SBS Skipton Building Society

Skipton Building Society has been holding money and issuing mortgages since 1853 - 172 years of accumulated digital debt alongside its physical branch network. As a mutual owned by over one million members rather than shareholders, the threat model leans toward protecting personal financial data at scale: savings accounts, mortgage details, pension planning records, ISAs. The attack surface spans 82 branches nationwide plus whatever online portals and internal systems sit between members and their money. This isn't a fintech startup optimizing for velocity. It's a legacy financial institution operating in the UK regulatory framework - FCA and PRA oversight, GDPR obligations, the lot. The data footprint includes sensitive advisory relationships covering investment planning, retirement, and inheritance tax. Every member interaction, from a basic easy-access account to an Income Booster mortgage, generates records that need defending. Security work here means securing traditional financial services infrastructure: savings platforms, mortgage origination systems, member portals, and the advisor-facing tools that handle wealth management data. The mutual structure means no quarterly shareholder pressure, but it also means the membership base - people who chose a building society over a bank - expects their data treated with a specific kind of care. The stakes are straightforward: protect financial records spanning generations of UK savers and homeowners.