Thai banks boost IT spending and 24-hour cyber monitoring

Thai banks are increasing technology spending and strengthening 24-hour monitoring as the Bank of Thailand presses lenders to tighten defences against increasingly sophisticated cyber threats.

Bank of Thailand (BOT) governor Vitai Ratanakorn said attempted attacks and efforts to probe Thai systems had increased over the preceding one to two weeks, reflecting a global trend, but remained within institutions’ ability to defend against them.

 

Central bank tightens reporting and information sharing

The BOT has met banks’ chief information officers and cybersecurity chiefs to review preparedness and demand stronger protection, Vitai said. Banks must address remaining weaknesses, accelerate information sharing and move to daily reporting when attempted hacks or attacks occur.

“Banks must tighten both prevention and reporting,” Vitai said, adding that sharing information among institutions and with the BOT would enable faster coordination and protection.

Deputy Prime Minister and Finance Minister Ekniti Nitithanprapas said Thailand was strengthening cybersecurity across finance and critical infrastructure. The Finance Ministry and National Cyber Security Agency (NCSA) were extending surveillance across sectors, alongside close monitoring of global threats. 

“Cyberattacks are a global phenomenon,” Ekniti said, confirming coordination with the Thai Bankers’ Association chairman and BOT governor to maintain preparedness.

Payong Srivanich, president and chief executive of Krungthai Bank and chairman of the Thai Bankers’ Association, said strict access rules governed connections with outside partners. Banks monitored suspicious behaviour and coordinated with the NCSA on threats crossing industry boundaries.

Payong identified the Thailand Banking Sector Computer Emergency Response Team (TB-CERT), operating under the association, as the sector’s central information-sharing and coordination mechanism, working directly with the BOT. Banks were required to update software and technology components promptly to close vulnerabilities.

AI threats prompt spending on stronger defences

Kobsak Pootrakool, director and senior executive vice president of Bangkok Bank, told Bangkok Biznews that the current activity marked the beginning of a wider threat. More emboldened international criminals were replacing domestic thieves and using artificial intelligence (AI) to strengthen attacks.

Kobsak said targets extended to anything connected to the internet, including refrigerators and hospital blood freezers. Inadequate private-sector cybersecurity investment left credit-card data, medical records and industrial control systems exposed.

Kobsak compared online assets with a vault that criminals could reach without first passing physical security guards. “What worries me most is that many private organisations are not taking cybersecurity seriously,” he said.

Bangkok Bank was investing heavily in AI to protect financial systems and customers’ assets, Kobsak said. Financial institutions and the BOT were also studying advanced technologies, including quantum technology, but risked adapting more slowly than financially motivated attackers making rapid technological advances.

Krungsri’s technology budget was growing by 15–20% annually. Saisunee Hanprathueangsil, chief information and digital officer at Bank of Ayudhya, which operates as Krungsri, said spending now focused on operational efficiency and faster threat detection following investment in core technology foundations.

Krungsri’s unified security platform was 80% implemented, bringing infrastructure, database and application security together around shared data, Saisunee said. An AI engine supported threat analysis and investigation.

Saisunee said Krungsri combined business continuity drills with information sharing involving Mitsubishi UFJ Financial Group (MUFG), the BOT, the

Thai Bankers’ Association and cyber police. AI also supported staff in improving accuracy and efficiency within BOT requirements.

Arapat Sangkharat, chief executive of Maybank Securities (Thailand), said its parent, Malaysia’s Maybank Group, had made cybersecurity its top priority and moved to its highest level of preparedness. A single attack could immediately damage its reputation and credibility.

Maybank Securities (Thailand) benefited from its parent’s extensive technology and cybersecurity infrastructure, Arapat said, citing annual IT allocations of several hundred million baht to purchase leading cybersecurity software.

Maybank replaced computers, laptops and other hardware before the end of their service life rather than waiting for breakdowns, Arapat said. Connections involving removable USB devices or flash drives were immediately blocked, while multiple firewall layers and regular penetration testing protected customer-facing systems.

Banks prioritise rapid recovery and continuous monitoring

Kattiya Indaravijaya, chief executive of Kasikornbank, said rapid detection, response and recovery were essential because no security system could provide complete protection. Even a five-minute interruption to financial services could seriously affect businesses and customer confidence.

Kattiya distinguished between organisations that knew they had been hacked and those that did not, describing the latter as the greater concern. Kasikornbank was closing vulnerabilities, operating a 24-hour monitoring centre and rehearsing business continuity plans to restore services as quickly as possible.

Siam Commercial Bank (SCB) said it was strengthening layered protection for finances, data and increasingly complex transactions as AI use expanded. Its Security Operations Center monitored, analysed and responded to threats around the clock.

SCB also used scanning tools to assess and promptly close vulnerabilities, alongside regular business continuity drills to prepare staff and procedures for unexpected incidents.

Piti Tantakasem, chief executive of TMBThanachart Bank (ttb), said specialist teams, detection systems and 24-hour surveillance supported stronger security across the bank. Measures also protected the continuity of critical operations in line with required standards.

Ttb regularly tested business continuity and cyber incident response plans, Piti said. Customers should avoid suspicious links in messages, emails or other communications, never disclose passwords, personal identification numbers or one-time passwords, and verify websites and applications before transacting.

AWS sets out five safeguards for cloud and AI adoption

Chatchai Komrangded, head of solutions architecture at Amazon Web Services (AWS) Thailand, outlined five security priorities for organisations adopting cloud services or expanding into AI and generative AI. AI agents were entering practical use, from developing applications to protecting systems, he said.

Chatchai recommended building security into software development from the outset and using continuous automated checks on live systems to identify vulnerabilities and anomalies quickly.

Chatchai also called for clear limits on AI agents’ access to data and authority to act, alongside automated threat detection, analysis and response to shorten the time taken to identify and handle incidents.

Chatchai’s fifth recommendation was to establish a security culture throughout the organisation, treating protection as a requirement from the beginning rather than an afterthought.