Security that scales: how Wilco protects processes, data and people
October was Cybersecurity Awareness Month. At Wilco, cybersecurity trainings and exercises run throughout the year, and in October we ran them more intensively, to keep awareness high across every team.
We spoke with two members of our IT team. Alexander Vokriachko, Head of IT Infrastructure, explained how Wilco protects its processes, data and people as the company grows. Artem Kolchin, Senior IT Project Manager, shared what the latest AI attacks mean for a financial company.
Growing without compromising
At the early stages of a company, speed comes first. For a larger company, security depends on structure: a defined onboarding process, written policies and a clear standard for the devices people work on.
Fast growth creates a constant tension between usability and security. For Alexander, that tension is a tradeoff to manage, not a reason to cut corners.
“Security is harder to manage when you scale, but that is not a reason to compromise on it,” he says. “It has to be designed into the way people join, work and use their devices from day one, not added on later.”
Standards as the backbone
Wilco builds its approach on ISO/IEC 27001 and ISO/IEC 27002, and is on track to formalise its ISO/IEC 27001 certification.
The first standard defines how an information security management system is run and is the one companies are certified against; the second sets out the controls. The principle behind both is that every process and every piece of data must be secured, and internal audits check the company against these requirements.
“The Central Bank of Armenia’s recommendations are close to these international standards. As cyber risks become ever more pressing, I expect them to become mandatory soon,” Alexander says.
People: the weakest link and the first line of defence
“People are the main point of failure, and attackers know it,” Alexander says. Phishing and social engineering target employees, not servers. But the reverse is also true: an employee who spots a phishing attempt stops an attack before it starts. That is why awareness at Wilco is a continuous programme, not a campaign: year-round training and exercises, a cybersecurity course on the internal portal, and tests on what employees learn. Penetration tests put Wilco’s own systems under controlled attack to find weaknesses before an attacker does.
Around this sit cybersecurity dashboards across the infrastructure, AI-supported security analysis and automation of routine tasks, so the team spends its time where judgement is needed. Some threats cannot be prevented in advance: a zero-day vulnerability, a flaw attackers exploit before a fix exists, is unknown by definition. “What you control is how quickly you see it and how well you respond,” Alexander says.
AI: the new attack surface
For Alexander, one of the biggest challenges right now is shadow AI: employees using personal AI tools for work, outside the company’s control. For a financial institution, that means data can leave the company without anyone noticing. There are no industry standards for it yet, nothing like the Cisco certifications the networking world relies on, and companies are caught between the fear of missing out and the instinct to restrict.
Wilco chose a corporate AI, so AI is used inside a controlled environment. “Our AI policy draws a hard line: personal data and critical information never go into AI tools,” Alexander says. The policy is part of the training programme, and employees are tested on it alongside internal and external security topics.
While Alexander looks at AI from inside the company, Artem Kolchin also looks at it from the outside. Through his weekly column, he keeps an eye on what is happening in AI security around the world. In October, three stories stood out to him, and each shows where the next risks for financial companies lie.
Permissions are the new prize
For Artem, the recent wave of attacks in the AI world shows where the next risks for financial companies lie.
Artem points to a vulnerability found in Meta Muse, an AI assistant for Mac with access to files, email, messages, camera and microphone: malware already running on a Mac could slip its own commands into the user’s voice prompt, and the assistant would carry them out with the permissions it had been granted. Meta shipped a fix the next day. “The most valuable asset for an attacker is no longer the model or the data: it’s the permissions the agent has already been given,” Artem says. His answer is least privilege, a human on critical actions, and updates now, not someday.
Artem, who builds his own security tools, including a pentesting tool, has seen frontier models become much stricter about helping with that kind of code. Attackers face no such limits. In an attack on South Korean financial institutions, according to CrowdStrike, the attacker likely used ARTEX, an open-source agentic pentesting tool, together with Claude Code, with the open DeepSeek model doing most of the work. South Korean authorities reported that more than 68,000 people were affected. “The attacker simply picks an open model that refuses nothing,” he says. “The defender hits refusals when building a pentesting tool or investigating an attack.”
The risk sits around the core
Cathedral, a startup testing Anthropic through its bug bounty programme, reported that its AI agents found paths into internal systems through third-party business software in under 12 hours. Anthropic confirmed access to a limited set of sales, HR and IT systems, and said user conversations, source code and model weights were not reached. “Client and employee personal data rarely leaks through core systems,” Artem says. “It leaks through the integrations around them. Finding an attack chain through these services used to take a pentest team weeks. Now an agent does it in half a day.”
He suggests three questions every team should ask itself:
- Do we have a complete list of SaaS tools with access to client data?
- What permissions does each integration have, and does it need all of them?
- Could we cut off a vendor within an hour if a vulnerability surfaced tomorrow?
Results nobody sees
“The paradox of security is that a good result is invisible: success means nothing happens,” Alexander says. What nobody sees is easy to undervalue, so Wilco makes the work visible internally, through dashboards, audits, tests and training results, and keeps investing in it when everything is quiet.
His message to colleagues is simple: “Cybersecurity is risk management, and people are the key to it. Every one of us is part of the defence.”
Wilco LLC is supervised by the Central Bank of Armenia.
