Ask HN: How do banks and fintec stay on top of IT security?

I am very pessimistic about IT security, after all, zero day exploits exist. So I tend to dismiss all fintec related startup ideas as unrealistic. Yet, some companies pull it off, and banks stay in business. How?