Iran’s war tested banks’ decision rights more than their defenses

The week

The United States and Israel began strikes on Iran on February 28, 2026, and Iran retaliated with missile and drone attacks on Israel and on U.S. partners in the region. As wars now do, this one opened a second front on the networks.

Markets felt it first. Oil prices rose sharply in the following days and tanker traffic through the Strait of Hormuz, the narrow sea passage through which much of the world’s oil moves, fell steeply. For banks, that meant busy trading desks, volatile prices and nervous clients, all at the same moment.

U.S. banks also went on heightened alert for Iranian cyber retaliation, a pattern familiar from earlier rounds of conflict. In early March, reporting on an intelligence assessment warned of low-level attacks by Iran-aligned hacktivists, meaning activists or state-friendly groups who hack to make a political point. The example given was denial of service: flooding a website or online service with so much junk traffic that real customers cannot get through.

FINRA, the self-regulatory body that oversees U.S. broker-dealers, later described Iranian actors targeting U.S. financial institutions through a list of familiar methods. Password spraying tries a few common passwords against many accounts. Brute force tries many passwords against one account. Weak or default passwords are the ones nobody changed after installation. Spear phishing is a carefully tailored email designed to trick a specific person into clicking or handing over credentials. And known flaws in internet-facing systems, such as VPN appliances, are publicly documented weaknesses in the devices that let staff connect to the bank’s network from outside.

Treasury’s Office of Cybersecurity and Critical Infrastructure Protection issued a flash alert on March 13, an urgent notice to the sector about the threat.

One more detail shaped the weeks that followed. DHS appropriations had lapsed on February 14. The Department of Homeland Security houses CISA, the federal agency that leads civilian cyber defense, so the government’s usual cyber support was running on reduced power just as the warnings arrived.

Every one of the named techniques was old, and that was the puzzle of the week.

Security teams tend to read a geopolitical alert as a warning about something new. The advisories that followed the strikes on Iran pointed the other way. The techniques they named were among the oldest on any list, and most banks had controls for all of them. That did not make the period easy. It moved the difficulty from technique to judgment.

A bank or broker-dealer under a heightened threat faces three decisions, and they belong to different people. What to close first, which is the CISO’s call (the chief information security officer, the executive responsible for protecting systems and data). Who may break a change freeze to close it, which belongs to the executives who own operational risk. And what to demand of the providers it depends on, which belongs to vendor management and, for smaller institutions, to the board. The three cover the institution’s own estate, its own processes and its third parties, and they do not overlap.

The front door and the side door

Most of the techniques on the advisories come down to two weak points: the front door and the side door.

The front door is the login. Password spraying and brute force are both guessing games. In spraying, an attacker takes a handful of common passwords, the sort people use when forced to change theirs every quarter, and tries each against thousands of accounts, staying under the lockout limit on any one of them. In brute force, the attacker hammers a single account with many guesses. Weak or default passwords make both easy. A surprising number of systems still ship with a factory password that someone meant to change. Spear phishing skips the guessing and simply asks: a convincing email, perhaps appearing to come from a colleague or regulator, persuades someone to enter their password on a fake page.

The defense against all of these is well known. Multi-factor authentication, or MFA, requires a second proof of identity, such as a code on a phone or a physical key, in addition to the password. A stolen or guessed password alone is then not enough.

The side door is the equipment that sits on the edge of the network. A VPN appliance is a box, physical or virtual, that lets employees and vendors connect securely from outside the office. Because it must be reachable from the internet to do its job, any flaw in its software is reachable too. When the maker publishes a fix, attackers read the same notice and race to use the flaw on anyone who has not yet patched.

Denial of service is different again. It does not break in; it overwhelms. A flood of traffic knocks a website or online banking portal offline for a while. It is disruptive and embarrassing, and customers notice, but it rarely touches money or data directly. Large banks typically buy protection from specialized providers that absorb such floods.

Why do such old techniques keep working? Because large organizations accumulate exceptions. A bank may have MFA on ninety-nine of its hundred logins, and the hundredth is the one an attacker finds: a test system someone forgot, a vendor account created for a project that ended, a reporting tool bought by one department and never connected to the central login. Likewise, a VPN appliance may be patched promptly nine times out of ten; the tenth fix waits for a maintenance window that keeps slipping. Attackers do not need to be clever. They need to be patient and to try everything, and automated tools let them try everything at very little cost.

The advisories matter even when they say nothing new. They tell defenders which exceptions are about to be tested, and roughly when. A good security team reads them as a checklist for its own exception list, not as news. A warning about these techniques says the gaps in well-understood defenses are about to be found; it does not say the defenses are obsolete.

What to close first

Every bank carries a backlog of known gaps. A heightened threat period does not create new ones. It reorders the queue. The named techniques pointed to two places.

The first is accounts that accept a password alone: service accounts (logins used by software rather than people, which often run unattended for years), legacy administrative interfaces, vendor support logins, test tenants and cloud applications outside single sign-on. Single sign-on is the system that lets staff log in once, through one well-protected gate, to reach many applications. Anything outside it tends to have weaker, separately managed passwords and no MFA.

The second is internet-facing appliances with known vulnerabilities, especially VPN and remote access devices, which are often patched more slowly than servers because they need maintenance windows and sit with network teams.

The decision is how to rank those items against everything else. A sound rule is exposure first and value second. An internet-reachable account without multi-factor authentication outranks an internal server missing a patch, however critical the server. The reasoning is simple: an attacker on the other side of the world can reach the first today, but must already be inside to reach the second.

Institutions subject to New York’s Part 500 had a head start. Part 500 is the New York Department of Financial Services cybersecurity regulation, and universal multi-factor authentication had been required under it since November 2025. Their exception lists were recent. Others had to build the list under pressure, which is slower and less reliable.

The CISO also has to decide what not to do. A threat period invites new tooling, new feeds and new dashboards. Each consumes the same people who would otherwise be closing gaps. Two weeks spent closing twenty known exposures is usually worth more than two weeks spent deploying something to watch for them.

Progress should be visible daily. A short list, owned by the CISO and shared with the chief risk officer, showing each exposure, its owner, its target date and its status, is enough. It gives executives a concrete basis for the second decision, because they can see exactly which fixes are waiting on a change window.

Who may break a change freeze

A change freeze is a period when an institution deliberately stops making changes to its systems, because any change, even a good one, carries some risk of breaking something. Banks commonly freeze around quarter-end, major launches and stressed markets. A change window is the scheduled slot, often overnight or at weekends, when changes are allowed.

The conflict arrived with a sharp move in energy markets and broad volatility. Trading desks, treasury operations and payment teams were busy, and operations leaders reasonably wanted stability. Change freezes protect it. Security teams wanted to push emergency patches to edge devices and identity systems. Both positions were defensible, and in many institutions nobody had the clear authority to choose between them.

The fix is a standing decision right, agreed before any crisis. It names who can approve an emergency security change during a freeze, usually the chief risk officer or chief operating officer together with the CISO. It states the evidence they need: active exploitation in the wild, exposure of the affected system, and a tested rollback (a rehearsed way to undo the change if it causes trouble). And it sets a time limit for the decision, measured in hours. Without that, the request travels up through committees while the exposure stays open. With it, a decision that might take three days takes an afternoon.

The same right should cover the reverse case. Sometimes the correct call is to defer a patch, apply a compensating control such as blocking an address range, and wait for the market to settle. A compensating control is a temporary substitute safeguard that reduces the risk until the real fix can be made. Writing that option down, with a review date, keeps deferral from becoming drift.

One Tuesday, two ways

Take a regional bank during the first weeks of the conflict. Its treasury desk is managing large swings in funding costs. Its payments team is processing heavy volumes. Operations has declared a change freeze until markets calm down.

On Tuesday morning the CISO’s daily exposure list shows three items in red: a VPN appliance with a published flaw that attackers are known to be exploiting, a vendor support login that accepts a password alone, and an old administrative portal for the mortgage system that sits outside single sign-on.

In a bank without a standing decision right, the CISO emails the head of IT operations, who declines to break the freeze without approval from the chief operating officer, who is in back-to-back market calls and asks for a paper for Thursday’s risk committee. The VPN stays exposed for three more days.

In a bank with one, the CISO calls the chief risk officer at ten. They review the evidence together: the flaw is being exploited in the wild, the device is reachable from the internet, and the network team has tested a rollback on a spare unit. By two o’clock the patch is approved for a short window that evening. The vendor login is disabled outright until the vendor can use MFA. The mortgage portal is harder to change during the freeze, so they block access to it from outside the bank’s own network as a compensating control and set a review date for two weeks later. Each decision is recorded in a few lines. Nobody had to be a hero.

What to demand of providers

Community banks and credit unions rely on core processors, managed security providers and technology service providers for much of their defense. A core processor runs the core banking system, the central ledger that holds every account, balance and transaction; for many smaller institutions it is operated entirely by an outside company. A managed security provider watches the network and responds to alerts on the bank’s behalf. In a threat period, their exposure is largely their providers’ exposure.

Federal support was also thinner than usual. With DHS funding lapsed, CISA kept its operations center and urgent alerts running but paused much proactive work, so sector channels such as Treasury’s alerts and the industry information-sharing organizations carried more of the load. These are member groups through which banks swap warnings and indicators about attacks they are seeing.

The decision for providers is what to ask for, and how fast. A useful request is narrow and written: confirmation that the provider has reviewed its internet-facing devices and administrative accounts against the named techniques, the date of that review, and a contact for incident escalation. Broad questionnaires sent during a crisis tend to come back late and say little. Contracts that already require prompt incident notice help. Contracts that also allow the institution to request a specific attestation, a formal written statement that a check has been done, during a declared threat period help more, and they are worth adding at the next renewal.

Boards should expect management to report on both its own posture and its providers’, because examiners will look at both. For a community bank, the provider attestation is often the most important document it can produce after a threat period. It shows the board asked the right question of the party that actually runs the systems.

Business decisions dressed as security ones

It is easy to see a cyber alert as a technical matter, but the three decisions above carry business consequences.

Money and markets. A successful break-in or a prolonged outage during volatile markets compounds losses: delayed payments, trading disruptions and the cost of recovery all arrive at the worst possible moment. Equally, a badly timed change that breaks a payment system in a busy week has its own cost. Clear decision rights are how a bank weighs those against each other quickly.

Customers and reputation. Even a denial-of-service attack that touches no money can leave customers unable to log in, and the story will be told as “bank hacked.”

Regulators. Examiners look at whether management identified the threat, prioritized sensibly, governed exceptions and oversaw third parties. A dated exposure list, recorded freeze decisions and provider attestations are exactly the evidence they ask for.

Staff. Security and operations teams who know in advance who decides do not spend crisis weeks arguing with each other. That matters more than it sounds.

Time. Every hour an exposed system waits for a decision is an hour an automated scanner somewhere can find it. Speed of decision, not sophistication of tooling, is often what separates a near miss from an incident.

Unglamorous preparation

The preparation that works is unglamorous: a short, ranked list of known exposures with owners and dates; a written decision right for emergency changes, with evidence criteria and a deadline; a documented path for deferral; and narrow, written requests to providers, backed by contract language.

The mistakes are familiar too:

• Chasing novelty. Buying new tools during the crisis instead of closing the gaps the advisories actually describe.
• Ranking by importance instead of exposure. Patching a critical internal server while an internet-facing login with no MFA stays open.
• Escalation by committee. Sending an urgent change request through the normal governance calendar.
• Silent deferral. Postponing a fix with no compensating control and no review date, so it is forgotten.
• The fifty-page questionnaire. Sending providers a sprawling survey mid-crisis and getting nothing useful back in time.

What to have settled before the next alert

1. Which of our internet-facing logins still accept a password alone, and which edge devices have published flaws we have not yet patched?
2. If we needed an emergency patch during a change freeze tonight, who would approve it, and how long would it take?
3. When we defer a fix, what compensating control do we use, and who checks the review date?
4. Have our core processor and key providers confirmed in writing that they checked against the named techniques, and do our contracts let us ask?
5. If federal support is reduced, which sector channels are we relying on for alerts, and who reads them?

With hindsight

FINRA said that as of March 16 it was not aware of any significant Iran-related cyberattacks against the financial services industry, even as it described active targeting. The attackers were knocking on doors, but no major door had given way.

The most visible destructive attack attributed to an Iran-linked persona in that period hit a medical technology manufacturer, Stryker, not a bank. (A “persona” is the public name a hacking group operates under, which may or may not reflect who is really behind it.) That fits what earlier episodes suggested: well-defended financial institutions see more probing than damage. Attackers looking for disruption tend to find it where defenses are thinner.

The cost showed up in time and attention. Brent crude averaged above $100 a barrel in April and May, according to the Energy Information Administration, fell back sharply in June after a U.S.-Iran memorandum, and was climbing again by early September as hostilities around the Strait of Hormuz resumed. Volatile markets and an elevated threat level ran together for months, not days.

The duration mattered most. A crisis plan built for a fortnight of heroics does not survive half a year. Teams tire, exceptions pile up, and every change freeze becomes a negotiation. Institutions that had settled who could break a change freeze, and that held recent provider attestations, carried that load more easily than those still escalating each request.

Resilience in a geopolitical crisis turned out to depend less on exotic defenses than on governance done in advance. The techniques were old. The controls were known. What separated institutions was whether the decisions about using them had been made before the pressure arrived, and written down so they could be repeated, calmly, week after week.

For boards, that suggests a simple test: ask management to show the decision right for emergency changes and the latest provider attestations. If either takes more than a day to produce, the work is not finished.