Thomas Murray Publishes Second Report
Thomas Murray Publishes "Beneath the Asset: Cyber Risk and the Infrastructure Institutions Depend On"Second report in
Press Release Disclaimer: This is a press release distributed through the XPR Media network. It has not been independently verified by our newsroom.
Thomas Murray Publishes “Beneath the Asset: Cyber Risk and the Infrastructure Institutions Depend On”
Second report in the flagship Beneath the Asset series shows how cyber risk has become the primary mechanism through which infrastructure failures reach institutional assets
LONDON, UK / ACCESS Newswire / July 27, 2026 / Thomas Murray, the global risk intelligence and ratings firm, today published Beneath the Asset: Cyber Risk and the Infrastructure Institutions Depend On, the second report in its Beneath the Asset series. The paper extends the firm’s flagship thesis, that asset safety is no longer just a custody question but an infrastructure question, by showing that cyber risk is now the primary transmission mechanism through which that infrastructure risk reaches an institution’s assets.
Drawing on a string of high-profile incidents in 2025 and 2026, including the ransomware attack on Jaguar Land Rover (modelled at £1.9 billion in UK economic loss, the most damaging cyber event on record) and the Marks & Spencer breach (which cost the retailer roughly £300 million in lost profit), the report finds that in both cases the point of failure was a third party and a person, not the target’s own perimeter, the same pattern Thomas Murray identified running through custody chains, CSDs and post-trade infrastructure in its original Beneath the Asset report.
Key findings include:
-
Geopolitics and cyber risk are converging. State-sponsored activity is now targeting infrastructure directly, adding a further transmission path alongside sanctions and market-access exposure, illustrated by destructive cyber activity against Iranian banking infrastructure in June 2025 and June 2026.
-
Cyber risk is now the primary transmission mechanism for infrastructure risk. When a CSD, custodian, fund administrator or their outsourced providers are compromised, the assets sitting on that infrastructure are compromised with them.
-
The exposure that matters most sits outside an institution’s own perimeter in custodian sub-networks, IT outsourcers, cloud platforms and help desks.
-
Current assessment tools force a false choice between rich, one-entity-at-a-time due diligence and broad but contextless surface scanning. Neither, alone, gives an asset owner or custodian a defensible, continuous view across a portfolio of dependencies.
The report argues that the answer is not more due diligence done the same way, more often, but continuous, contextualised risk intelligence across the full chain of infrastructure an institution’s assets depend on, combining the depth of maturity and control assessments with the scale and continuity of external attack-surface monitoring.
Thomas Murray is taking this thinking forward through a pathfinder programme with a small group of like-minded organisations, with further insights to follow.
“Cyber risk has become the fastest-moving route through which infrastructure failures reach an institution’s assets. The organisations that stay safe will be the ones that stop treating their custodians and providers as a once-a-year compliance exercise and start seeing them as a portfolio of risk to be monitored continuously” said Ioan Peters, Managing Director, Cyber Risk at Thomas Murray.
Beneath the Asset: Cyber Risk and the Infrastructure Institutions Depend On is available now.
About Thomas Murray
Thomas Murray provides risk intelligence and ratings covering central securities depositories, custodians, market infrastructures and financial systems worldwide. For more than three decades, the firm has helped financial institutions understand and manage the risks affecting the safety, resilience and performance of their assets across global markets.
Media Contact
Amie Johnstone
Head of Marketing and Communications, Thomas Murray
ajohnstone@thomasmurray.com
This information is provided by Reach, the non-regulatory press release distribution service of RNS, part of the London Stock Exchange. Terms and conditions relating to the use and distribution of this information may apply. For further information, please contact rns@lseg.com or visit www.rns.com.
SOURCE: Thomas Murray Network Management Ltd
View the original press release on ACCESS Newswire
Media gallery
