The security decision is changing
For years, digital banking security treated bot mitigation, application protection, authentication and DDoS defense as related but largely separate disciplines. That model is changing. Attackers now move across the customer journey, using distributed infrastructure, human-like browser behavior and valid credentials to make malicious interactions resemble legitimate ones.
The security decision is no longer only what to block. It is what to trust—and why.
Financial institutions need a connected trust model that combines signals across the network, browser, application, device, identity and session. The objective is to distinguish legitimate consumers and services from higher-risk interactions earlier—before suspicious activity reaches authentication, consumes application resources or disrupts the account holder experience.
Why the old model is straining
Every day, customers and members use digital banking to check balances, transfer funds, pay bills and manage their financial lives. Financial aggregators, monitoring services, mobile applications and other legitimate automated services use many of the same entry points. Attackers operate within that shared traffic, making harmful activity increasingly difficult to separate from expected use.
The same digital front door serves customers, trusted services, and attackers.
Traditional defenses remain essential. Bot-management technologies assess browser characteristics, IP reputation, behavior, request velocity and network indicators. Web application firewalls inspect requests for malicious activity, while rate limiting and DDoS defenses contain abusive or overwhelming traffic.
But attackers have adapted to the signals those controls evaluate. Authentication attempts can be distributed across residential and mobile networks. Individual connections may generate too little activity to trigger simple thresholds. Browser sessions may appear normal, and attackers may use valid credentials obtained through phishing or credential harvesting.
That creates a difficult balance. Block too aggressively, and legitimate customers, members or trusted services may be disrupted. Be too conservative, and potentially malicious activity can advance toward authentication and other sensitive banking functions.
It’s for that reason, we take this approach at Candescent:
What do we know about this interaction, and what evidence do we have that it should be trusted?
What connected trust looks like: Adding trust evidence before authentication
Candescent’s approach brings bot management, WAF protection, intelligent rate limiting, behavioral analytics, threat intelligence and DDoS defense into one decision model. Instead of treating each capability as an isolated control, it combines evidence about the connection, client environment, identity activity, session behavior and prior activity.
A request may look normal when each signal is viewed alone: the IP address may not be suspicious, the browser may behave correctly and even the username and password may be valid. Evaluated together, however, connection data, browser or device evidence, authentication activity, session behavior and prior activity can reveal inconsistencies that justify additional validation or mitigation.
Here’s how it works with Cloudflare and Approov across our web and mobile experiences:
Cloudflare Turnstile performs browser-side checks and issues a token that can be validated before authentication proceeds. The token does not establish the user’s identity; it adds evidence that the interaction passed active browser validation.
Approov attestation evaluates whether a request comes from the expected mobile application running in an acceptable environment. Short-lived cryptographic tokens carry that evidence to backend services, adding confidence in the application and runtime.
Together, Turnstile and Approov provide complementary trust signals for web and mobile interactions. They do not replace bot mitigation, strong authentication, WAF protection or DDoS defense. They strengthen the layered decision by adding evidence about the client environment before backend systems act on the request.
Why resilience must be connected: DDoS protection belongs in the same trust model
Traditional DDoS protection remains critical for detecting and mitigating volumetric attacks intended to overwhelm infrastructure. But protection must also account for application-layer activity that targets resource-intensive functions or distributes requests across many sources. In those cases, no single connection may look extreme, even though the combined activity can degrade service or exhaust application resources.
Candescent brings DDoS protection together with WAF controls, bot mitigation, rate controls, behavioral intelligence, authentication context and stronger trust signals. The objective is to identify and control risk before it becomes an application, availability, fraud or customer/member-experience problem.
This connected model improves both visibility and response. Controls in front of the banking platform can identify suspicious patterns earlier, while browser, application, identity, device and session evidence helps determine which interactions warrant additional scrutiny. The result is a more graduated response than a simple allow-or-block decision.
Connected trust changes the economics of the attack
Credential attacks depend on automation and scale. When attackers can cheaply rotate IP addresses, modify browser characteristics and repeatedly attempt authentication, the economics remain attractive.
Every additional trust requirement raises the cost. If browser behavior alone is no longer sufficient, the attacker must overcome active validation. If mobile API access requires evidence from the legitimate application in an acceptable environment, another obstacle is introduced. Correlating those signals with identity and session context further reduces the value of imitating any one trusted characteristic.
The goal is not to claim that fraud or automated attacks can be eliminated. It is to make malicious activity harder to automate, more expensive to operate, easier to identify and less scalable—while preserving a low-friction experience for legitimate customers and members. The future of digital banking security is connected trust: understanding the interaction, validating it where appropriate and controlling risk before it affects fraud, availability or customer experience.
The Candescent difference
Move from simply reacting to suspicious traffic and toward understanding the interaction and use connected evidence to decide what to trust, what to challenge and what to block.
If you have any questions related to Candescent’s cybersecurity practices
please reach out to your DSM or get in touch with us..
