Cybersecurity is top of mind for many executives today, as news broke of an alleged Russian hacking campaign that infiltrated the U.S. departments of Homeland Security, Commerce and Treasury, as well as thousands of businesses, Reuters reported.

For the $1.3 trillion TD, cybersecurity management is born out of its fusion centers, where the bank is using an automated decision tree capability to help analysts connect dots on threat incidents that occur, and to better understand indicators of compromise.

“There are tools that we work with that help us to take events — billions of events — correlate those events and understand what are the true areas we need to focus on from an incident perspective,” Claudette McGowan, TD’s global executive officer for cybersecurity, told Bank Innovation.

Remote work introduced a new challenge for the analysts within TD’s fusion centers, which are resiliency hubs that bring together bank experts cross cybersecurity, tech, incident response, engineering and ops.

“Imagine you’re an analyst and you’re getting all this information, how are you individually going to make the same decision as the person beside you … when there’s not that person beside you,” McGowan said. The bank leaned on an automated decision tree capability that helps bring the analysts to very similar outcomes, she said. TD also deployed automation as a tool for its forensics team to give analysts greater visibility into which alerts should be prioritized.

TD is investing in the dissemination of security intel across the organization, so that business leaders can subscribe to a list and have access to the threat trends and patterns picked up by the analytical teams. “It’s a service where [business leaders] put their hand up and say, ‘I’d like to know what’s going on,’ and there’s not a day where I don’t see a leader or somebody saying they’d like to be added to the list,” McGowan said.

Looking ahead, TD is working to improve integrations for its automated case-management system, which oversees incident cases across the organization, she added. “How we share data across the different disciplines is quite powerful because in many cases, whether it’s compliance, or fraud, or the cyber team … it’s paramount that we share as much as we can,” McGowan said.

TD’s four fusion centers are located in New Jersey, Singapore, Tel Aviv and Toronto; at the beginning of the pandemic, the centers were refashioned into war rooms to better adapt to the bank’s rapidly changing needs and environments.