Written by: Kamil Ponicki, Director of Talent Acquisition, Digital Colliers
The WIRED reporting on the researcher who got inside North Korean operator infrastructure landed with a specific number: 1,640 companies across 57 countries in 22 months. Most of the coverage focused on the fake resumes and the laptop farms. The more interesting question for anyone running security at a bank is quieter. When one of those operators sat inside your codebase for six months as a contract engineer, can you actually reconstruct which internal systems they touched?
For most mid-market banks, the honest answer is no. Not without a two-week forensic exercise across four different logging systems. That gap is the story.
Why banks carry the worst version of this problem
A typical mid-market bank has more non-employee identities than employee ones. Contract engineers, offshore delivery partners, KYC vendors, model risk consultants, core banking implementers, cloud managed service providers, and the service accounts each of them spawns. Every one of those identities gets provisioned into GitHub, Jira, the data warehouse, a couple of production read replicas, and usually at least one system nobody has reviewed access to since 2021.
The control plane for employee identity is usually reasonable. Someone owns joiners, movers, and leavers. The control plane for everyone else is a spreadsheet in someone's OneDrive, a Jira ticket queue, and a vendor onboarding form that hasn't been updated since the last audit.
Under DORA, which has been in force since 17 January 2025, that gap is now a supervisory issue. ICT third-party risk registers, contractual controls, and the ability to demonstrate operational resilience across your critical providers are not optional. If a regulator asks which of your third parties had access to what during a specific eight-week window, you need an answer that isn't a screenshot.
The shape of a unified identity graph
When I look at the banks handling this well, they've stopped treating identity as an HR problem or an IT problem. They treat it as one graph with four node types:
- Employees, with a source of truth in HR
- Contractors and contingent workers, with a source of truth in the vendor management or procurement system
- Vendors and their delegated users, with contracts and DORA registers as the source of truth
- Service accounts and machine identities, with the platform team owning the register
Every access grant, in any system, ties back to exactly one node in that graph. Every node has an owner, an expiry, and a business justification. When someone leaves, the graph tells you every downstream permission that has to die, in every system, within minutes.
The hard part isn't the diagram. It's the plumbing. You need SCIM or equivalent into every system that grants access, and you need it into the long tail, not just Okta-integrated SaaS. The bank subsidiary running its own trading platform on a fifteen-year-old middleware layer is where the exposure lives.
Why the attacker math favours patience
Attackers don't need to move fast. Only about 3 to 5 percent of publicly disclosed vulnerabilities get patched within 30 days. A contractor with legitimate credentials and six months of tenure doesn't need a zero-day. They have time to map your environment, find the unpatched internal service, and stage exfiltration through channels that look like normal contractor traffic.
Which is why the identity graph matters more than the perimeter. If you can't answer "which systems did contractor X touch in Q2" in under an hour, you also can't answer it for the operator who was pretending to be contractor X.
What the exposure actually costs
The regulatory math is not gentle. GDPR fines reach up to 20 million euros or 4 percent of global turnover, and a contractor exfiltration event that hits customer PII sits squarely in that band. That's before DORA sanctions, before the operational cost of notifying every counterparty, and before the reputational damage that follows a public disclosure.
The banks that will look competent in 2027 are the ones investing in the identity graph now. Not the tooling, the plumbing. Every access grant tied to a real human or a real service account, with a real owner, with an expiry that actually fires. It's unglamorous work. It's also the difference between a two-hour forensic answer and a two-week one.
If your team is still pulling contractor access lists by hand for the audit, you already know which side of that line you're on.