Listen to this Post
Introduction:
As Malaysia’s first digital bank surpasses 1.4 million customers and processes over 450 million transactions, GXBank has become a living laboratory for cybersecurity innovation in the ASEAN financial sector. Built entirely on AWS with a cloud-1ative architecture and zero legacy systems, the bank’s security framework offers a rare, behind-the-scenes look at how modern financial institutions can scale securely while staying ahead of AI-driven cyber threats. This article dissects GXBank’s multi-layered defence strategy—from biometric onboarding to generative AI fraud detection—and provides actionable technical guidance for security professionals, IT leaders, and developers looking to harden their own digital banking or fintech environments.
Learning Objectives:
- Understand the architecture and implementation of a cloud-1ative, zero-trust security model for digital banking.
- Master AI-driven fraud detection frameworks (FrAIdy/TrAIdy) and document forensics (GuardPlus) for risk operations.
- Learn how to configure API security scanning, mobile app penetration testing, and identity governance in regulated environments.
1. Cloud-1ative Architecture & Infrastructure Hardening
GXBank’s technology stack is entirely cloud-1ative, built on Amazon Web Services (AWS) with no inherited legacy systems. This architectural choice is not merely about scalability—it is a strategic security advantage. Without the constraints of ageing infrastructure, GXBank can push updates faster, deploy new security measures more efficiently, and respond to emerging threat patterns across the entire platform in near real-time. The bank controls which countries its app is available in and checks user location during onboarding.
Step-by-Step Guide: Implementing Cloud-1ative Security Controls
- Adopt Infrastructure as Code (IaC): Use Terraform or AWS CloudFormation to define your entire infrastructure. This ensures that security configurations (security groups, IAM roles, encryption settings) are version-controlled, auditable, and repeatable.
- Enforce Least-Privilege IAM: Implement strict identity and access management. GXBank’s Head of Cybersecurity & Identity Governance role is accountable for overseeing cybersecurity and access governance, aligned with Bank Negara Malaysia’s RMiT framework. Use AWS IAM roles with fine-grained policies—never use root credentials for daily operations.
- Deploy Container-Based Infrastructure: GXBank requires experience with container-based infrastructures in the cloud. Use Amazon EKS or ECS with Kubernetes network policies to segment workloads. Implement Pod Security Policies (PSP) or OPA Gatekeeper to enforce security standards at the container level.
- Enable Comprehensive Observability: Establish frameworks for metrics, logging, and tracing to maintain system health. Use AWS CloudTrail for API activity logging, Amazon GuardDuty for threat detection, and AWS Config for continuous compliance monitoring. Configure alerts for unusual patterns such as excessive API calls from a single IP or abnormal data egress.
Linux Command Example – Auditing Open Ports and Services:
ss -tulpn | grep LISTEN nmap -sV -p- localhost
Windows Command Example – Checking Firewall Rules:
netsh advfirewall firewall show rule name=all
Get-1etFirewallRule | Where-Object {$_.Enabled -eq "True"} | Select-Object DisplayName, Direction, Action
- AI-Powered Fraud Detection: The FrAIdy and TrAIdy Framework
GXBank has built three internal AI-enabled tools: FrAIdy and TrAIdy for fraud and anti-money-laundering (AML) case assessment, GuardPlus for document forensics in digital lending, and BI Bytes for governed self-service business intelligence. FrAIdy and TrAIdy function as a dual-engine generative AI framework that uses transaction and behavioural data to prepare risk narratives and recommendations for analysts. Crucially, the system does not make final decisions—human reviewers remain accountable.
Step-by-Step Guide: Building an AI-Assisted Fraud Detection Pipeline
- Data Aggregation: Consolidate transaction data, user behavioural patterns, and device fingerprinting into a central data warehouse (e.g., Amazon Redshift or Snowflake). Ensure data is structured for quick retrieval.
- Pre-configured Prompts & RBAC: Implement role-based access controls (RBAC) to govern who can access which data and what types of analysis they can perform. GXBank’s AI model is grounded in factual transaction data from its data warehouse, supported by pre-configured prompts.
- Model Training & Validation: Train a generative AI model (e.g., using Amazon SageMaker) on historical fraud cases and legitimate transactions. Establish a feedback loop where analysts validate model outputs. GXBank reports up to 95% accuracy in identifying high-risk cases and clearing low-risk alerts.
- Automate Routine Assessments: Configure the AI to automatically collect information from multiple systems and turn it into a structured assessment. This reduces case processing time from 15–20 minutes to 1–3 minutes. Implement batch processing for high-volume scenarios.
- Human-in-the-Loop Review: Ensure all high-risk and complex cases are escalated to human analysts. The AI serves as an operational support layer, not a substitute for human judgement in regulated decision-making.
API Security Testing Command – Using OWASP ZAP:
zap-api-scan.py -t https://api.gxbank.example.com/v1/transactions -f openapi -r report.html
SQL Query Example – Detecting Suspicious Transaction Patterns:
SELECT user_id, COUNT() as tx_count, SUM(amount) as total_amount FROM transactions WHERE timestamp > NOW() - INTERVAL '1 hour' GROUP BY user_id HAVING COUNT() > 50 OR SUM(amount) > 10000;
- Mobile & API Security: Penetration Testing and Secure Code Review
GXBank’s Security Verification & Testing specialists perform secure design reviews, threat modelling, secure code reviews, and penetration testing of mobile applications, RESTful APIs, and web applications. The bank uses scanning tools for mobile, API, and web application security testing. This rigorous approach ensures that vulnerabilities are identified and remediated before they can be exploited.
Step-by-Step Guide: Conducting a Mobile/API Penetration Test
- Threat Modelling: Begin with a threat model. Identify assets (customer data, transaction APIs), entry points (mobile app, web portal), and potential attackers. Use STRIDE or DREAD frameworks to prioritise risks.
- Static Application Security Testing (SAST): Run SAST tools (e.g., SonarQube, Checkmarx) on the source code to identify hard-coded secrets, insecure cryptographic implementations, and SQL injection vulnerabilities.
- Dynamic Application Security Testing (DAST): Deploy DAST tools (e.g., Burp Suite, OWASP ZAP) against staging environments. For mobile apps, intercept traffic using a proxy (e.g., mitmproxy) to test API endpoints.
- API-Specific Testing: Test RESTful APIs for OWASP API Security Top 10 risks: broken object-level authorisation (BOLA), broken user authentication, excessive data exposure, and lack of rate limiting. Use tools like Postman with automated test scripts.
- Container Security: Scan container images for known vulnerabilities using tools like Trivy or Clair.
- Reporting & Remediation: Develop comprehensive reports for both technical and executive audiences, making recommendations for security improvements. Lead engagements with engineering teams from scoping through remediation.
Penetration Testing Command – Using Nmap for Network Reconnaissance:
nmap -sV -p 443,8080,8443 target-domain.com
API Security Check – Testing for BOLA (Broken Object Level Authorization):
curl -X GET https://api.example.com/v1/users/12345 -H "Authorization: Bearer [bash]"
- Biometric Onboarding & eKYC: Balancing Security with User Experience
GXBank faced the challenge of building trust without a national digital identity system. It selected Entrust Identity Verification (IDV) for its hybrid identity verification model, combining AI-powered verification with human oversight. The solution achieved a 90% straight-through processing (STP) rate with a fraud detection rate below 1%. Biometric verification is integrated into the mobile app for onboarding and high-value transactions.
Step-by-Step Guide: Implementing Secure eKYC
- Multi-Factor Identity Verification: Combine document verification (MyKad/MyPR), facial recognition (liveness detection), and a bank transfer from an already verified account under the same name.
- Device Integrity Checks: Upon app launch, check whether the device is jailbroken (iOS) or rooted (Android), whether malware is present, and whether the user is on a VPN or unsecured Wi-Fi connection.
- Location Validation: Control which countries the app is available in and check the user’s location during the onboarding process.
- Step-Up Authentication: For high-risk transactions flagged by the fraud engine, perform step-up authentication (e.g., additional biometric verification or OTP).
- Continuous Monitoring: After onboarding, apply transaction monitoring with ongoing due diligence performed daily, screening activities repeatedly.
iOS Security Check – Detecting Jailbreak (Objective-C):
“`bash-c
- (BOOL)isJailbroken {
if TARGET_IPHONE_SIMULATOR
return NO;
else
NSArray paths = @[@”/Applications/Cydia.app”, @”/bin/bash”, @”/usr/sbin/sshd”];
for (NSString path in paths) {
if ([[NSFileManager defaultManager] fileExistsAtPath:path]) {
return YES;
}
}
return NO;
endif
}
Android Security Check – Detecting Root Access (Java):
[bash]
public boolean isDeviceRooted() {
String[] paths = {"/system/app/Superuser.apk", "/sbin/su", "/system/bin/su"};
for (String path : paths) {
if (new File(path).exists()) return true;
}
return false;
}
5. Zero Trust Architecture & Identity Governance
GXBank’s Head, Cybersecurity & Identity Governance is responsible for strategising and architecting Identity and Cybersecurity Governance, incorporating robust risk management for public cloud and frontier AI models. The bank also utilises privileged access management tools like CyberArk. Adopting a Zero Trust approach to risk is not merely about preventing losses; it is about unlocking growth.
Step-by-Step Guide: Implementing Zero Trust for Digital Banking
- Micro-Segmentation: Divide the network into small, isolated segments. Use AWS Security Groups and Network ACLs to restrict east-west traffic. Implement service meshes (e.g., Istio) for granular traffic control.
- Continuous Authentication: Never trust, always verify. Require authentication and authorisation for every access request, regardless of origin. Implement Multi-Factor Authentication (MFA) for all users.
- Least Privilege Access: Grant users and services only the minimum permissions necessary. Use just-in-time (JIT) access for privileged operations. GXBank’s Identity Governance frameworks ensure robust risk management.
- Encrypt Everything: Encrypt data at rest (using AWS KMS) and in transit (TLS 1.3). Implement field-level encryption for sensitive data like PII.
- Continuous Monitoring & Analytics: Use SIEM solutions (e.g., Splunk, AWS Security Hub) to aggregate logs and detect anomalies. GXBank conducts email content filtering to ensure employees are protected from phishing.
Linux Command – Encrypting a File with OpenSSL:
openssl enc -aes-256-cbc -salt -in sensitive_data.csv -out sensitive_data.csv.enc -k YOUR_PASSWORD
AWS CLI Command – Enforcing MFA for IAM Users:
aws iam update-user --user-1ame username --tags '{"Key": "MFA_Enabled", "Value": "true"}'
6. API Security & Open Banking Compliance
Bank Negara Malaysia (BNM) launched the Open API Framework, providing clear guidance on how banks and third-party fintech providers can securely share data. GXBank’s security specialists are expected to have experience using scanning tools for mobile, API, and web application security testing, and perform secure code review of RESTful APIs. The Monetary Authority of Singapore (MAS) mandates multi-factor authentication (MFA), the use of OTPs or biometrics.
Step-by-Step Guide: Hardening API Security
- API Discovery & Inventory: Maintain an up-to-date inventory of all APIs and their data flows. Use tools like Swagger/OpenAPI for documentation.
- Authentication & Authorisation: Implement OAuth 2.0 and OpenID Connect (OIDC) for secure authorisation. Use JSON Web Tokens (JWT) with short expiration times and strong signing algorithms (RS256).
- Input Validation & Sanitisation: Validate all inputs against strict schemas. Use parameterised queries to prevent SQL injection.
- Rate Limiting & Throttling: Implement rate limiting to prevent brute-force attacks and denial-of-service (DoS). Use AWS API Gateway or Kong for this purpose.
- API Security Testing: Regularly perform automated and manual penetration testing of APIs. Use tools like Burp Suite, OWASP ZAP, and Postman.
- Logging & Monitoring: Log all API requests and responses (redacting sensitive data). Set up alerts for unusual patterns like high error rates or abnormal request volumes.
API Security Command – Testing for SQL Injection with sqlmap:
sqlmap -u "https://api.example.com/v1/products?id=1" --dbs --batch
Nginx Configuration – Rate Limiting:
limit_req_zone $binary_remote_addr zone=mylimit:10m rate=10r/s;
server {
location /api/ {
limit_req zone=mylimit burst=20 nodelay;
proxy_pass http://backend_api;
}
}
What Undercode Say:
- Key Takeaway 1: GXBank’s AI-driven fraud detection framework (FrAIdy/TrAIdy) demonstrates that generative AI can reduce case processing time by over 90% (from 15–20 minutes to 1–3 minutes) while maintaining up to 95% accuracy. This is a game-changer for lean security teams.
- Key Takeaway 2: The bank’s cloud-1ative, multi-layered security architecture—from device integrity checks at app launch to continuous transaction monitoring—provides a blueprint for any fintech or financial institution looking to scale securely without legacy baggage.
Analysis:
GXBank’s security posture is a testament to the power of starting from scratch with a cloud-1ative mindset. By avoiding the technical debt of legacy systems, the bank has been able to embed security at every layer of its architecture—from infrastructure to application to data. The use of AI not just for fraud detection but also for document forensics (GuardPlus) and self-service analytics (BI Bytes) shows a holistic approach where security and business intelligence are intertwined. However, the bank’s experience with a sophisticated fraud incident involving tampered income statements in April 2025 highlights that AI is not a silver bullet. Continuous investment, human oversight, and regulatory alignment (BNM RMiT, MAS TRM) remain critical. For security professionals, GXBank’s journey offers invaluable lessons in balancing speed, security, and compliance in the digital age. The bank’s partnership with Entrust for eKYC and its use of CyberArk for privileged access management further underscore the importance of strategic vendor selection in building a robust security ecosystem.
Prediction:
- +1 GXBank’s AI-driven security model will become the de facto standard for digital banks in Southeast Asia, with competitors racing to adopt similar generative AI frameworks for fraud detection and risk management.
- +1 The bank’s success with a 90% STP rate and sub-1% fraud detection will push regulators like BNM and MAS to update their technology risk management guidelines, encouraging wider adoption of AI in compliance and security functions.
- -1 As GXBank scales its SME lending (MYR 25 million disbursed), the bank will face increasingly sophisticated supply chain and invoice fraud attacks, necessitating even more advanced AI defences and potentially leading to temporary lending adjustments similar to the April 2025 incident.
- -1 The growing reliance on AI for critical security decisions introduces new risks, including model drift, adversarial AI attacks, and algorithmic bias, which could undermine trust if not managed with rigorous human oversight and continuous model validation.
- +1 GXBank’s investment in cybersecurity talent—evidenced by its hiring of Security Verification & Testing specialists and a Head of Cybersecurity & Identity Governance—will create a virtuous cycle, attracting top security talent to Malaysia and strengthening the region’s overall cybersecurity ecosystem.
▶️ Related Video (78% Match):
🎯Let’s Practice For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
IT/Security Reporter URL:
Reported By: https://lnkd.in/p/emKT-PMa – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅
