Cybersecurity for Financial Services Firms
Financial services firms need a security program that satisfies regulators, stops wire fraud and holds up when a vendor is breached. Defensible gives advisers, lenders, insurers and fintechs the security leadership, managed protection and incident response to meet NYDFS Part 500, SEC Regulation S-P and the GLBA Safeguards Rule.
Founded by former Stroz Friedberg leaders. New York office at 48 Wall Street.
Why Are Financial Firms Targeted?
Financial firms move money and hold the data attackers want. The most common losses don't start with malware. They start with a convincing email that changes wire instructions, or a stolen password used to log in like a real employee.
At the same time, regulators expect written programs, tested plans and fast notification. The work has to satisfy both the attacker and the examiner.
Wire fraud
Spoofed or compromised email changes payment instructions at the last moment.
Account takeover
Stolen credentials used against email, CRM and custodial portals.
Vendor exposure
Custodians, CRMs and cloud apps that hold client data outside your walls.
Examiner requests
Policies, risk assessments and test results requested on short notice.
Notification deadlines
Tight clocks to notify regulators and affected customers.
Lean IT teams
Small firms carrying large-firm security expectations.
How Do You Stop Wire Fraud and Business Email Compromise?
Business email compromise is stopped by layers: strong identity, filtered email, a payment process that doesn't trust email alone, and a team that can investigate fast when something slips through.
MFA everywhere, conditional access and alerts on suspicious sign-ins and mailbox rules.
Phishing and impersonation filtering, plus user reporting that feeds detection.
Call-back verification on new or changed wire instructions, using a known number.
BEC forensics to trace access, scope exposure and support recovery efforts.
What Does Defensible Do for Financial Firms?
Leadership, protection and response from one team, scoped to your size and regulators.
Security Leadership and Compliance
A vCISO who owns the program and speaks to examiners and your board.
- vCISO — Policies, risk assessment and board reporting
- NYDFS Part 500 — CISO function and certification evidence
- Assessments — Risk assessments and penetration testing
Managed Protection and Response
24/7 monitoring, plus an incident response team that investigates BEC and ransomware.
- Managed security — 24/7 monitoring, endpoint and email security
- Awareness training — Phishing simulation focused on payment fraud
- Incident response — A senior responder engages within one hour
How Do NYDFS Part 500, SEC Reg S-P and the GLBA Safeguards Rule Compare?
Many firms fall under more than one. A plain-English summary, not legal advice; confirm your obligations with counsel.
| Rule | Who it applies to | Key expectations |
|---|---|---|
| NYDFS Part 500 | Entities licensed under New York's Banking, Insurance or Financial Services Laws | CISO, risk assessment, MFA, asset inventory, 72-hour notice to DFS, annual certification by April 15 |
| SEC Regulation S-P (amended 2024) | SEC-registered broker-dealers, investment advisers, investment companies and transfer agents | Written incident response program, service provider oversight, and notice to affected individuals within 30 days of becoming aware of unauthorized access to sensitive customer information |
| GLBA Safeguards Rule (FTC) | Non-bank financial institutions such as mortgage brokers, lenders and tax preparers | Qualified individual, written risk assessment, MFA, encryption, testing, board reporting, and FTC notice for qualifying breaches |
Financial and Professional Services Firms We Support
Firms where client trust and regulatory scrutiny go together.
RIAs and fund managers with SEC obligations.
Licensed producers covered by NYDFS Part 500.
Firms covered by GLBA or NYDFS.
Law and accounting firms that handle client funds and confidential data.
How Do We Start?
A senior-led path from first call to a program you can show an examiner.
- STEP 1Consultation
Your regulators, systems, vendors and current controls.
- STEP 2Assessment
Risk assessment and gap analysis against your rules.
- STEP 3Roadmap
Prioritized fixes with owners and dates.
- STEP 4Protect
Managed security, MFA, email security and payment controls.
- STEP 5Prove
Evidence, testing and reporting for examiners and your board.
How Should Financial Firms Manage Vendor Risk?
Start with a list of every vendor that stores client data or can reach your systems, ranked by what they could expose. Custodians, CRMs, portfolio tools, email providers and your IT provider are usually at the top.
For each critical vendor, collect security evidence such as a SOC 2 report, set minimum controls like MFA and encryption in the contract, and agree how fast they must tell you about an incident. Review the list at least annually. Our guide to vendor risk management covers the process in more detail.
"Defensible Technology is an amazing company to work with. We have utilized their services and are very pleased with the results. They have been incredibly effective in helping us to discover, understand and remediate security vulnerabilities in our environment. Thanks to their insight and expertise, we have been able to implement better safeguards and improve our firm's security posture."
— Shawn Campbell, Chief Information Officer at Lankler Siffert & Wohl LLP
Frequently Asked Questions
Which cybersecurity rules apply to my firm?+
It depends on your licenses and registrations. New York-licensed banks, insurers and lenders fall under NYDFS Part 500. SEC-registered advisers and broker-dealers fall under Regulation S-P. Many non-bank financial institutions fall under the FTC's GLBA Safeguards Rule. Confirm with counsel.
What changed in SEC Regulation S-P?+
The 2024 amendments require covered institutions to maintain a written incident response program, oversee service providers, and notify affected individuals within 30 days of becoming aware of unauthorized access to sensitive customer information. Larger entities had to comply from December 2025, smaller ones from June 2026.
What should we do if a wire was sent to a fraudster?+
Call your bank immediately to request a recall, report the fraud to the FBI's IC3, and preserve the emails and logs. Call our 24/7 hotline, (646) 349-4252; a senior responder engages within one hour to investigate how the attacker got in.
How do you manage vendor risk?+
We inventory the vendors that hold client data or access your systems, review their security evidence, set minimum requirements and contract terms, and track issues to closure. All three rules expect some form of service provider oversight.
Can a vCISO act as our CISO or qualified individual?+
Yes. NYDFS Part 500 allows a third-party CISO, and the GLBA Safeguards Rule allows a qualified individual employed by a service provider. Your firm keeps responsibility and oversight in both cases.
Security That Satisfies Examiners and Stops Wire Fraud
Talk to a senior consultant about your regulators, your vendors and your payment process. We'll show you where the gaps are and how to close them.