Unpatched Software Is Now the Top Way Into Banks

Why It Matters

Banks must prioritize patch management and supply‑chain security to curb the fastest‑growing breach vectors, while addressing AI‑related insider risks to protect customer data and regulatory compliance.

Key Takeaways

• Unpatched software caused 22% of financial services breaches in 2025
• Third‑party involvement in breaches rose 60% to 48% across industries
• AI tools used by 45% of employees raise accidental data leakage risk
• Voice and text phishing increased click rates 40% over email
• Ransomware “System Intrusion” stays top breach pattern in finance

Pulse Analysis

The latest Data Breach Investigations Report marks a watershed moment for the banking sector. After two decades of password‑centric attacks, unpatched software now leads the pack, exposing legacy systems and delayed updates as critical vulnerabilities. This shift reflects the democratization of exploit tools, many powered by artificial intelligence, which enable low‑skill actors to weaponize known flaws at scale. For financial institutions, the cost of a single unpatched breach can run into millions of dollars in remediation, fines, and reputational damage, underscoring the urgency of robust vulnerability‑management programs.

Equally concerning is the surge in third‑party involvement. The DBIR notes a 60% jump in vendor‑related breaches, with one‑third of financial incidents tied to external partners. The ransomware attack on Marquis Software Solutions, which compromised data for 824,000 consumers across 80 banks, illustrates how a single supply‑chain weakness can cascade across the industry. Banks must therefore enforce stringent vendor risk assessments, continuous monitoring, and contractual security clauses to limit exposure from the expanding IT ecosystem.

Human factors remain a potent attack surface. Phishing has evolved beyond email, with voice and text vectors now yielding 40% higher engagement rates. Meanwhile, 45% of employees regularly use AI tools—often through personal accounts—creating “shadow AI” scenarios that increase accidental data leakage. Organizations should combine advanced threat‑intelligence platforms with comprehensive security awareness training that addresses both traditional phishing and emerging AI‑related risks, ensuring a layered defense that aligns with regulatory expectations.