Banks & Financial Institutions
We are a cybersecurity company, and for banks that means testing every network, endpoint, web application and API to find out whether it is safe from attackers. Banks are measured against the highest security expectations of any industry. We test like attackers, report like auditors and help your team close the gaps.
Community banks, credit unions and other financial institutions operate under some of the most detailed supervisory expectations in any industry, from the Interagency Guidelines on information security to examiner reviews of third-party risk. Customers also expect their bank to be the safest place for their money and data.
Our approach combines penetration testing that reflects real attacker methods, clear reporting that a board can read, and practical help closing what we find. We work with your IT staff and examiners' expectations, not around them.
For payment and wire requests, our insight article "Deepfake-Proof Payments: Callback Verification That Holds Up" describes the callback approach we can help you set up, confirming sensitive requests through a separate, known channel before money moves.
What we see in your industry
- Third-party and fintech integrations widen the attack surface every quarter.
- Board and examiner reporting requires a clear, current view of the security program.
- Incident response must be rehearsed, documented and fast.
- Federal rules set fixed clocks: 36 hours to notify the primary regulator for banks, and 72 hours for credit unions reporting to NCUA.
Incident notification has fixed clocks. Under the federal banking agencies' computer-security incident rule, a banking organization must notify its primary federal regulator within 36 hours of determining that a notification incident has occurred, and federally insured credit unions must report a reportable cyber incident to NCUA as soon as possible and no later than 72 hours after reasonably believing one occurred. A response plan that has never been rehearsed rarely meets those deadlines.
Third-party risk deserves the same attention. The OCC, Federal Reserve and FDIC's June 2023 interagency guidance on third-party relationships expects risk-based due diligence and ongoing monitoring of vendors and fintech partners. On September 15, 2026, the agencies, with the NCUA joining for the first time, proposed new guidance to replace it. The proposal is not final, and the 2023 guidance remains the reference until a final version is issued. We can help you inventory those relationships, assess the ones that matter and document the oversight in a form that will survive either text.
Our experience in this setting is practical. For nearly ten years our team ran the infrastructure and information security of the New York trading office and San Francisco venture office of one of South Korea's largest conglomerates, where we found vulnerabilities in headquarters' email servers and escalated them before they became incidents. Penetration testing, rehearsed response plans and a clean evidence file are how a bank's security program becomes something a board and an examiner can both trust.
A typical engagement starts with a scoped test of the internet-facing systems and the staff-facing ones, a report ranked by risk with a fix beside every finding, and a retest once the fixes are made. Clayton Secure then keeps the program visible between exams, with a current view of vulnerabilities, assets and open actions that a risk committee can read.
For the rehearsal itself, "Ransomware Readiness and Incident Response" turns the CISA #StopRansomware guide into a checklist, and "Bank and Credit Union Cyber Incident Reporting" walks through the 36‑hour and 72‑hour clocks and what to prepare before one starts. "Business Email Compromise and Wire Fraud" covers the payment-redirection schemes that reach finance staff first.
"Vendor and Third-Party Risk for Mid-Size Firms" explains the 2023 guidance, the 2026 proposal and the NIST material behind both. "Zero Trust for Mid-Size Firms" lays out a staged path using NIST SP 800-207 and the CISA maturity model, and "Cyber Insurance Readiness" covers the controls underwriters check.
Every industry's reference library and routine can run offline. Our Apocalypse IT Package is an on-premises continuity kit with a local reference library, document scanning, a private AI desk, chat and battery backup, offered to every customer.
Related work on our track record: an on-premises language model for a regional bank (illustrative), ALM and CECL models brought in-house at a $7B bank (illustrative), the petabyte storage and redundant colocation behind a balance-sheet risk analytics firm that serves banks, a financial institution moved from Windows to Omarchy and open-source office suites, and a card-data platform on Kubernetes with hardware-backed keys.
Many of these firms must be able to show what a message said and when it was sent. Our team builds immutable message archives with provable integrity: a copy of every inbound and outbound email is stored in write-once storage, such as Amazon S3 Object Lock in compliance mode on Amazon Web Services (AWS) with encryption keys in AWS Key Management Service (AWS KMS), or the equivalents on Google Cloud (Bucket Lock and Cloud KMS), Microsoft Azure (immutable storage for Blob Storage and Azure Key Vault) and Oracle Cloud Infrastructure (OCI) (Object Storage retention rules and OCI Vault). A SHA-256 fingerprint of each message, protected with a key in the cloud key service, lets a third party check later that it is unchanged. For a bank or credit union, it supports records of customer communications and of the notices the institution sent. Counsel and the compliance officer decide what must be retained; this is technical evidence, not legal advice.
Ransomware Readiness and Incident Response: A Checklist Based on the CISA #StopRansomware Guide
The joint CISA, FBI, NSA and MS-ISAC #StopRansomware Guide splits the work in two: what to do before an attack and what to do during one. Here is how a small or mid-size firm can turn it into a plan it can actually run.
Work like yours
A 150 TB Microsoft SQL Server database, live in two data centers on a petabyte of storage
A balance-sheet risk analytics firm that serves banks and financial institutions, with models for interest-rate risk, net interest income and valuation. A leader in its segment.
1 PB storage, 150+ TB database, 1 TB+ RAM and 128 cores per production server, New York + New Jersey, SOC 2Read the case
Ten years running the U.S. offices of one of South Korea's largest companies
One of South Korea's largest conglomerates and a leader in its segments, with a trading office in New York and a venture-capital office in San Francisco.
2 U.S. sites, bi-coastalRead the case
A major financial institution moved off Windows to Omarchy and open-source office tools
A major financial institution, a leader in its segment.
Operating system and office suites replaced, no loss of productivityRead the case
A cross-border payments platform on Kubernetes, with card data sealed by hardware security modules
A cross-border payments company moving money between the United States, Europe and Latin America, a leader in its segment.
3 Kubernetes clusters in 2 regions, about 140 services, 2,400 transactions per second at peak, network-attached HSM clusterRead the case
A frontier-class language model in the bank's own rack: AI for 100 staff without a prompt leaving the building
A regional bank and wealth manager in the Midwest, a leader in its segment.
~100 staff, 1 flagship open-weight model (671B parameters), 2 active-active GPU nodes + 1 utility node, air-gapped inference tierRead the case
Seeing inside the black box: ALM, deposit and CECL models brought in-house at a mid-size US bank
A nationally chartered bank in the Midwest with roughly $7 billion in assets and a treasury team of five.
~$7B in assets, ~1,150 staff, 2 parallel-run quarter-ends, 40+ rate scenarios, 14 years of deposit historyRead the caseHow we help
Cybersecurity
We find out whether everything you run is safe from attackers, then we fix it.
Learn moreClayton Secure
One view of your entire cybersecurity program, in near real time.
Learn moreCloud Management
Cloud cost review and management, without compromising on quality or security.
Learn moreMicrosoft Exchange, Active Directory & SQL
Exchange, Active Directory and SQL Server built redundant, backed up and recoverable, and engineers on call when they fail.
Learn moreSecurity Awareness Training
Train your people to stop the phish, the fake voice and the wire request before money moves.
Learn moreFrequently asked questions
Direct answers to the questions we hear most. Something else on your mind?
Send us a messageDo you perform penetration tests for community banks and credit unions?
Yes. We test networks, applications and staff exposure in scope, report in a format suitable for management and the board, and help close findings.
How do you help with third-party and fintech risk?
We help inventory vendors, review their security and track findings, so your board sees current vendor risk instead of a once-a-year spreadsheet. Reviews cover how a vendor protects your data, who its subcontractors are and how quickly it would tell you about an incident. We document the results in a form examiners can follow.
Can you help us prepare for examiner review?
We assemble evidence of your security program and test results so you can answer examiners with documents. We do not replace your compliance staff or counsel.
What does board-level cybersecurity reporting look like?
A short plain-English view of risk, progress and decisions needed. Clayton Secure provides this as a dashboard with recurring expert review.
Do you test incident response?
Yes. We run tabletop exercises with your leadership and technical staff and update the plan from what we learn.
Which laws apply to financial institutions?
Commonly the Gramm-Leach-Bliley Act and its Safeguards and Privacy rules, plus state breach laws and regulator guidance. Your counsel confirms what applies to you.
What is the 72-hour rule for credit unions?
A federally insured credit union must notify the NCUA as soon as possible and no later than 72 hours after it reasonably believes it has experienced a reportable cyber incident (12 CFR 748.1(c), effective September 1, 2023). The trigger is reasonable belief, earlier than a bank's determination. If a third-party provider is compromised, the clock can run from when the provider notifies you. The notice is an early alert, not a full report. Your compliance staff and counsel decide what is reportable.
Is the interagency third-party risk guidance changing?
Yes, it may. The 2023 interagency guidance on third-party relationships (OCC Bulletin 2023-17) is still the reference. On September 15, 2026, the OCC, Federal Reserve, FDIC and NCUA proposed new guidance to rescind and replace it, with comments due November 16, 2026. It is a proposal and its wording may change. Either way, an inventory, tiers by criticality, contract terms and ongoing monitoring remain sound practice.