Core Fact: Cloud migration exposes banks to critical security risks
The migration of banks to the cloud is accompanied by severe security risks that require immediate technological solutions. According to the ENISA Threat Landscape 2025 report, digital infrastructure accounts for 27.7% of all data breaches, while critical infrastructure, including banks, represents 53.7% of organizations affected by cyberattacks. To address these vulnerabilities, financial institutions are increasingly turning to Trusted Execution Environments (TEEs) to secure data during active processing.
Cyber threats in the financial sector and cloud challenges
An additional risk factor is the rapid adoption of 5G technology, which increases the volume of data that must be protected in real time. Traditional encryption protects data at rest and in transit. However, during active processing in server memory, it remains vulnerable. The concept of Confidential Computing addresses this issue using Trusted Execution Environments (TEEs). These are hardware-isolated areas within the processor (enclaves) that prevent access to code and data by the operating system, hypervisor, or cloud administrators.
Implementation details and architectural requirements
Using TEE does not guarantee automatic security without proper processes. The Cisco Cybersecurity Readiness Index 2025 study highlights a gap between the availability of tools and companies' actual readiness. Implementing the technology requires separating application components, managing cryptographic keys, and attesting enclaves.
TEE use case in banking
An example of using this technology is deploying a real-time fraud detection system:
- The analysis logic and machine learning models are hosted inside the TEE.
- Transaction data is sent directly to the enclave in encrypted form.
- Before processing, attestation is performed—a cryptographic verification of code and hardware integrity.
- The analysis result is transmitted to external systems, while sensitive data never leaves the enclave.
Industry implications
The adoption of TEE technology fundamentally changes how the financial sector handles cloud security. By ensuring confidentiality (RAM protection), integrity (preventing code modification), and hardware-based attestation, banks can safely migrate their most critical workloads to public clouds. This reduces reliance on cloud provider trust, mitigates insider threats, and allows financial institutions to seamlessly meet strict regulatory compliance standards.
What to do
To successfully implement TEE technology and secure banking workloads in the cloud, organizations should take the following practical steps:
- Identify critical data and workloads that require hardware-level protection.
- Assess current security risks and vulnerabilities in your existing cloud environment.
- Develop a clear strategy for integrating TEE with your current software tools and architecture.
- Ensure compliance with regulatory requirements, such as NBU and GDPR, during the design phase.
- Build or acquire the technical expertise necessary to support and maintain enclave-based solutions.
Prepared by a Software Ukraine member. Original publication.