53% of IAM leaders and stakeholders cite cost and budget constraints as an obstacle to universal phishing-resistant MFA.

Interactions with Network APIs, including SIM Swap and Number Verification, grew by 91%, with the finance sector leading adoption.

Among organizations that cite regulatory compliance as a top driver to modernize, 79% report that at least half their applications and infrastructure are legacy.

82% of IAM leaders and stakeholders at financial services firms are confident their current controls can mitigate account takeover risk.

Malware activity averaged 39,341 hits per firewall in the first half of 2026, giving financial services the second-highest per-device malware intensity of any industry, behind only healthcare.

Financial services experienced more than double the cross-sector average of cyberattack attempts per device in the first half of 2026.

51% of IAM leaders and stakeholders cite the inability to support legacy apps and infrastructure as an obstacle to universal phishing-resistant MFA.

The GoodTech Telnet Server Buffer Overflow vulnerability generated 42.2 million detection events in the financial services industry in the first half of 2026.

Ten ransomware families were active against the financial services sector in the first half of 2026, including REvil (Sodinokibi) and Prometheus.

Log4Shell generated 35.6 million detection events in the first half of 2026 in the financial services industry, more than two years after disclosure.

Financial services saw 132,378 IPS hits per device in the first half of 2026, the highest attack intensity of any industry SonicWall tracks.

94% of IAM leaders and stakeholders at financial services firms report that phishing attacks increased over the past year.

Only 28% of the MFA used for workforce authentication in financial services is phishing-resistant.

SaaS applications in financial organizations are protected by MFA at a rate of 74%.

Legacy systems in financial organizations are protected by MFA at a rate of 50%.

54% of financial organizations report that at least half their applications and infrastructure are legacy.

79% of IAM leaders and stakeholders cite technical or architectural complexity as an obstacle to universal phishing-resistant MFA.

Only 15% of workforce authentication flows in financial services are passwordless.

Internal information disclosure accounts for 42.7% of critical exposures in Financial Services.

From 2024 to 2025, the number of critical vulnerabilities carried across vendors serving the financial sector increased 387%.