M&T Bank

From Platform Security to Enterprise Cyber Defense

When I joined M&T Bank nearly ten years ago, cybersecurity looked very different from what it does today. Security discussions were largely focused on perimeter defenses, traditional access management and protecting individual systems. Mainframe security teams operated within highly specialized environments. Although the platform was recognized for its exceptional security and reliability, it was not always included in broader enterprise cybersecurity conversations.

Today, cybersecurity is driven by integrated security operations, real-time analytics, cloud connectivity, artificial intelligence, automation, DevSecOps and enterprise-wide visibility. Mainframes are recognized as critical components of modern hybrid architectures that power some of the world's most important financial, healthcare, government and commercial systems.

My journey at M&T Bank has provided a front-row seat to this evolution, and perhaps the most important lesson I have learned is that the future of cybersecurity is not replacing the mainframe. The future is being built upon it.

Early in my career, mainframe security centered on traditional security administration. Responsibilities included user provisioning and deprovisioning, user and role-based access controls, external security manager administration, compliance reporting, segregation of duties reviews and privileged access management.

Those responsibilities remain essential today, but the role has expanded significantly. Modern security professionals must understand threat detection, security analytics, cloud integration, automation, incident response and enterprise risk management. As organizations adopt Zero Trust architectures, security teams increasingly focus on continuously validating users, devices, applications and workloads instead of controlling network access.

Breaking Down Silos through Visibility and Integration

One of the most significant changes I have witnessed is the elimination of operational silos between security teams. Historically, organizations maintained separate teams for mainframe security, distributed systems security, network security, identity management, Security Operations Center activities and cloud security. Each team operated within its own environment and relied on separate tools.

Today, cybersecurity leaders expect a unified view of enterprise risk. A suspicious login on a cloud platform may be connected to an identity event originating from Active Directory, which may correlate with privileged activity occurring on a mainframe system processing millions of financial transactions.

Perhaps one of the most transformative advancements has been the integration of mainframe security data into enterprise Security Information and Event Management platforms.

For years, many organizations relied on platform-specific logging and reporting tools. Valuable security data existed, but security operations teams often lacked centralized visibility. Today, platforms like Splunk, QRadar, Elastic, Microsoft Sentinel and other SIEM technologies correlate information across mainframe security events, identity platforms, cloud environments, endpoint security tools, network telemetry, application logs and threat intelligence feeds.

For mainframe security professionals, this transformation has been game-changing. Security events that once required specialized knowledge and manual investigation can now be analyzed alongside enterprise-wide security telemetry. The result is faster incident detection, stronger threat correlation, better compliance reporting, enhanced forensic capabilities and greater executive visibility.

Embedding Security Earlier and Smarter

Software development has undergone its own transformation. Ten years ago, development, operations and security teams often worked independently, and security reviews frequently occurred late in the development lifecycle. Today, DevSecOps has fundamentally changed that model by embedding security from the beginning.

For organizations using mainframe applications alongside cloud-native architectures, DevSecOps makes it possible to automate security validation, integrate compliance testing, perform vulnerability analysis earlier, improve software quality and reduce deployment risk.

The modern mainframe environment supports APIs, containerized integrations, automated testing pipelines and continuous delivery models that would have seemed unimaginable to many industry professionals only a few years ago.

Artificial intelligence is also rapidly becoming one of the most significant forces shaping cybersecurity. AI-powered security operations help organizations identify patterns, prioritize alerts, automate investigations and accelerate response times.

We are already beginning to see capabilities such as automatic detection of identity anomalies, real-time risk scoring of privileged access activities, instant correlation of mainframe security events with cloud threats, AI-driven investigation support and more proactive threat hunting emerge across the cybersecurity industry. Mainframe security teams that once focused primarily on rule administration and audit compliance are increasingly participating in advanced threat detection and cyber defense initiatives.

Why Mainframes Continue to Power the Future

Despite decades of predictions about their demise, mainframes remain among the most strategic technology platforms in existence. Organizations still depend on them because they deliver extreme scalability, unmatched reliability, continuous availability, data integrity and transactional security.

What has changed is how the mainframe participates within the broader technology ecosystem. Today's mainframes connect to cloud services, support API-driven architectures, integrate with AI workloads, feed enterprise analytics platforms, participate in DevSecOps pipelines and deliver realtime business intelligence.

Rather than being replaced by modern technology, the mainframe has evolved alongside it. In many cases, it remains the trusted system of record that enables innovation across the enterprise.

Preparing the Next Generation of Cybersecurity Leaders

One of the industry's greatest challenges is ensuring the next generation understands the value and relevance of mainframe technology. Many students and early-career professionals are introduced to cloud computing, cybersecurity and software engineering, yet rarely learn about the systems that process the world's most critical transactions.

As an IBM Champion, mentor, speaker and advocate for STEM initiatives, I make it a priority to help bridge that gap. The future workforce needs to understand that cybersecurity is not only about protecting websites and mobile applications. It is about securing the infrastructure that powers economies, governments and industries.

Mainframe professionals bring expertise in resilience, identity management, access control, compliance and enterprise security that remains invaluable in today's cybersecurity landscape.

As I reflect on ten years at M&T Bank, I am struck by how much has changed and how much has remained fundamentally the same. The tools have evolved. Security operations have matured. DevSecOps has transformed software delivery. SIEM platforms have unified security visibility. AI-powered security operations are accelerating the speed of cyber defense. Yet the mission remains unchanged. Protect the data. Protect the customer. Protect the business.

As organizations embrace AI, automation, hybrid cloud and next-generation cybersecurity operations, I believe the mainframe will remain at the center of trust, resilience and innovation, enabling the future while securing the present.