Interview: D360 Bank redefines cyber security for Saudi Arabia’s cashless future

As Saudi Arabia accelerates toward a cashless, digitally driven economy, cyber security has moved from a technical discipline to a cornerstone of national trust. At the heart of this transformation are digital-first banks such as D360 Bank, where security must evolve at the same pace as innovation.

For Muath Alhomoud, director of cyber security at D360 Bank, the challenge is clear: enable speed, openness and customer-centric design, without compromising resilience.

“Digital banking today operates in an environment of constant exposure,” Alhomoud says. “Payments are instant, ecosystems are interconnected and customer expectations for frictionless experiences are higher than ever. Security can no longer be reactive, it has to be adaptive and embedded by design.”

This shift comes at a time when digital payments globally surpassed US$9.5tn and continue to grow at double-digit rates. In parallel, application programming interfaces (APIs) now account for the majority of global web traffic, fundamentally changing how banks expose services and interact with fintech partners. In Saudi Arabia, these trends are amplified by Vision 2030, which targets 70% cashless transactions by the end of the decade.

Against this backdrop, Alhomoud explains that payment security strategies are undergoing a structural rethink. Traditional perimeter-based defences are no longer sufficient in an API-driven, open banking world. Instead, banks are moving toward intelligence-led security models built on zero-trust principles, continuous risk assessment and strong cryptographic foundations.

“Every transaction, identity and device must be verified continuously,” he says. “Zero trust isn’t just an architecture, it’s a mindset. When combined with risk-based authentication, we can significantly reduce customer friction while improving fraud detection.”

This balance between security and experience has become a defining priority. Studies show that risk-based approaches can cut customer friction dramatically, and Alhomoud sees this as essential to digital adoption. “Security that frustrates customers ultimately erodes trust,” he adds. “The goal is to make protection invisible but effective.”

However, securing payment systems in an increasingly connected world introduces additional complexity. The rapid expansion of APIs, mobile applications, fintech integrations and software supply chains has dramatically increased the attack surface. At the same time, real-time payment rails compress decision-making windows, giving defenders milliseconds rather than minutes to respond.

“Instant payments are transformative, but they are also attractive to attackers,” Alhomoud says. “Fraud attempts concentrate where speed limits human intervention. That’s why behavioural analytics and AI-driven anomaly detection are no longer optional, they’re foundational.”

“Security that frustrates customers ultimately erodes trust. The goal is to make protection invisible but effective”

Muath Alhomoud, D360 Bank

Third-party and supply-chain risks further complicate the landscape. As embedded finance and SaaS adoption grow, banks must maintain visibility far beyond their own infrastructure. According to Alhomoud, this requires rigorous third-party risk management aligned with Saudi regulatory frameworks, combined with end-to-end ecosystem mapping. “You can’t protect what you don’t fully understand,” he says.

Cloud adoption has become a critical enabler in addressing these challenges. Like many modern financial institutions, D360 Bank operates in a hybrid, cloud-centric environment governed by SAMA, NCA, and PDPL requirements. For Alhomoud, the cloud is not a security risk when implemented correctly.

“Cloud-native architectures allow us to build security directly into how systems are designed, deployed and operated,” he says. “From hardened containers and secure landing zones to CI/CD pipelines with automated guardrails, security becomes continuous rather than episodic.”

Operationally, this means real-time telemetry feeding security operations centres, continuous vulnerability scanning, and drift detection that identifies misconfigurations before they become incidents. Governance models also evolve, with shared responsibility frameworks and continuous compliance monitoring replacing periodic audits.