Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Financial institutions face a tricky balancing act: they need to innovate quickly while also following strict compliance rules in an environment where security is paramount. Recently, Snyk's Field CTO, Steven Schmidt, sat down with Mihai Saveschi, Senior Director of Security Service Management at CIBC, for a fireside chat to discuss these pressing issues. We’ve pulled key insights from their conversation on some of the most pressing AppSec challenges facing financial services organizations today.

Developers are trapped in a loop: constantly chasing dependency upgrades to mitigate security risks or chasing down security reports of vulnerable code or findings in the CI pipeline. Developers often refer to this as “vulnerability fatigue,” a term commonly referenced in npm package install logs that list the newly introduced security vulnerabilities for third-party dependencies.

Speed and innovation rule in software development, which makes it easy to overlook one crucial aspect: security. As a Staff Solutions Engineer at Snyk, I’ve seen firsthand how a single overlooked vulnerability can spiral into a crisis, affecting businesses, customers, and trust. Secure coding isn’t just about writing better code—it’s about protecting what matters, which includes the credibility and reputation of individuals, teams, and the business.

In the afternoon on Friday, March 14, 2025, details began to emerge about a serious security exploit on a popular GitHub Action called changed files (tj-actions/changed-files). About 23,000 GitHub repos use this Action as part of their CI and DevOps workflows. It allows you to track which files have changed across branches and commits. An attacker with write privileges on the Action repo made a commit that caused encrypted secrets to appear in plaintext in the GitHub Action logs.

As organizations continue to evolve their DevSecOps programs by adopting comprehensive testing and monitoring, the next step is to take action on the insights uncovered. This means remediating security issues as early as possible and responding to security alerts and incidents in a timely manner. However, many security and development teams find that triaging the findings of every tool and managing remediation efforts is time-consuming and costly.

Managing the risks of AI development tools is crucial for organizations looking to responsibly and effectively leverage this technology’s potential. AI offers transformative capabilities, particularly in coding assistance, where tools can speed up development and reduce manual workloads. However, these benefits can come with risks, such as security vulnerabilities and compliance challenges, that cannot be overlooked.