Iran’s war tested banks’ decision rights more than their defenses

The week

The United States and Israel began strikes on Iran on February 28, 2026, and Iran retaliated with missile and drone attacks on Israel and on U.S. partners in the region. Oil prices rose sharply in the following days and tanker traffic through the Strait of Hormuz fell steeply. U.S. banks went on heightened alert for Iranian cyber retaliation, a pattern familiar from earlier rounds of conflict. In early March, reporting on an intelligence assessment warned of low-level attacks by Iran-aligned hacktivists, such as denial of service. FINRA later described Iranian actors targeting U.S. financial institutions through password spraying, brute force, weak or default passwords, spear phishing and known flaws in internet-facing systems such as VPN appliances. Treasury’s Office of Cybersecurity and Critical Infrastructure Protection issued a flash alert on March 13. DHS appropriations had lapsed on February 14.

Security teams tend to read a geopolitical alert as a warning about something new. The advisories that followed the strikes on Iran pointed the other way. The techniques they named were among the oldest on any list, and most banks had controls for all of them. That did not make the period easy. It moved the difficulty from technique to judgment.

A bank or broker-dealer under a heightened threat faces three decisions, and they belong to different people. What to close first, which is the CISO’s call. Who may break a change freeze to close it, which belongs to the executives who own operational risk. And what to demand of the providers it depends on, which belongs to vendor management and, for smaller institutions, to the board. The three cover the institution’s own estate, its own processes and its third parties, and they do not overlap.

What to close first

Every bank carries a backlog of known gaps. A heightened threat period does not create new ones. It reorders the queue. The named techniques pointed to two places. The first is accounts that accept a password alone: service accounts, legacy administrative interfaces, vendor support logins, test tenants and cloud applications outside single sign-on. The second is internet-facing appliances with known vulnerabilities, especially VPN and remote access devices, which are often patched more slowly than servers because they need maintenance windows and sit with network teams.

The decision is how to rank those items against everything else. A sound rule is exposure first and value second. An internet-reachable account without multi-factor authentication outranks an internal server missing a patch, however critical the server. Institutions subject to New York’s Part 500 had a head start, because universal multi-factor authentication had been required since November 2025. Their exception lists were recent. Others had to build the list under pressure, which is slower and less reliable.

The CISO also has to decide what not to do. A threat period invites new tooling, new feeds and new dashboards. Each consumes the same people who would otherwise be closing gaps. Two weeks spent closing twenty known exposures is usually worth more than two weeks spent deploying something to watch for them.

Progress should be visible daily. A short list, owned by the CISO and shared with the chief risk officer, showing each exposure, its owner, its target date and its status, is enough. It gives executives a concrete basis for the second decision, because they can see exactly which fixes are waiting on a change window.

Who may break a change freeze

The conflict arrived with a sharp move in energy markets and broad volatility. Trading desks, treasury operations and payment teams were busy, and operations leaders reasonably wanted stability. Change freezes protect it. Security teams wanted to push emergency patches to edge devices and identity systems. Both positions were defensible, and in many institutions nobody had the clear authority to choose between them.

The fix is a standing decision right, agreed before any crisis. It names who can approve an emergency security change during a freeze, usually the chief risk officer or chief operating officer together with the CISO. It states the evidence they need: active exploitation in the wild, exposure of the affected system, and a tested rollback. And it sets a time limit for the decision, measured in hours. Without that, the request travels up through committees while the exposure stays open. With it, a decision that might take three days takes an afternoon.

The same right should cover the reverse case. Sometimes the correct call is to defer a patch, apply a compensating control such as blocking an address range, and wait for the market to settle. Writing that option down, with a review date, keeps deferral from becoming drift.

What to demand of providers

Community banks and credit unions rely on core processors, managed security providers and technology service providers for much of their defense. In a threat period, their exposure is largely their providers’ exposure. Federal support was also thinner than usual. With DHS funding lapsed, CISA kept its operations center and urgent alerts running but paused much proactive work, so sector channels such as Treasury’s alerts and the industry information-sharing organizations carried more of the load.

The decision here is what to ask for, and how fast. A useful request is narrow and written: confirmation that the provider has reviewed its internet-facing devices and administrative accounts against the named techniques, the date of that review, and a contact for incident escalation. Broad questionnaires sent during a crisis tend to come back late and say little. Contracts that already require prompt incident notice help. Contracts that also allow the institution to request a specific attestation during a declared threat period help more, and they are worth adding at the next renewal.

Boards should expect management to report on both its own posture and its providers’, because examiners will look at both. For a community bank, the provider attestation is often the most important document it can produce after a threat period. It shows the board asked the right question of the party that actually runs the systems.

With hindsight

FINRA said that as of March 16 it was not aware of any significant Iran-related cyberattacks against the financial services industry, even as it described active targeting. The most visible destructive attack attributed to an Iran-linked persona in that period hit a medical technology manufacturer, Stryker, not a bank. That fits what earlier episodes suggested: well-defended financial institutions see more probing than damage.

The cost showed up in time and attention. Brent crude traded above $100 a barrel for stretches of the spring, fell back sharply in June, and was climbing again in September as disputes over the Strait of Hormuz resurfaced. Volatile markets and an elevated threat level ran together for months, not days. Institutions that had settled who could break a change freeze, and that held recent provider attestations, carried that load more easily than those still escalating each request.