Saturday 17th January marked the first anniversary of the Digital Operational Resilience Act (DORA), which has set a new standard for ICT security and operational resilience across the European financial sector.
Various industry experts have provided comments to Resilience Forward, covering themes such as:
- The compliance versus reality gap: many organizations can demonstrate DORA compliance on paper but still lack confidence that their controls, incident understanding, and risk reporting reflect real operational conditions.
- Visibility and risk intelligence as foundations: weak ICT visibility, particularly across SaaS and cloud environments, continues to undermine organizations’ ability to maintain a trusted single source of truth and translate compliance into actionable, business-aligned risk insight.
- Speed without control is risk: rapid adoption of cloud, SaaS, AI, and DevOps practices is outpacing organizations’ ability to govern, verify, and explain outcomes, creating systemic exposure despite apparent technological progress.
- AI accelerates both innovation and fragility: the rise of AI-driven development and automation is amplifying existing weaknesses in governance, testing, traceability, and auditability, reinforcing the need to embed security and controls from the outset.
- Data quality determines DORA outcomes: while many banks have invested heavily in operational resilience, only those modernising core systems and improving data quality are unlocking real-time insight and lasting business value.
- Service resilience over component risk: DORA is reinforcing a shift away from managing isolated vulnerabilities towards understanding and protecting the end-to-end resilience and cyber health of critical business services.
- Resilience by design, not retrofit: organizations that treat DORA as a bolt-on compliance exercise continue to struggle, while those embedding resilience into architecture, pipelines, and operating models are better positioned for sustainable compliance.
- Governance remains a work in progress: although board-level oversight is central to DORA, many organizations are still developing the clarity, reporting, and accountability structures needed for effective cyber and operational resilience governance.
- Regulation is converging, not fragmenting: DORA now operates alongside NIS2, the EU AI Act, and related initiatives, increasing pressure on organizations to move from siloed compliance towards integrated, enterprise-wide resilience governance.
Comments received include:
Chris Hosking, AI and Cloud Security Evangelist, SentinelOne
“One year on, DORA has been a welcome and necessary first step for financial services. Like many regulations, it emerged from hard lessons, but it has helped shift the industry away from viewing cyber risk purely through a financial lens and towards treating resilience as a core operational priority.
“That said, adoption has been uneven. Many organizations are still treating DORA as a paper exercise, while real-world risk is being driven by sprawling SaaS and cloud environments, poor visibility of ICT assets, and growing dependence on complex software supply chains. At the same time, firms are struggling to accurately investigate and classify incidents quickly enough, particularly when attackers rely on social engineering rather than technical compromise.
“To remain effective against today’s fast-moving threats, DORA will need to keep evolving – with a stronger focus on measurable security outcomes and how organizations actually operate, rather than box-ticking compliance.”
Martin Reynolds, Field CTO, Harness
“One year on from DORA’s enforcement, Europe’s regulatory landscape has shifted. Between DORA, the EU AI Act, and NIS2, organizations now operate within a more unified, accountability-led framework that demands real transparency, traceability, and algorithmic accountability.
“This is more important than ever, as reliance on AI-generated and ‘vibe’ coding has created new high-stakes risks for organizations. When development accelerates but testing, governance and security don’t keep pace, the result isn’t innovation; it’s exposure.
“In the age of AI, DORA serves as an important reminder that velocity without verification is risk. The organizations that succeed in year two of DORA won’t be the ones producing the most code, but the ones who can prove its safety at scale. That means automated policy enforcement, continuous security scanning, traceable audit trails, and guardrails built directly into pipelines, not bolted on after release. Forward-looking teams are already building resilience in from the start, embedding security as code, augmenting testing with AI, and validating behaviour continuously in runtime. With DORA-minded processes in place, AI becomes an accelerant, not a liability, enabling faster innovation that stays compliant, resilient, and safe.”
Jonathan Gill, CEO, Panaseer
“With DORA only a year old, there have been no notable breaches or enforcement actions. But this is just the calm before the storm, as transforming – and regulating – the operational resilience of an entire industry and tech ecosystem doesn’t happen overnight. Organizations now need to own and fully understand risk and the controls that manage it. But this is still a challenge for CISOs in financial firms. Less than half (48 percent) are truly confident that cybersecurity reports to the board, risk teams, and regulators are clear and comprehensive. Whilst two-thirds (67 percent) lack full visibility into how effectively their security controls are working and only 29 percent are confident the security team knows their true risk level.
“Firms need to switch to a more integrated, intelligence-led approach to compliance. Establishing a ‘single source of truth’, a centralised and trusted inventory of all assets and related risks is critical to driving a more comprehensive understanding of risk. Compliance gaps in the underlying apps and infrastructure that support the wider business can then be spotted and addressed. But perhaps most importantly, truth data translates risk into language that business leaders and boards understand, helping CISOs to spread accountability, increase ownership for security, and reduce risk.
“This will help security go beyond critical vulnerabilities on servers or SQL injection flaws and ascertain the cyber health of a business service, aligning CISO risk to organizational risk to help hold business leaders accountable. The security team can then map DORA compliance to other adjacent regulations and programmes such as International Counter Ransomware Initiative to increase resilience further and connect compliance with risk management.”
Steve Round, Co-Founder and President, SaaScada
“One year into DORA, many banks have paid through the nose to improve operational resilience – investing in new monitoring capabilities, better system visibility, and speeding up incident reporting. But it’s still early days, and only time will tell if these often-rushed modernisation efforts have done enough to avoid costly non-compliance fines. Too many banks are still wrestling with disconnected systems and manual processes which hinder their ability to spot issues early, contain incidents quickly, and keep critical services running.
“The banks that started by modernising their core systems and improving overall data quality are in the best possible position. They now have access to real-time insights that are boosting resilience, but also making it easier to launch personalised products and features faster, earning customer trust and increasing their share of wallet. On the other hand, those that have treated DORA as a box-ticking exercise will keep paying for the same problems, year after year.”
Chris Royles, Field CTO EMEA , Cloudera
“At the one-year anniversary of the EU DORA regulation organizations have to now plan beyond being compliant, to being sustainable and operationalized strategically. With DORA now in force it is important to have enterprise-wide governance in place to accommodate change and continuous improvement.
“Throughout the last year we have seen organizations rethinking their ICT strategy, considering more flexible hybrid architectures for data and application deployment and investing in data lineage and governance at enterprise scale across systems.
“The rapid adoption of AI has not made this easier, it has added an additional risk to resilience. This will become more important as AI is integrated with business-critical processes and agent-based approaches. Not only will it be critical to understand the lineage of your data, but also the lineage and governance of AI. 2026 will be about taking back control, operationalizing resilience, accommodating ever faster change and building robust governance across all aspects of data and AI.”
