I have investigated multiple cyber incidents pertaining to swift transfers including malware and insider collaboration, the ground reality at the most institutions is that their infrastructure are poorly designed and are insecure by default. In one of the bank's I visited, the Swift AGS was on the same vlan as the rest of the network, including admin and receptionist's PC. No EDR, basic AV, no application aware firewalls, no network baselining, improperly configured AD events, 2 month log retention period, lack of standardized OS golden images and pirated operating systems cracked using executables downloaded from internet. Worst, AGS was managed through a PC accessible via TeamViewer protected through a weak password. You may consider this as an isolated case, but on ground, most of the banks only focus on CBS and security takes a backseat, until something happens.