The foundation of security compliance for financial services businesses

One of the less surprising findings of the 2026 Verizon Data Breach Incident Report (DBIR) is the fact that incidents targeting the Financial and Insurance sector are on the rise. As they put it, “This sector continues to be a favorite among attackers, which isn’t surprising given that its core business is handling money.” For small-to-medium businesses (SMBs) in the financial services sector, the DBIR paints an even more dire picture. The report notes that SMBs face the same threats and breach patterns of larger organizations, but are also disproportionately impacted by attacks; 96% of ransomware victims were SMBs. In short: businesses in the financial services industry who are still building their foundation, or who possess limited security resources, are caught between a rock and a hard place. They operate within one of the most heavily targeted sectors for cyberattack, and are held to enterprise-level security standards by regulators and clients alike, but they’re operating with startup-level security resources. For lean security and IT teams to make the most of those limited resources, they need to focus on what they can afford. That means getting the fundamentals right for a strong and impactful security foundation. The highest-leverage fundamental is, of course, credential management. Top security challenges for financial services organizations Small IT and security teams in the financial services industry are faced with high expectations when it comes to security. Unfortunately, they also experience significant challenges when it comes to securing credentials. AI is accelerating SaaS and credential sprawl JP Morgan Chase’s recent research report, Understanding the use of AI among small businesses, finds that not only are a growing number of small businesses adopting AI, when they do, they also tend to implement a greater number and variety of AI tools. It’s not hard to understand why this is the case; AI’s ability to automate processes and improve productivity is a natural fit for lean teams, trying to maximize impact with limited resources. However, AI tools and agents are also accelerating the rate of SaaS sprawl, shadow IT, and policy violations. One in four employees has used AI applications that weren’t approved by their company, and over a third of employees admit to having knowingly disregarded their company’s AI policies. AI is also increasing the sophistication of attacks. Attackers are able to move faster, and are particularly able to generate more convincing phishing attacks. Unfortunately, phishing-resistant authentication factors are hard to deploy at scale. As RSM reported, “Many middle market and smaller financial services organizations lag their larger counterparts in this area.” AI use can also drastically accelerate credential risks, as AI tools and agents interface with credentials and developer secrets at a scale far beyond what traditional identity and access management (IAM) systems were designed to govern. To learn more about credential sprawl and how AI puts credentials at risk, read 1Password’s ebook, Credential Sprawl: How AI increases the risks. Complex compliance standards Cybersecurity compliance represents one of the greatest challenges for businesses of all sizes in the financial services industry. SOC 2, GLBA, and PCI DSS are just a few of the compliance standards with strict guidelines designed to protect financial information. These standards exist with good reason; when financial data is compromised, the consequences can be dire for companies and users alike. Still, the complex and varied legal and compliance standards that financial service providers have to meet can be daunting, to say the least, particularly when access is distributed across a growing sprawl of unmanaged apps and credentials. For instance, to meet standards like GLBA, HIPAA, and PCI DSS, teams have to be able to prove to an auditor that every system or app that interacts with protected data is being guarded by strong credentials and other authentication factors. Unfortunately, 1Password’s 2025 annual report found that two-thirds of employees admit to engaging in poor password practices, including: Using the same passwords across multiple work accounts Never changing IT-default passwords Using the same password for both work and personal accounts Texting, emailing, or otherwise messaging passwords to yourself or a colleague Each of these practices fly in the face of compliance guidelines. Unfortunately, scattered security tooling and unmanaged sprawl can make it difficult to enforce policies around password use, leaving access records fragmented at best, or non-existent at worst. All of this can make it difficult to prove compliance to the satisfaction of an auditor, and compliance failures can represent significant costs. A survey in 2026 found that 25% of small business owners stated that they had received a compliance-related fine or citation. As they reported, “Most penalties t

Extras afișat conform termenilor RSS ai publicației · 142 cuvinte · textul integral și figurile sunt pe site-ul publicației