###### Abstract  
The global financial sector's accelerating digitalization, propelled by the growing demand for rapid and tailored services, is increasingly vulnerable to complex cyber threats. This vulnerability underscores the critical need for comprehensive and coordinated cybersecurity efforts across all organizational levels. In this context, this study examines the role of internal audit as the third line of defense, investigating its potential to improve the effectiveness of cybersecurity controls within Brazilian financial institutions. The research aims to bridge existing gaps in cyber risk management by employing a qualitative methodology centered on semi-structured interviews with internal auditing, risk management, and information security experts across ten financial institutions. The data collected were analyzed using content analysis, enabling the categorization and interpretation of current practices and challenges in cyber risk management. The results indicated two perspectives on the depth of assessments conducted by internal audit and reinforced the fundamental role of internal audit in strengthening cybersecurity defenses: whether through high-level assessments of governance and management or penetration testing in specific scenarios, it can validate and increase the effectiveness of implemented controls. In addition, the study highlights the usefulness of data analytics for continuous auditing, identifying it as a proactive approach for the early detection of emerging cyber risks. These insights contribute significantly to the scholarly discourse on internal auditing's role in the improvement of a secure and resilient organizational environment. They also offer actionable strategies for financial institutions seeking to integrate effective cyber risk management practices, thus reinforcing the sector's preparedness against increasingly sophisticated cyber threats. c 2025 15 5715 17  
investment by the need to address more sophisticated and frequent threats, as well as the pressure to comply with strict data protection regulations. Despite the increase in investment, many challenges remain. One of these is ineffective or non-existent cyber risk management, as many organizations still need robust processes to identify, assess, and mitigate cyber risks [5]. This deficit is often due to a need for more internal expertise and senior management underestimating cyber threats. Another worrying trend is the continued rise in the number of cyber attacks. Studies have documented a significant increase in cyber incidents, including ransomware attacks, phishing attacks, and data breaches. These attacks are more frequent and sophisticated, making it harder for organizations to defend themselves [1; 6]. In parallel with the increase in attacks, there has been a rise in system vulnerabilities. [PERSON], [PERSON], and [PERSON] [2] point out that the increasing complexity of IT systems and the rapid adoption of new technologies often result in unpatched vulnerabilities. These flaws provide attractive entry points for cybercriminals, exacerbating the risk of successful attacks. The costs associated with data breaches and system outages are also rising. According to an IBM report [7], companies face increasing expenses to recover data, restore operations, and deal with legal and reputational repercussions of security incidents. These costs can be very significant, especially for small and medium-sized businesses that may not have the financial resources to bear such losses. An organization's reputation can also suffer significant damage due to security breaches. Security incidents can seriously undermine consumer and partner trust, causing loss of business and opportunities. Rebuilding trust is a time-consuming process and can have a lasting impact on the viability and success of the organization [8]. Another challenge is the need for more cooperation and information sharing about threats and vulnerabilities.