On July 21, the CYBERFINANCE-2026 forum, organized by the National Bank of Kyrgyzstan, took place at the Razzakov Kyrgyz State Technical University (KSTU) in Bishkek. Systems integrator Green Light acted as an official partner, and Baisal Sheraliev, Senior Security Engineer at Green Light, delivered a report on Zero Trust Network Access (ZTNA) in the financial sector. Below is a breakdown of the core concepts presented.
The traditional corporate network perimeter in Kyrgyzstan’s financial sector has largely dissolved. The rollout of the digital som, widespread cloud adoption, open APIs, and various fintech integrations continuously expand the attack surface. Furthermore, remote work and third-party vendor connections push sensitive data far beyond the bank’s secure boundaries. Consequently, trust can no longer be granted simply because a device is located on the internal network. Security must be rooted in strict identity verification, contextual awareness, and the principle of least privilege for every single request.
Traditional VPNs are now widely considered obsolete because they grant users access to the entire network rather than specific resources. If an attacker breaches the perimeter, they gain the freedom to move laterally across the infrastructure. Zero Trust Network Access (ZTNA) replaces this legacy mechanism by granting access strictly on a per-application basis. All other corporate services remain hidden from the outside world and invisible without explicit authorization. Under ZTNA, a trust broker dynamically evaluates access for every new session, factoring in both user identity and device posture.
This architecture is already standard practice in high-load industries. Global airlines, for instance, use ZTNA to provide thousands of worldwide contractors with secure access to critical Global Distribution Systems (GDS). Users work entirely through their web browsers without VPN clients. The internal network remains fully concealed, lateral movement is prevented, and every action is recorded in audit logs. For the banking sector, this is the optimal operational model for managing third-party vendor access.
Today, however, securing human access addresses only part of the risk. Digitalization introduces entirely new threat vectors where the primary actors are autonomous AI agents. A modern AI agent is fundamentally different from a standard chatbot: it can independently set sub-tasks, invoke tools, make decisions, and operate autonomously within an IT infrastructure. In the financial sector, these solutions are already automating SOC analysts’ workflows, anti-fraud systems, and complex customer service scenarios. The underlying risk is that each of these agents requires direct access to the bank’s databases and internal systems.
The scale of this shift is significant: the number of autonomous agents is projected to grow by 85% over the next year. Already, machine identities outnumber human employees in a typical organization by a ratio of 80 to 1. Granting AI agents broad network access and standing privileges can lead to massive security incidents, as machines operate in milliseconds and instantly replicate errors. We are also seeing highly specific threats emerge: prompt injection, for instance, allows hackers to embed hidden instructions within data to force an AI to execute malicious commands. The abuse of legitimate tools, agent token theft, and standing privileges combine to create an enormous blast radius in the event of a compromise.
To mitigate these risks, core Zero Trust principles must be extended to AI agents, treating them as full-fledged network entities. Every AI must have a verifiable identity strictly tethered to its human owner. Instead of standing permissions, systems should issue short-lived Just-in-Time (JIT) tokens granted exclusively for specific tasks—a concept known as Zero Standing Privileges (ZSP). Additionally, a unified MCP (Model Context Protocol) gateway must tightly restrict the toolkit available to the agent and rigorously filter its inputs. Every API call or data request made by an AI must be continuously logged to ensure auditability and behavioral control.
Implementing this defense-in-depth architecture requires strict sequencing. For a bank, the roadmap begins with a comprehensive inventory of all network entities: humans, machines, and AI agents. The next step is enforcing strong authentication, notably phishing-resistant MFA. This is followed by replacing legacy VPNs with ZTNA for targeted, application-level access. The final stages involve microsegmentation, deploying guardrails for AI agents, and establishing continuous behavioral monitoring.
Securely managing autonomous AI entities and protecting sensitive data relies entirely on a Zero Trust architecture. Strict identity verification, minimal privileges, and total traceability form the foundation that enables the financial sector to deploy innovations without expanding its attack surface.
For its significant contribution to organizing and conducting the CYBERFINANCE-2026 cyber exercises, Green Light was awarded a letter of appreciation from the National Bank of the Kyrgyz Republic.
