54% of banks employ a chief risk officer.

35% of bank leaders cite internal communications as a common gap found in tabletop cybersecurity exercises.

79% of bank CEOs, board members, chief risk officers and senior executives are concerned about fraud.

53% of bank leaders believe their bank could take more strategic risk.

84% of bank leaders are concerned about fraud and scams targeting their customers.

28% of bank leaders cite regulatory risk as a top concern, down from 55% a year earlier.

Technology, financial services, and gaming accounted for 34%, 20%, and 19% of DDoS attacks, respectively.

36% of bank leaders cite overreliance on one individual or function as a common gap found in tabletop cybersecurity exercises.

20% of bank leaders believe their bank or its customers were impacted by fraud involving AI or deepfake media in the prior 18 months.

38% of bank leaders believe their primary regulator was understaffed or otherwise underresourced.

47% of directors say the board invited outside experts to speak about cybersecurity trends over the past 12 months.

79% of board chairs and independent directors say the board reviews and approves the bank’s cybersecurity strategy.

One-third of bank leaders say they do not understand agentic AI at all.

89% of bank CEOs and technology executives say their bank conducted a tabletop exercise of its cybersecurity incident response plan in the prior 12 months.

The financial sector accounted for 14.6% of incidents.

37% of bank leaders report heightened attention to cybersecurity during regulatory exams, up from 30% in 2025.

Nearly 87% of financial institutions use TPRM software.

73% of large organizations with 5,001 or more employees fall into the lowest TPRM confidence tiers.

72% of financial institutions are only partially aware of which vendors use AI, and 0% feel extremely confident managing vendor AI.

Financial institutions using manual TPRM processes are 71% more likely to receive exam findings.