What 345 Days of Untested Exposure Looks Like at a Bank

In April, a single VPN vulnerability led to data breaches at more than seventy financial institutions running Marquis Software's infrastructure, according to American Banker's reporting on the incident. The patch existed. The institutions affected likely had recent penetration tests on file. Neither prevented the exposure from compounding across the portfolio.

The math is straightforward. A standard annual external penetration test runs two to three weeks of active testing. That leaves roughly 345 days of operational reality unvalidated.

Mandiant's M-Trends 2026 report puts the 2025 median dwell time at fourteen days, reversing a multi-year decline, with espionage actors averaging 122-days.

CrowdStrike's 2026 Global Threat Report ranks financial services fourth in interactive intrusion targeting. Adversaries did not wait between annual assessments. The model assumed they would.

Regulators Set the Floor Against a Slower Threat Model

PCI DSS, FFIEC, and NYDFS all reference penetration testing in their requirements and guidance. None of them describe annual cadence as sufficient.

PCI DSS 4.0 Requirement 11.3.1 mandates external penetration testing after any significant infrastructure or application upgrade or modification. The FFIEC IT Examination Handbook describes penetration testing as part of ongoing vulnerability management, not a discrete annual event. NYDFS Section 500.05 mandates annual testing alongside continuous monitoring obligations strengthened in the 2023 amendments to 23 NYCRR 500.

Every one of these frameworks already assumes testing happens in response to change. The regulatory floor was written for institutions where significant changes happened on quarterly release cycles.

That cadence does not match modern banking infrastructure. Digital banking releases, cloud workload migrations, fintech API integrations, third-party portal launches, and M&A integration work all generate untested attack surface between annual tests.

The compliance question is no longer whether the institution tested last year. It is whether the institution tested the things that actually changed.

... continue reading