Most Targeted, Most Overdrawn: The Financial Sector’s Security Debt

Attackers are hitting financial services harder than any other industry — and walking through doors that should have been locked a decade ago.

If you work in financial services security, here’s a number that deserves a moment of your time: 132,378.

That’s the average number of cyberattack hits per firewall recorded across financial institutions in the first five months of 2026. The cross-industry average is around 59,000. So while every other sector is dealing with a threat landscape that’s intense, financial services is dealing with one that’s a different category of problem entirely — more than double the pressure, per device, than the average org absorbs.

And here’s the part that should give any financial services security team pause: overall attack volume is actually down year over year. Fewer attacks, but concentrated with far more precision on the institutions that represent the highest return. Attackers aren’t leaving the sector. They’re having a higher success rate with their attacks, meaning they need fewer attacks to get a payday. 

The Door They’re Walking Through Was Unlocked in 2014

So how are they getting in? The answer is embarrassingly simple.

Heartbleed — CVE-2014-0160 — is still generating active probes across financial services networks in 2026. Not because it’s a new discovery. Because it was patched twelve years ago and a meaningful slice of the industry never fully closed it. Log4Shell, disclosed in late 2021, is still producing tens of millions of intrusion attempts against Java-based financial middleware that was apparently too operationally complex to remediate. The GoodTech Telnet Server Buffer Overflow generated over 42 million hits concentrated almost entirely in financial sector devices, almost certainly legacy core banking infrastructure, transmitting credentials in plain text, exposed to the internet, today.

These aren’t zero-days. They’re not sophisticated novel exploits. They’re known quantities with published patches, and they’re still working.

The reason isn’t negligence, it’s architecture. Core banking systems, payment processors, fraud detection engines—these aren’t applications you take offline on a Tuesday afternoon. They were built for resilience, not agility, and the operational cost of patching them is real. So organizations run a calculation, decide to wait, and log the exposure for a future quarter that never quite arrives.

Attackers have learned that calculation. They’re not guessing which systems haven’t been touched. They know.

They’re Not Spraying. They’re Aiming.

The ransomware picture reinforces exactly this. Ten active families were detected targeting financial services in the first five months of 2026 alone, not opportunistically, but with documented sector-specific strategies and the discipline to move laterally through complex enterprise environments. They’re choosing financial services because it consistently offers the highest return: valuable data, enormous pressure to restore operations fast and regulatory consequences that create additional leverage at the negotiating table.

The drop in overall attack volume masks something more concerning than a spike would. Selectivity. These groups have studied the sector and they’re betting, with reasonable confidence, on infrastructure that hasn’t been patched since the Obama administration.

Compliance Doesn’t Close the Tab

The financial services industry spends more on cybersecurity than almost any other sector on earth. It passes more audits, employs more compliance officers and produces more security documentation than most industries generate in total. None of that is in question.

What the data does put in question is the gap between that investment and the actual attack surface it’s leaving exposed. Compliance asks whether a control exists. It rarely asks whether the underlying system that control is protecting should still be running at all. That gap between perceived security posture and actual exposure is where 132,378 hits per firewall is finding its footing.

The full picture is in SonicWall’s 2026 Financial Services Threat Brief: specific attack data, vulnerability breakdowns and a clear-eyed look at what the threat landscape actually looks like for this sector right now.