mythos situation is a preview of a structural shift that’s accelerating. State-of-the-art AI is becoming a national security infrastructure. The hardware required to run models of this complexity costs billions. The economics are pushing toward a world where the most powerful AI is available only to sovereign governments and a small number of hyperscale corporations.

For everyone else, the model announced for public use is Claude Opus 4.7, a capable but deliberately restricted system. Anthropic has promised a Cyber Verification Programme that would give vetted security professionals access to more capable models, but that’s still a gatekeeping system based on institutional affiliation.

The window to patch the world’s software before AI-powered attacks become routine is real, but it’s narrow and currently controlled by a small group of private corporations. What Project Glasswing represents is the first serious attempt to answer the question of who governs the most dangerous software ever built. The answer, for now, is not you.

The post Project Glasswing: The invite-only club for Claude Mythos appeared first on International Finance.

Google’s Threat Intelligence Group (GTIG), partnering with Mandiant (a subsidiary of Google Cloud and a premier cybersecurity firm specialising in threat intelligence, incident response, and managed defence) and others, ended up exposing Chinese state-backed organisation UNC2814’s spy operations. The group has now been classified as an Advanced Persistent Threat (APT).

In the most recent campaign, the organisation used GridTide, a backdoor malware that had never been seen before and used the Google Sheets API for C2 infrastructure. The backdoor blends with regular company traffic and causes no concerns because it sends HTTPS queries to authentic Google infrastructure rather than connecting to a distant server to obtain commands and steal data.

Every command is kept in a spreadsheet cell within an attacker-owned document. The malware periodically examines, decodes, and executes the encoded instructions that the operators inject into designated rows or cells.

Exfiltrated data may occasionally be written back into the sheet. GTIG stated that it did not see any examples of data exfiltration. With reports of its activity dating back to 2017 or potentially earlier, UNC2814 is a somewhat well-known threat actor.

Google terminated all of the attackers’ authority over Google Cloud Projects as part of the disruption operations, cutting off their ongoing access to GridTide-compromised environments. They restricted access to the Google Sheets API requests, disabled attacker accounts, and located and stopped all known UNC2814 infrastructure. Lastly, it published a list of IoCs connected to the UNC2814 infrastructure that has been operational since at least 2023.

The campaign started in 2023 and affected at least 53 organisations in 42 countries. Google suspects that UNC2814 is present in at least 20 more countries. Most of Latin America, Eastern Europe, Russia, parts of Africa, and parts of South Asia seem to have been hit. Except for Portugal, Western Europe is mostly unscathed. The United States was not touched as well.

The activity is distinct from separate high-profile, telecommunications-focused Chinese hacking activity tracked as “Salt Typhoon,” Google told Reuters. That campaign, which the US government has linked to Beijing, targeted hundreds of American organisations, in addition to prominent political figures.

Chinese Embassy spokesperson Liu Pengyu, while reacting to the news, said, “Cybersecurity is a common challenge faced by all countries and should be addressed through dialogue and cooperation. China consistently opposes and combats hacking activities in accordance with the law, and at the same time firmly rejects attempts to use cybersecurity issues to smear or slander China.”

The post Google disrupts Chinese hacking operations in more than 40 nations appeared first on International Finance.

In this backdrop, Brooklyn-based Outtake, whose agentic cybersecurity platform helps enterprises detect, investigate, and take down identity fraud, has raised a USD 40 million Series B round of funding. While the amount may not sound huge compared to the capital raised by Outtake’s industry peers, the funding round hit the headlines due to the list of participating angel investors, which included Microsoft CEO Satya Nadella, Palo Alto Networks CEO Nikesh Arora, Pershing Square Holdings CEO Bill Ackman, Palantir CTO Shyam Sankar, Anduril co-founder Trae Stephens, former OpenAI VP Bob McGrew, Vercel CEO Guillermo Rauch, and former AT&T CEO John Donovan.

Knowing The Player In Detail

Outtake, established in 2023 by former Palantir engineer Alex Dhillon, has come up with a fix when it comes to automating what has largely been a manual problem: spotting and taking down digital identity posers, entities like impersonation accounts, malicious domains posing as companies’ official websites, rogue apps, fraudulent ads, and more.

Outtake has customers like OpenAI, British financial services company Pershing Square, and American mobile technology company AppLovin, along with several federal agencies. OpenAI even profiled the company in July 2025 as an example of an agentic start-up built on its reasoning models.

Outtake’s ARR (Annual Recurring Revenue) has increased six times year-over-year, while its customer base grew more than ten times. This shows one thing: while the demand for foolproof cybersecurity solutions is expanding rapidly, the 21st century’s global socio-economic order is also taking the threat of digital identity theft more seriously than ever.

According to Dhillon and his team, two-thirds of identity theft-related attacks now utilise some form of AI, remarking, “the question isn’t whether your organisation will be targeted, it’s whether your defences can match the sophistication of AI-powered threats that are reshaping the very nature of cybercrime.”

So, what is Outtake dealing with? The rising menace of bots, with a 2024 study claiming that 30% of accounts across major social media platforms are likely to be fake. These bots are used to spread scams, steal identities, or manipulate public opinion.

Then add the 703% increase in credential phishing attacks, thanks to the widespread availability of AI-generated phishing kits online. We also have a 202% increase in phishing emails, with generative AI tools and automation again helping hackers compose phishing emails up to 40% faster.

Making ‘Digital Trust’ Great Again

Talking about Outtake’s “AI-Driven Intelligence for Open Sources,” the start-up’s AI agents cut through noise and contextualise risks in real time by delivering the early warning security teams need to protect people, reputation, and operations.

“Manual OSINT (Open-Source Intelligence) workflows can’t keep pace with today’s threat landscape. Security analysts spend hours chasing false positives, triaging repetitive alerts, and piecing together fragments from multiple sources,” the venture stated, further pointing out issues like manual backlogs (with threat actors quickly shifting their campaign methods by the time analysts detect and manually remediate a threat), an endless streak of false alerts (with keyword-based monitoring generating endless dead ends, burying investigators in irrelevant hits and obscuring the real signals that matter), and manual correlation of findings (with cybersecurity teams seeing isolated incidents as big wins rather than uncovering the full campaign across platforms and sources).

To counter these, Outtake has bet big on AI agents, which continuously discover and analyse images, videos, audio, and text across the open web, delivering contextualised intelligence without the manual overhead. They track emerging narratives (upcoming cybercrime trends) and force-protection campaigns before they escalate into reputational or physical risks.

Legacy traditional tools often end up missing threats from social platforms, forums, and open sources, something that Outtake’s AI agents address thoroughly, taking things further to “Location-Based Risk Intelligence” by mapping chatter tied to physical locations to anticipate risks to executives, facilities, and events.

Also, “AI-Driven Intelligence for Open Sources” keeps its client businesses safe by monitoring third-party players like vendors, partners, and acquisition targets for emerging risks. After everything, Outtake distils millions of signals into clear, prioritised summaries before delivering threat digests directly to clients’ inboxes or collaboration tools, customised to the latter’s security priorities.

Next are “Digital Risk Protection” agents that, in the start-up’s language, provide “AI that tirelessly detects, prioritises, and dismantles impersonation threats across domains, social media, apps, and ads.” When it comes to proactively identifying and eliminating digital impersonation threats, traditional methods are trailing severely. How? First of all, they are drowning in AI-generated noise due to the widespread availability of AI-generated phishing kits online.

Attacks are getting sophisticated and fast-paced, with threat actors diversifying their mediums. Apart from missing threats hidden in images, videos, code, and visual brand abuse, legacy keyword tools end up chasing nodes while missing well-coordinated campaigns. These solutions are only capable of tackling isolated threats instead of going after the full attack ecosystem. They can’t connect signals across platforms, leaving coordinated campaigns intact and growing.

“Digital Risk Protection” agents have been tailored with social engineering scams in mind—criminal acts that exploit human psychology to trick individuals into divulging confidential information, transferring money, or installing malware. These attacks are known for impersonating trusted entities or businesses through phishing (emails), vishing (phone calls), or smishing (SMS). Outtake’s solution goes aggressively after these elements, removing fake brand and executive impersonations across all platforms while continuously mapping threat infrastructure across digital mediums, revealing the hidden links that single-point tools overlook.

Be it fraudulent phishing, malware domains, fake mobile apps, or deceptive marketplace listings, “Digital Risk Protection” agents have been tasked with one job: monitor, identify, and take down.

Redefining Digital Verification

Business Email Compromise (BEC), which targets organisations through deceptive emails, skyrocketed in 2025, with Barracuda’s “Email Security Breach Report” registering a staggering 78% of surveyed organisations worldwide experiencing an email security breach throughout the year, with the lack of expertise, automation, and awareness ending up costing companies money, reputation, customers, and growth prospects.

Against this backdrop, Outtake has launched a device- and identity-bound authentication tool via World ID or passkeys, as AI is known for generating both phishing and legitimate emails. “Outtake Verify” has evolved as a browser extension that cryptographically verifies a business’ identity (through mathematical proof instead of probabilistic guessing) and signs the company’s emails. Even if the official mail account gets hacked, Outtake still ensures that these compromised accounts can’t send verified emails by denying attackers device-bound authentication.

The solution not only improves internal email security for Outtake’s client organisations, but it also increases trust in third-party communications by making the whole digital environment secure. “Outtake Verify” also reduces the burden on human cybersecurity professionals within a team by taking over tasks like verifying executive payment approvals, eliminating out-of-band confirmations, ensuring sensitive documents come from authenticated sources with message integrity, and extending trust beyond organisational boundaries by requiring authentication from key vendors.

The post Start-up of the Week: Outtake tackles next-gen identity fraud appeared first on International Finance.

Recently, Cybernews confirmed a post on a popular hacker forum, likely made by the alleged perpetrators, claiming 353 gigabytes of data were stolen during a breach of Doctor Alliance’s network. For now, the data has not been leaked, with the user going by the alias “GOD” threatening to either post or sell the information on November 21, 2025, in case a ransom of USD 200,000 is not paid.

Alias “GOD,” who likely represents a group of individuals, released a small 200 MB sample to prove they have the files. As per Cybernews, the revealed files include “various medical records, riddled with sensitive personal data,” specifically details on patient prescriptions, treatment plans, names, health insurance numbers, phone numbers, home addresses, hospital orders and more.

In the United States, such data access would constitute a reportable breach under the terms of the Health Insurance Portability and Privacy Act (HIPAA). Cybersecurity researchers now believe the trove, if determined to be legitimate, poses a serious risk to patients and employees, as it could all be used for identity theft, blackmail or other nefarious purposes. This includes not only medical identity theft but also insurance fraud.

“This data leak poses a huge risk of identity theft and medical fraud for the patients involved, such as obtaining medical services or prescription drugs in the victim’s name. Both doctors and patients can fall victim to social engineering attacks,” remarked the researchers.

While promising that the data would be deleted if the ransom is paid, the alleged cybercriminals in a post refused to divulge details like when the attack took place and what vector was used. No known hacker outfit has claimed credit for the attack.

The post Cyberattack on healthcare firm Doctor Alliance: All you need to know appeared first on International Finance.

As industries are embracing AI and technology rapidly, so are the worries around cybersecurity. Enterprises prioritise protective measures against online attacks and hacks, prompting businesses to spend more on safeguarding their domains.

Against this backdrop, Chainguard, whose customers include Anduril, ANZ Bank, Canva, GitLab and Hewlett Packard Enterprise, has stood up to the occasion by providing tools and services to help clients keep their software secure. At the same time, it is also cementing its place as a key cybersecurity player, as it has so far raised USD 612 million. The start-up, founded in 2021, grew its annual recurring revenue seven times to USD 40 million in fiscal year 2025.

In today’s episode of the “Start-up of the Week,” International Finance will talk about the company in detail.

The Safe Source For Open Source

Chainguard has built a secure, trusted software supply chain that “empowers teams to build the future instead of patching the past.”

“The status quo in open source has led to high-profile security breaches, countless hours of engineering toil, and compliance failures. Enterprises need a new mechanism for open-source software delivery,” the start-up stated.

The safe open-source software has been rebuilt from source in secure environments with end-to-end integrity, with the vision of ensuring a future where security and innovation move in lockstep and every line of code makes software safer.

“As high-profile attacks exposed systemic weaknesses, organisations struggled to secure their development pipelines without adding friction for engineers. Existing solutions were complex, reactive, and often ineffective, so Chainguard set out to build a safe source for open source. Today, Chainguard helps organisations eliminate threats in their software supply chains by providing guarded open-source software, built from source and updated continuously,” the company added.

Chainguard’s software supply chain has enabled its client companies to save 288,000 engineering hours. Additionally, it has addressed more than 72,000 Common Vulnerabilities and Exposures (CVEs)—a widely recognized list of publicly disclosed security flaws in computer systems. Most importantly, this effort has resulted in an 80% reduction in the attack surface.

Chainguard’s software supply chain is run by “Container Image Security,” which builds, ships, and runs hardened, minimal container images.

The company commented, “Our suite of hardened, minimal container images help developers start secure and stay secure throughout the software development lifecycle. With 97.6% fewer vulnerabilities than alternatives, Chainguard Containers help you reach vulnerability requirements for compliance frameworks like NIST 800-53, FedRAMP, or StateRAMP.”

The software supply chain performs another crucial function called “Vulnerability Remediation,” where it prioritises speed and precision to eliminate CVEs daily in the open-source software the client companies consume, so the latter’s developers can spend their time honing their craft. No more constantly monitoring security spreadsheets, running known-vulnerable software, or manually patching images.

When it comes to compliance and risk mitigation, the Chainguard Containers solution eliminates vulnerabilities in the clients’ containers that repeatedly impact their compliance certifications for FedRAMP, PCI-DSS, SOC 2, and more. Human cybersecurity professionals get relieved of repetitive tasks like patching, updating, and hardening container images to meet and maintain compliance requirements faster.

The start-up also helps its clients build secure software with images that include Signatures, SLSA Provenance (verifiable information about software artefacts describing where, when and how something was produced), and SBOMs (Software Bill of Materials is a comprehensive inventory of all the software components, including their versions, dependencies, and associated metadata, that make up a software application), thereby providing the building blocks for a secure software supply chain.

On the AI/ML Security front, Chainguard AI Images are a suite of CPU and GPU-enabled container images, including popular frameworks like PyTorch, Conda, and Kafka. These images are hardened, minimal, and optimised for efficient AI development and deployment. By leveraging Chainguard AI Images, organisations can confidently secure their AI infrastructure, streamline vulnerability management, and maintain high performance with low-to-zero vulnerabilities.

PCI DSS (Payment Card Industry Data Security Standard) requirements for vulnerability management drive add significant worry and complexity for companies investing in their digital architectures, especially when it comes to the data authentication task.

Chainguard simplifies PCI compliance with minimal, zero-CVE containers built entirely from source. The start-up offers minimal, zero-CVE images by default, shrinking its clients’ compliance and auditing worries from day one.

Chainguard helps its clients eliminate PCI DSS overhead and costs with source build pipelines, supply chain transparency, and CVE management. The start-up mitigates the risk of costly security breaches and failed audits, which incite heavy fines and penalties from regulators.

Here Is The Product Line-up

Among Chainguard’s key products is “Chainguard Containers,” which helps companies build software better with minimal, zero-CVE container images guarded under the start-up’s industry-leading remediation SLA (Service-Level Agreement).

The solution enables companies to adopt inherently secure software, allowing engineers to focus more on delivering products and less on patching Common Vulnerabilities and Exposures (CVEs). Additionally, it leverages trusted open-source solutions to enhance security and minimize the attack surface for potential threats. Addressing critical compliance controls by default helps reduce overhead costs and accelerates the time to market for products.

Next is “Chainguard Libraries,” which stop software supply chain attacks without compromising developer experience and productivity with language dependencies built securely in SLSA-hardened build infrastructure.

Using the tool, companies can eliminate risks from compromised build systems and hijacked package distribution mechanisms to prevent attacks like XZ-Utils, MavenGate, and Lottie Player. Chainguard Libraries free up developers to ship faster by eliminating toil and productivity erosion associated with manual and/or policy-based package curation, apart from offloading the hard work of vendors in shared system libraries for dynamically linked languages.

These language libraries get built from source in Chainguard’s SLSA Level 2 build infrastructure, eliminating supply chain attacks at the build and distribution phases of the package lifecycle. Businesses can use the start-up’s language libraries anywhere to develop and deploy the code.

Chainguard helps IT companies standardise their developers on a safe and secure mechanism to consume language dependencies. Chainguard Libraries natively integrate with common artefact managers so developers can pull trusted dependencies without any additional friction.

Finally, we have Chainguard’s “Virtual Machine Software,” which hosts image containers on optimised, minimal, zero-CVE virtual machine images rebuilt from source daily for ephemeral cloud instances. The start-up described this particular solution as the security and innovation-friendly container host that meets “critical compliance controls by default with zero-CVE container hosts guarded under a CVE remediation SLA.”

The “Virtual Machine Software” also focuses on differentiated product experiences, in addition to reducing the burden on engineering and security teams for CVE triage, management, and remediation, while carrying out innovations on the security and performance optimisation front without costly and complex major upgrades.

Image Credits: Chainguard

The post Start-up of the Week: Armed with fresh funding, Chainguard eyes to become major cybersecurity player appeared first on International Finance.

While companies are adopting strategies such as making it mandatory for their employees to complete yearly cybersecurity training courses, human-driven cybersecurity breaches continue to occur. The situation could worsen in the coming days as generative AI increases the scale and personalisation of social engineering campaigns. To address this challenge, Anagram, formerly known as Cipher, is taking a new approach to employee cybersecurity training that the start-up hopes will keep pace with the evolving nature of these social engineering campaigns.

In today’s edition of the “Start-up of the Week,” International Finance will delve into the New York-based venture, which is now known for its virtual platform that offers hands-on security training for enterprises. This method includes bite-sized videos and personalised interactive puzzles designed to teach employees how to spot suspicious emails and communications. These training sessions are frequent and engaging, as opposed to the current standard of a once-yearly, lengthy training session. In this way, businesses and their employees stay updated on the latest trends in the world of cybercrime.

A Game-Changing Training Method

According to Harley Sugarman, founder and CEO of Anagram, the training activities primarily include tasks such as having employees create their own personalised phishing emails, which, in turn, teach them how to identify sophisticated campaigns aimed at them.

“We took very little, in fact, basically no inspiration from the existing stuff out there. What we really took were lessons from TikTok, Duolingo, and Khan Academy. We looked at these platforms that have done really well engaging and changing user behaviour outside the security space, and we asked ourselves, ‘OK, how can we apply those lessons within security?’” Sugarman explained to TechCrunch, highlighting what differentiates Anagram’s cybersecurity training from existing methods.

Harley Sugarman, a computer science professional, initially sought to apply the cybersecurity industry’s “capture the flag” training approach to upskill enterprise cybersecurity employees. This training method involves building software with vulnerabilities and having security researchers find the bugs and figure out how to write code without falling into the same traps.

That initiative evolved into Cipher in 2022 and gained some traction. However, Harley Sugarman faced another challenge: chief information security officers (CISOs) told him that their businesses had a bigger security issue they were looking to tackle—their non-security employees. He said CISOs described their employees as their weakest cybersecurity link.

“What sort of surprised me was actually just the amount of hopelessness I heard in their voices. This was an unsolvable problem for them,” Sugarman said.

Cipher then scaled up in January 2024 to focus on solving that problem. In 2025, the venture changed its name to Anagram to reflect its new focus and is winding down its original product. In addition to strong growth following its rebranding, Anagram has secured high-profile clients, including Thomson Reuters, MassMutual, and Disney, among others.

In February 2025, Anagram raised a $10 million Series A round led by Madrona, with participation from General Catalyst, Bloomberg Beta, and Operator Partners, among others. The company now plans to use the funds to expand its sales team and continue improving the product. Sugarman said that so far, the start-up has been able to reduce client companies’ phishing failure rates from 20% to 6%, but the goal is to continue moving closer to zero.

Understanding The Method In Detail

According to Harley Sugarman, Anagram launched its product at a pivotal moment for the cybersecurity industry. As generative AI advances, so do personalised social engineering campaigns, which can make it more difficult for people to distinguish between what is real and what isn’t.

“I think the side effect of that is that traditional email security platforms are actually going to have a much harder time detecting these AI-generated phishing attempts. The ability to generate and randomise is just so strong, and it’s really difficult, from an engineering perspective, to defend against that,” Sugarman explained.

To address this challenge, Anagram has divided its hands-on security training into two parts: “Security Awareness Training” and “Developer Training.” The first method operates under the motto “Bite-Sized Lessons, Big Results.” The start-up describes this approach as “quick, real-world training that leverages the science of learning so your (business’s) employees know how to spot and stop an attack.”

“Security Awareness Training” launches phishing simulations within minutes using Anagram’s best-in-class templates (even assisting companies in building their own campaigns). It also integrates a company’s cybersecurity policies directly into the training method, ensuring that everyone understands the rules and stays safe.

When it comes to combating cybersecurity threats, employees within a company—just like their varied roles and responsibilities—face different threats and challenges. To address this, Anagram offers both general and topic-specific modules so users can create programmes relevant to their operational needs.

Every October, the start-up offers a gamified “Awareness Month Programme” for companies. However, the most unique aspect of the “Security Awareness Training” is its content library, which covers cybersecurity challenges such as business email compromise, coding with AI, handling sensitive data, detecting deepfakes, holiday scams, insider threats, tax scams, sharing data externally, social engineering, wire fraud, and more.

Regarding “Developer Training,” the start-up focuses on real-world scenarios, whether protecting secret keys, tackling API vulnerabilities, or preventing software supply chain attacks. The training also includes interactive sandboxes where software developers and website builders can learn security best practices in a safe, realistic environment.

Since the threats developers face are constantly evolving, Anagram uses examples pulled from actual vulnerabilities and breaches, so developers can learn how to tackle the issues they are most likely to encounter.

The training method, which is updated multiple times a year to keep up with the ever-changing cyber landscape, covers topics such as SQL injection, managing secrets, broken access control, cross-site scripting (XSS), validating API design, cryptographic failures, insecure logging and monitoring, avoiding outdated components, protecting backups, detecting SSRF, securing cloud infrastructure, and ensuring software and data integrity.

The Road Ahead

Anagram is currently working on developing an AI agent that will be embedded in enterprise employees’ emails and will be trained to flag potential cybersecurity slip-ups before they happen.

According to Sugarman, the agent will be able to intervene by asking employees whether they really want to send their credit card information over email, among other similar safeguards.

Last but not least, Anagram is also currently partnering with renowned industry leaders, including Steve Zalewski (Levi Strauss), Lena Smart (MongoDB), Tim Youngblood (McDonald’s, T-Mobile), David Cross (Atlassian, Oracle), and Andrew Wilder (Nestlé). These collaborations underscore Anagram’s commitment to driving innovation and delivering impactful security solutions.

By blending customised microlearning with real-time security scenarios, the platform has disrupted cybersecurity training in a positive way. This approach has attracted the attention of leading global enterprises, including several from the Fortune 500. Expect the start-up to make even more waves in the coming days.

The post Start-up of the Week: Anagram’s cutting-edge approach to cybersecurity training appeared first on International Finance.

The banking industry’s resilience is demonstrated by data from the Central Bank of Kenya (CBK), which indicates that profits have increased from $1.09 billion during the same period last year.

CBK Governor Kamau Thugge claims that March was the banks’ best-performing month, with pre-tax profits hitting $184 million.

On the other hand, August saw the lowest profits of $119 million, the only month since January when profits fell below $136 million. Despite this minor decline, the banking industry has continued to grow while other economic sectors have experienced severe disruptions.

Kenya had a difficult year, marked by challenges such as severe flooding and rain from March to June, political turmoil with anti-government demonstrations in June and July, and limited liquidity.

Despite challenges, banks have shown resilience, with the finance and insurance industry expanding by 7% in the first quarter of 2024, according to the Kenya National Bureau of Statistics.

However, in the second quarter, this growth slowed to 5.1%. According to the CBK, the banking industry will expand by 6% for the entire year, which is the slowest growth since the COVID-19 pandemic hit the economy in 2020, when growth was only 5.9%.

The general economic outlook seems more muted. The CBK has revised its prediction for the growth of the national economy from 5.4% to 5.1%. This change follows a slowdown in the second quarter, when growth slowed to 4.6% compared to 5.6% during the same time last year. Lending has decreased, which has also affected Kenyan banks.

The loan book for this sector was $27.2 billion at the end of August, a $1 billion decrease from $28.2 billion at the end of 2023. As the value of the Kenyan shilling increased relative to the United States dollar, this indicates both a decrease in lending and a depreciation of loans denominated in dollars.

The expansion of private sector credit has decreased dramatically; in August, it was only 1.3%, the lowest level in over five years. At the same time, the non-performing loan ratio rose to 16.7%, the highest level in 18 years. High credit costs have coincided with an increase in defaults and a decrease in borrowing. In February 2024, Kenya’s benchmark lending rate reached a 12-year high of 13%.

The CBK implemented consecutive reductions to the benchmark rate, bringing it down to 12%, in an effort to alleviate the burden on borrowers in response to these economic pressures. Reviving economic activity and encouraging borrowing are the goals of this.

In a statement, CBK said, “The Monetary Policy Committee noted the sharp deceleration in private sector credit and the slowdown in economic growth during the second quarter of 2024. It concluded that there was scope for further easing of monetary policy to boost economic activity while ensuring exchange rate stability.”

The performance of the industry will still be strongly correlated with more general economic developments, such as initiatives to control inflation, exchange rate swings, and international financial circumstances.

Strong security over PoS rollout

Network International, a Middle Eastern and African digital commerce enabler, has reaffirmed its commitment to ensuring strong cybersecurity measures as it launches new payment solutions in Kenya.

Judy Waruiru, its Regional Managing Director for East and South Africa, said, “We are introducing our point-of-sale (POS) solutions as part of our strategy to enter the in-person payments market in Kenya, a key hub for East Africa.”

Network International is providing merchants with new point-of-sale solutions at no cost as part of this rollout, enabling companies of all sizes to conveniently accept payments in-store or while on the go.

In order to accommodate a variety of payment preferences, customers will also have the option to pay with cards or mobile wallets. As the number of digital transactions in the area rises, the business is expanding its service portfolio and addressing growing concerns about payment system security.

During an interaction with African Banker, Paul Mutethia, Head of Commercial at Network International Kenya, said, “The risks in cyberspace have increased, especially Denial of Service, malicious codes, botnets, and bugs which hamper operations. We secure our internal systems when they interact with the external environment. Our transactions are encrypted, and all our solutions are secure. We ensure there is no exposure to cyber-attacks because we hold sensitive customer data.”

He revealed that there is a dedicated department within the company that handles threat management and cyberspace monitoring. It would be better to close the business if you don’t make any investments in cybersecurity.

According to data from the Central Bank of Kenya, there are only slightly more than 55,000 point-of-sale machines in the country. This is insignificant when you consider that the Kenya National Bureau of Statistics reports that there are 7.4 million registered micro, small, and medium-sized businesses (MSMEs). This reveals a serious weakness in the infrastructure for digital payments for companies across the nation.

The most recent products from Network International include contactless payment systems, improved mobile payment gateways, and e-commerce solutions designed to increase convenience while upholding strict security regulations.

JPMorgan Chase eyes presence in Nairobi

JPMorgan Chase, the biggest bank in the world by market capitalisation, is expanding in Africa, with plans to open an office in Nairobi, Kenya.

The bank is the largest lender in the United States, with $4 trillion in assets and operations in more than 100 countries.

It received an operating license from the Central Bank of Kenya (CBK) just days before Jamie Dimon, the CEO of the bank, travelled to the country. The action is part of the bank’s strategy for global expansion and demonstrates its increasing interest in making investments in the African market.

The bank has identified Africa, which has the youngest population in the world, as a key growth region due to its fintech innovations and the rise in institutional bankers.

In October 2024, JPMorgan Chairman and CEO Jamie Dimon travelled to Kenya as part of a trip to Africa that also included stops in South Africa and Nigeria.

“We are opening our first branch in Kenya, which we are really happy to do. We want to add a country or two in Africa every couple of years or so. And when you do it, you are basically covering the government, maybe some big government enterprises, and the multinationals that are going in there with traditional banking services,” Jamie Dimon said during an event in Nigeria.

Sailepu Montet, a former executive at CBK, has been appointed as the bank’s new Country Manager for Kenya. He has more than 20 years of banking experience and a solid foundation in financial markets from both the public and private sectors.

According to Dimon, the bank’s primary areas of interest are treasury services, commercial and investment banking, and possibly some lending in Kenya. Nevertheless, it does not currently have any plans to provide asset and wealth management services in the country, which are already offered in Nigeria and South Africa.

“We are not doing asset and wealth management now, but that doesn’t mean it won’t happen in the next few years,” Dimon added.

Nairobi was selected as the site for JPMorgan Chase’s office because of its growing prominence as a technology hub and its status as the gateway to the wider East African market, which makes it a desirable location for companies wishing to grow throughout the region.

Ten international banks, including Bank of China, Access Bank of Nigeria, Bank of Kigali, First Rand Bank and Nedbank of South Africa, Rabobank of Mauritius, and French lender Societe Generale, have representative offices in Nairobi.

The bank must, however, differentiate its offerings in various markets, such as Kenya, where regional and local lenders are well-represented. There are 46 commercial banks in the nation, providing services to 55 million people.

Nigerian banks go big

One of Nigeria’s leading commercial banks, First Bank, is now planning to expand to at least three African countries in its next growth phase, starting in 2025.

According to the Deputy Managing Director of the bank, Ini Ebong, the countries being targeted include Ethiopia, Angola, Cameroon, and Ivory Coast.

He asserted that there are growing opportunities in markets across the African continent, similar to “what we saw in the early 2000s in some of the larger African markets. We believe it is an opportune time to take part in this phase of growth.”

In December 2024, the Ethiopian parliament passed a law that allows foreign banks to open subsidiaries in Ethiopia. Foreign firms will only be allowed to own 49% of shares.

Also, during a panel session at the recently concluded Africa Financial Industry Summit, Ethiopia’s central bank governor, Mamo Mihretu, said the country had been working on the legislation that would finally open the banking sector to foreign competition over the past year.

FirstBank, which has been operating in Nigeria for 130 years, began establishing subsidiaries in other African markets in 2011 when it acquired Banque International de Credit, one of the leading banks in the Democratic Republic of Congo.

In November 2013, it acquired subsidiaries of International Commercial Bank Financial Group Holdings AG (ICBFGH) in The Gambia, Sierra Leone, Ghana, and Guinea. It purchased ICB Senegal the following year, completing its acquisition of West African assets and operations of ICBFGH. FirstBank also has operations in London and Paris, France, as well as a representative office in Beijing, China.

In January 2025, news emerged about Bidvest Bank being sold to Nigerian-based Access Bank, which is set to expand the latter’s operations in South Africa substantially. Johannesburg Stock Exchange-listed Bidvest is now eyeing the disposal of 100% of its holdings to Access Bank.

Bidvest is expected to raise R2.8 billion from the sale, which will then be used to settle its existing debt. Access Bank, on the other hand, plans to implement Broad-Based Black Economic Empowerment (BBBEE) ownership, including an Employee Stock Ownership Plan. The acquisition is expected to close in the second half of 2025, subject to regulatory approvals in South Africa and Nigeria.

The Bidvest Bank book, which mainly consists of leased assets, loans and advances, totalled R6 billion in December, and was funded by deposits of R8 billion. In its most recent financial year, Bidvest Bank generated a trading profit of R371 million and an operating income of R377 million.

Speaking of Access Bank, the largest lender in Nigeria by assets, it has established itself as a full-service bank with over 60 million customers globally across three continents, serving three principal segments: retail, business, commercial, and corporate.

Following the acquisition, Bidvest Bank is set to be merged with Access Bank’s existing South African subsidiary to create an enlarged platform to anchor the regional growth strategy for the SADC region.

Using Bidvest Bank’s local capabilities and its established pan-African presence, Access Bank now hopes to have increased capacity for intra- and inter-Africa trade, connect businesses, and create new opportunities for regional integration.

The Nigerian-based company noted that South Africa’s banking sector is the largest in Africa, with a combined tier-one capital exceeding $42.2 billion in 2022. Despite a tough operating environment, the industry still achieved headline earnings growth of 2.5% year-on-year and maintained strong profitability (ROE of 17%) in the first half of 2024. Access Bank will now leverage the latest acquisition to strengthen its business and SME banking as well as its foreign exchange services, while also introducing new services tailored to the South African market.

Access Bank has already been operating in South Africa since 2021 after it acquired Grobank Limited. Grobank, which was previously known as Bank of Athens, was primarily focused on agriculture before Access Bank transformed it into a retail banking operation. The group currently offers personal, business, and corporate banking in South Africa.

Banks embrace WhatsApp banking

In order to process payments more quickly and interact with customers more effectively, Kenyan banks are increasingly using WhatsApp banking. Conversational banking is encouraged by this model, which also streamlines customer journeys and improves user intuitiveness.

Kenya’s Housing Finance Group, commonly referred to as HF Group, became the first major bank in the country to deploy WhatsApp banking in 2019.

HF Group CEO Robert Kibaara said, “Customers can simply add HF’s WhatsApp phone number to begin a secure banking chat session.”

Since 2019, the KCB Group, Kenya’s biggest bank by assets, has also adopted WhatsApp banking. KCB hopes to improve its communications by utilising widely used messaging platforms as part of a larger plan to offer individualised services.

A subsidiary of South Africa’s Absa Group, Absa Bank Kenya, followed suit in 2021 by launching the “Abby” WhatsApp banking service.

A Mumbai doctor’s loss of $2,000 from his WhatsApp wallet raised cybersecurity concerns, while many Kenyan consumers were ecstatic about the new banking model at the time.

“We have put up stringent measures to make WhatsApp banking secure for everyone. We have several security layers on the platform,” the bank’s head of digital channels, Andrew Mwithiga, told African Banker.

In 2022, Equity Group, which has the largest customer base in Kenya, introduced the Equity Virtual Assistant, a WhatsApp banking platform. With its open banking model, I&M Bank has also entered the WhatsApp banking space, initially providing customer service for non-transactional enquiries.

Through its AI-powered chatbot, Zuri, M-Pesa, the top mobile money platform in the world, has integrated WhatsApp banking since 2020. In Kenya, M-Pesa is used by more than 95% of households.

According to Statista, as of January 2024, 86% of Kenyan internet users were using WhatsApp, making it the most popular messaging app in the country. In Kenya, there were 7.9 million WhatsApp users as of 2023.

Meanwhile, an €8.51 million loan from the African Development Bank has been approved for Senegal’s “Programme to Promote Efficient Lighting Lamps” (PPLEEF), a groundbreaking project aimed at promoting energy efficiency in the nation. This establishes a new standard for sustainable development in Africa and is the bank’s first entirely focused demand-side energy efficiency investment project.

The post African banks post strong profits amidst hurdles appeared first on International Finance.