Introduction

The Detection Architecture That FinTech Built — and What It Cannot See                                   

The detection architecture that FinTech organisations have built reflects the evolution of modern technology environments. These organisations have adopted cloud-native systems that emphasise scalability, flexibility, and rapid deployment. In such setups,

Endpoint Detection and Response (EDR) tools are typically used to monitor employee devices and production servers, while SIEM platforms are responsible for aggregating logs from cloud infrastructure, identity systems, and applications. At first glance, this layered monitoring approach creates the impression of complete visibility, where every component appears to be tracked and controlled. However, this perceived completeness is deceptive because the architecture itself has moved beyond the capabilities of the tools designed to monitor it.

The real issue is not a lack of data but a lack of visibility into how modern cloud-native systems behave, especially under attack conditions. FinTech environments rely heavily on advanced technologies such as containers, Kubernetes orchestration, serverless computing, and microservices. These technologies introduce new interaction patterns that do not generate traditional endpoint signals, making them difficult for legacy tools to detect.

Some key examples of this problem include:

• A container escape may not trigger meaningful alerts within the container layer itself.
• Kubernetes privilege escalation can occur using legitimate service account credentials.
• Serverless functions operate without persistent infrastructure, leaving no endpoint trace.
• Microservice communication often appears as valid API traffic, even when malicious.

Attackers targeting these environments are aware of these limitations. Instead of using obvious attack methods, they operate within legitimate workflows, blending into normal system behaviour. This creates a structural detection gap where traditional tools are not necessarily malfunctioning—they are simply not designed to observe the right signals. As a result, the challenge becomes architectural rather than operational, requiring a shift towards correlated, cross-domain visibility that can interpret behaviour across multiple system layers.

How Containerised Architectures Create Detection Gaps

Containerisation plays a central role in FinTech infrastructure because it enables rapid deployment, efficient scaling, and consistency across application environments. However, these same benefits introduce challenges for traditional monitoring systems. Containers are inherently ephemeral, meaning they can be created, execute workloads, and terminate within seconds. This short lifecycle makes it difficult to deploy and maintain agent-based monitoring tools effectively, as containers may disappear before sufficient telemetry is collected.

Another major factor is the shared kernel model. Containers do not function as fully isolated systems; instead, they share the host operating system kernel. When a container escape occurs, the malicious activity may not be visible within the container itself but may instead appear at the host level. Without proper correlation between container-level and host-level events, these signals remain fragmented and difficult to interpret as part of an attack sequence.

Key challenges introduced by containerisation include:

• Ephemeral lifecycles that limit telemetry collection
• Shared kernel architecture reducing isolation
• Fragmented visibility between container and host layers
• Difficulty in correlating events across environments

Kubernetes further complicates this landscape by introducing orchestration-level components such as API servers, etcd data stores, and role-based access control systems. These components are essential for managing container environments but were not designed with traditional endpoint monitoring in mind.

Attackers can exploit misconfigurations, access APIs using valid credentials, or escalate privileges through service accounts—all without triggering conventional alerts. Since these actions are technically valid within the system, they are particularly difficult to detect using rule-based approaches.

XDR addresses these issues by integrating telemetry from multiple layers, including container runtimes, orchestration platforms, host systems, and network traffic. Rather than relying on a single data source, it correlates signals across these layers to create a unified understanding of system activity. For example, when a container escape occurs, XDR connects the initial anomaly with host-level actions and network behaviour, transforming fragmented signals into a coherent attack narrative.

Kubernetes and Identity-Based Attack Paths

In cloud-native environments, identity has effectively replaced the traditional network perimeter as the primary security boundary. Kubernetes relies heavily on service accounts, tokens, and role-based permissions to manage access. While this model provides flexibility and scalability, it also introduces new opportunities for attackers to exploit identity-based controls.

An attacker who gains access to a service account can interact with the Kubernetes API in ways that appear completely legitimate. They can query resources, deploy workloads, or modify configurations using valid credentials. Traditional monitoring systems often fail to flag these actions because they are technically authorised within the system’s access controls.

This creates a dangerous scenario where:

• Malicious actions appear as legitimate operations
• Valid credentials are used to bypass detection
• Traditional tools fail to distinguish misuse from normal behaviour

XDR changes this detection approach by focusing on behavioural analysis rather than simple access validation. Instead of checking whether an action is allowed, it evaluates whether the action aligns with established behavioural patterns. For instance, if a service account begins accessing unfamiliar resources or performing actions at unusual times, these deviations are flagged as anomalies.

This behavioural approach is critical because:

• It detects misuse of legitimate credentials
• It identifies subtle deviations in activity patterns
• It provides visibility into threats hidden within normal operations

By establishing baselines and identifying deviations, XDR enables organisations to detect threats that would otherwise remain invisible in identity-driven environments.

Microservices and the Lateral Movement Problem

Microservices architecture introduces another level of complexity by changing how applications communicate. In traditional environments, lateral movement is often seen as suspicious because it involves accessing systems that are not typically connected. However, in microservices environments, lateral communication is a normal and essential part of system operation.

Services continuously interact with each other through APIs, exchanging data and executing workflows. This makes it extremely difficult to distinguish between legitimate communication and malicious lateral movement. An attacker who compromises a single microservice can move laterally by making API calls that appear completely valid.

This leads to several detection challenges:

• API requests follow expected protocols even when malicious
• No predefined rules are violated during lateral movement
• Traditional monitoring tools see activity as normal

XDR addresses this issue by learning behavioural patterns of service-to-service communication. It establishes baselines for how services interact, including communication frequency, data exchange patterns, and typical interaction paths. When deviations occur—such as unexpected communication routes or unusual spikes in requests—XDR flags them as anomalies.

The advantages of this method include:

• Detection without reliance on static rules or signatures
• Identification of subtle behavioural changes
• Adaptability to dynamic microservices environments

This makes XDR particularly effective in environments where traditional detection methods fail due to the complexity and variability of legitimate activity.

Serverless and the Invisible Execution Layer

Serverless computing represents one of the most challenging areas for traditional security monitoring. Serverless functions run without persistent infrastructure, executing code in response to events and scaling automatically based on demand. Because these functions operate in managed environments controlled by cloud providers, they do not support traditional endpoint agents and produce limited telemetry.

This creates an execution layer that is effectively invisible to conventional tools. Attackers can exploit this invisibility by abusing function triggers, executing malicious code within legitimate workflows, or accessing resources through function permissions.

Common risks in serverless environments include:

• Lack of persistent infrastructure for monitoring
• Limited telemetry generation
• Abuse of legitimate execution workflows
• Difficulty in detecting malicious function behaviour.

XDR overcomes these limitations by analysing the broader context in which serverless functions operate. Instead of focusing on the function itself, it examines surrounding factors such as invocation patterns, identity usage, network interactions, and resource access behaviour. By correlating these signals, XDR can detect anomalies that indicate potential compromise.

For example, it can identify:

• Unusual spikes in function invocations
• Access to unexpected resources
• Deviations from normal execution behaviour

This approach extends visibility into previously unmonitored areas, enabling organisations to detect threats in environments where traditional tools have no coverage.

How Codec Networks Helps in This Area

Codec Networks delivers advanced XDR solutions tailored for cloud-native FinTech environments, helping organisations achieve deeper visibility across complex and distributed systems. Their approach focuses on bridging the gaps left by traditional security tools by integrating multiple layers of telemetry.

By combining behavioural analytics with cross-domain correlation, Codec Networks enables early detection of sophisticated attack patterns that often go unnoticed. This ensures that organisations can secure modern architectures effectively without impacting performance or scalability.

Key Capabilities

1. Cross-Domain Visibility

• Provides unified visibility across multiple layers of infrastructure
• Covers containers, orchestration platforms, endpoints, and network traffic
• Eliminates blind spots present in traditional monitoring tools

2. Behavioural Analytics

• Detects anomalies based on deviations from normal activity patterns
• Identifies misuse of legitimate credentials and system workflows
• Focuses on behaviour rather than static rules or signatures

3. Advanced Threat Detection

• Recognises sophisticated, cloud-native attack techniques
• Detects threats that blend into normal system operations
• Correlates fragmented signals into meaningful attack insights

4. Real-Time Correlation

• Connects events across different environments and system layers
• Builds a complete attack narrative from scattered data points
• Enhances accuracy and reduces false positives

5. Performance and Scalability

• Designed for modern, dynamic FinTech infrastructures
• Ensures security without impacting system performance
• Supports scalable architectures like microservices and serverless systems

6. Proactive Security Approach

• Enables early identification and response to threats
• Reduces dwell time of attackers within systems
• Strengthens overall security posture in complex environments

Conclusion

FinTech organisations have developed advanced security monitoring architectures aligned with modern cloud-native systems, but these architectures inherently introduce visibility gaps that traditional tools cannot fully address. Technologies such as containers, Kubernetes, microservices, and serverless computing create environments where attackers can operate using legitimate mechanisms, allowing malicious activity to blend seamlessly into normal system behaviour.

Traditional tools struggle because they lack visibility into cloud-native interactions, while attackers increasingly exploit identity systems, APIs, and dynamic infrastructures to avoid detection. The fragmentation of data across multiple layers further complicates the ability to identify complete attack sequences. XDR addresses these limitations by providing cross-domain visibility, applying behavioural analytics to detect anomalies, and correlating signals in real time to build a unified understanding of threats. By doing so, it enables organisations to identify and respond to attacks that would otherwise remain undetected until significant impact occurs, making it an essential component of modern FinTech security strategies.