T-Bank Paid Hackers for Weak Spots, but the Grand Prize Went Untouched
T-Bank has completed three months of open cybersecurity testing and recorded no unacceptable events. Researchers submitted five reports, four of which were recognized as valid.
The testing involved 78 researchers who attempted to execute scenarios capable of causing significant damage to the company, such as gaining access to money or data. The maximum payout was 3.5 million rubles ($~38,000) for one of the vulnerabilities found. The bank was prepared to pay 12 million rubles for executing a critical scenario, but no one managed to bring an attack to that outcome. Several attacks using artificial intelligence were also detected during the testing.
Dmitry Gadar, Vice President and Head of the Information Security Department at T-Bank, noted that banning research will not stop malicious actors — they will look for weak spots regardless. It is therefore more sensible for a company to set the rules itself under which specialists search for and report problems.
A plenary session, "Cyber Resilience in the AI Era," discussed how companies can continue operating after incidents and how to test AI systems.
