Cybersecurity for Finance and Insurance

Home/Cybersecurity for Finance and Insurance

Banks, credit unions, advisors and insurance agencies are not just advised to have security. They are examined on it. Regulators expect monitoring, testing and a written incident plan, and the clocks after an incident are short: 36 hours for banks, 72 hours for credit unions, three business days for Oklahoma insurance licensees. IBM puts the average cost of a breach in financial services at $5.56 million.

Cytek works with community banks, credit unions, registered investment advisors, lenders and independent agencies, with 24/7 monitoring and testing through the Safeguard™ platform and the reports examiners ask to see.

Talk to an analyst →Get your security score

01

The risks we see in finance and insurance

  • Account takeover and wire fraud. A compromised employee or customer mailbox leads to fraudulent transfers and changed payoff instructions.
  • Ransomware against the systems you run on. Core banking, loan origination and agency management systems are high-value targets, and so are the vendors that host them. Verizon's 2025 DBIR found third-party involvement in breaches doubled to 30%.
  • Credential attacks on customer portals. Passwords reused from other breaches get tried against online banking and client portals.
  • Concentrated personal data. Social Security numbers, account numbers and health information on every customer, which makes any breach a reportable one.

02

What examiners and regulators expect

Which rules apply depends on your charter and license. Most firms answer to more than one.

  • Banks. GLBA and the Interagency Guidelines, FFIEC examination expectations, and the federal rule requiring notice to your primary regulator within 36 hours of a significant computer-security incident.
  • Credit unions. NCUA's rule requiring notice within 72 hours of a reportable cyber incident, in effect since September 2023, plus information security examinations.
  • Investment advisors and broker-dealers. Amended SEC Regulation S-P: an incident response program, oversight of service providers and customer notice within 30 days. Compliance dates were December 3, 2025 for larger firms and June 3, 2026 for smaller ones, and the SEC lists Reg S-P as a 2026 examination priority.
  • Lenders, mortgage brokers and dealers. The FTC Safeguards Rule: a written security program, MFA, encryption, annual penetration testing and six-month vulnerability scans, and FTC notice within 30 days for breaches affecting 500 or more consumers.
  • Insurers and agencies. The Oklahoma Insurance Data Security Act (36 O.S. §§ 670–679), based on the NAIC model law: an information security program, risk assessment, incident response plan, board reporting and notice to the Insurance Commissioner within three business days of a qualifying event. Licensees under $5 million in annual revenue are exempt from most of it.
  • Everyone. Oklahoma's updated breach notification law (Attorney General notice within 60 days for 500 or more residents, effective January 1, 2026), and PCI DSS 4.0 if you handle card payments.

03

How Cytek helps

Related

Also see

Professional services

Law firms, accounting firms and advisors keeping client files confidential.

Learn more →

Small and mid-size businesses

Any company handling customer data, payments or payroll.

Learn more →

Safeguard platform

MDR, SIEM, ITDR, scanning and more in one portal.

Learn more →

FAQ

Frequently asked questions

How quickly do we have to report a cyber incident?

It depends on who regulates you: 36 hours to a bank's primary federal regulator, 72 hours to the NCUA for credit unions, three business days to the Oklahoma Insurance Commissioner for insurance licensees, 30 days to the FTC under the Safeguards Rule, 30 days to affected customers under Regulation S-P, and 60 days to the Oklahoma Attorney General for breaches affecting 500 or more residents. Keep the list that applies to you in your incident response plan.

Do examiners expect an annual penetration test?

Most do, and the FTC Safeguards Rule requires one unless you run continuous monitoring. Even where a test is not required by name, examiners expect independent testing and evidence that the findings were fixed.

Does the Oklahoma Insurance Data Security Act apply to a small independent agency?

If you are licensed by the Oklahoma Insurance Department and have $5 million or more in gross annual revenue, yes. Smaller agencies are exempt from most of the Act, but carrier contracts and your cyber or E&O insurer may still require the same controls.

Can Cytek help us respond to an examiner finding?

Yes. We map the finding to the control, put the monitoring or testing in place, and give you the documentation to close it.

Sources: IBM Cost of a Data Breach Report 2025 · Verizon 2025 DBIR · NCUA cyber incident reporting rule · Regulation S-P compliance dates (Baker Donelson) · FTC Safeguards Rule guide · Oklahoma Insurance Data Security Act (OID). This page is general information, not legal advice.

Be ready for the exam and for the incident

Talk to an analyst about monitoring, testing or an examiner finding.

Talk to an analyst →Get your security score