Financial Services
Operating securely in financial services depends on more than encrypted applications and well-run data centres. It increasingly depends on where your people are sitting when they connect.
Client data, transaction records and regulatory reporting are all routinely reached from outside the office. Staff work from home, travel, and use serviced offices and third-party spaces. Each of those introduces risk at the uncontrolled network edge, the point where your systems meet infrastructure you neither own nor control.
Regulators have noticed. The expectation has moved from having a policy to being able to evidence a control, and the network edge is one of the harder places to produce that evidence
Why the Uncontrolled Edge Is Now in Scope
Secure platforms, multi-factor authentication and encrypted connections all do their jobs. None of them tell you anything about the network a user is connected to.
Most off-the-shelf routers:
- Ship with unpatched vulnerabilities and are rarely updated afterwards
- Revert to insecure defaults after a factory reset
- Provide no separation between devices on the same network
- Sit outside any central management your IT team operates
So an analyst reviewing client records from home or when out of the office may be connecting through infrastructure that puts your data and your compliance obligations at material risk.
What the Threat Actually Looks Like
The shift here is measurable rather than rhetorical. Within breaches that involved exploiting a vulnerability, the proportion targeting edge devices and VPNs rose from 3% to 22% year on year, an almost eightfold increase, according to the Verizon 2025 Data Breach Investigations Report. As the corporate perimeter has hardened, attackers have moved to the layer nobody manages, and automation has made that cheap to do at scale.
For a financial firm, the practical exposures at the edge are well understood:
- DNS redirection and traffic interception before an encrypted session is established.
- Man-in-the-middle attacks on shared, hotel and public networks.
- Compromised routers used as a foothold or a pivot point.
- Lateral movement between devices sharing an untrusted local network.
What these have in common is that they happen below the layer your security stack can see.
Loxada: A Controlled Edge
Loxada replaces the untrusted router with a Loxada secure router, centrally managed and pre-configured for use in regulated environments, and routes traffic through Loxada’s secure connectivity layer, an encrypted connection from the device out to the internet.
Each device:
- Runs Loxada’s secure firmware in place of the manufacturer’s
- Creates a separate work network, physically separate from everything else on the local connection
- Updates automatically using Loxada’s secure firmware packages
- Blocks known malicious domains, dropping requests to domains on Loxada’s aggregated blocklist before they resolve
- Returns to a secure state after a factory reset, and cannot be rolled back to a superseded build
- Can be revoked centrally when a person or engagement ends
There is nothing to install and no user configuration. Deployment is fully auditable, with monthly security reports and device-status visibility.
Supporting Operational Resilience Expectations
For UK-regulated firms the operative framework is the FCA and PRA operational resilience regime rather than DORA, and regulators have moved from asking whether you have a plan to asking you to evidence one. That means showing you can keep important business services running through severe but plausible disruption, and understanding what each of them depends on.
A compromised home or shared network that permits interception or lateral movement is precisely that kind of scenario, and difficult to argue you have addressed if the edge has never been brought under management.
Dependency mapping is where the network edge shows up most directly. Firms are expected to map the technology and third parties behind each important business service, and domestic routers chosen by staff and maintained by nobody are an unmapped dependency.
Loxada replaces them with a single documented provider that can appear on that map and be governed as a managed service arrangement, which gives the individual accountable under the Senior Managers and Certification Regime something concrete to evidence, and something to bring to the evidence-based scenario testing supervisors increasingly expect.
For Firms with EU Operations
-
Many UK firms also operate in the EU through subsidiaries, branches or by serving EU-regulated clients, and carry obligations under the Digital Operational Resilience Act for those entities. DORA is unusually specific about this layer: it expects encryption of connections made over domestic networks, controls that keep non-compliant endpoints out, and assurance that home working and personal devices do not weaken the firm’s security position.
Loxada can be deployed uniformly across a workforce spanning both regimes, documented once, and referenced in both your UK third-party arrangements and your DORA register of information. Our DORA compliance page covers this in more detail.
Loxada supports these expectations at one layer, the uncontrolled network edge. It is a preventive control providing deployment coverage and configuration assurance, not monitoring, threat detection or incident response, and those obligations sit elsewhere in your programme.
Common Deployment Scenarios
- Private bankers working from home or between client locations.
- Risk and compliance staff reviewing confidential material from serviced offices.
- M&A teams and analysts conducting due diligence in external environments.
- Business continuity teams needing secure connectivity in unfamiliar locations.
- Contractors and consultants granted access to sensitive internal systems.
Why Financial Services Firms Choose Loxada
- Brings a previously unmanaged layer under documented control
- Supports FCA, PRA and, where relevant, DORA expectations with auditable evidence
- Deploys at scale with no user training or software installation
- Works alongside your existing identity, endpoint and connectivity tooling
- Scales across UK and EU operations without maintaining two approaches
