Who watches the watchman?

Community banks’ approach to technology is always changing. It’s more a matter of keeping up with the pace of a demanding digital world than it is a desire to step away from the traditional and elegant history of simply being a trusted community resource with lenders who know their customers by their first names. Every banker who has adopted this or that new fintech provided and maintained by a third party, probably a young company if not a startup, knows that eventually the bank has to take a leap of faith. The software-as-a-service solution on offer looks great on paper and the sales team has you convinced that along with meeting customers where they are (their phone) the product is also abundantly secure. Ready? Jump! .These fintechs know how a banker feels. They themselves take that same leap. One would be hard pressed to find a fintech that doesn’t rely on the tech products of other companies. From the ubiquitous Amazon Web Services to Microsoft to Cisco, even a fintech with a patent or two is not re-inventing the internet to provide a new service. They themselves are vulnerable to bad actors and human errors outside of their control. A recent study underlines the diligence a community bank has to execute to minimize the possibility of a new fintech partner becoming a security risk because that fintech’s back-end partners messed up. Earlier this year, SecurityScorecard released a report, Defending the Financial Supply Chain: Strengths and Vulnerabilities in Top Fintech Companies. It’s by no means comprehensive, but the study gathers enough data to make a case that 41.8 percent of breaches impacting top fintech companies originated from third-party vendors. Based on an analysis of the cybersecurity history of 250 of the world’s top fintechs, the report highlights the growing disconnect between strong internal controls and external supply chain risk.It should be said that SecurityScorecard makes its money by offering to rate tech-vendor track records along this chain, or the system of tech companies that rely on each other to make a product a reality. Their work is something bankers might think of when selecting fintech partners. It’s a process worth noting. “Fintech companies anchor global finance, but one exposed vendor can take down critical infrastructure,” Ryan Sherstobitoff, SVP at SecurityScorecard, said. “Third-party breaches aren’t edge cases — they reveal structural risk. In fintech, that means operational outages across payment systems, digital asset platforms and core financial infrastructure.”There is good news in this report. By SecurityScorecard’s evaluation, fintech firms had the strongest security posture of any industry analyzed. Fintechs are regulated in ways many other tech firms are not, so it’s nice to see that regulation is having a positive effect. Yet, there are weak points to be found: 18.4 percent of fintechs experienced publicly reported breaches and 28.2 percent of those had multiple incidents.Third-party attacks, or those coming from services fintechs rely on, made up 41.8 percent of breaches. Fourth-party exposures accounted for an additional 11.9 percent. Did someone just say fourth party? That’s right, the companies that fintechs rely on themselves rely on other service companies. There could be fifth and sixth parties. This is turning into quite a party! SecurityScorecard offered some advice for how to mix in with this party atmosphere. “Strengthen third- and fourth-party oversight,” the study suggests. “Fintech companies should tier vendors based on exposure and breach history, not just expense or business value. Disclosing downstream dependencies and requiring incident notification clauses in contracts can reduce cascading risk from fourth-party breaches.”Translation: Make sure to ask a potential fintech vendor to explain their rigorous process of vetting the vendors it relies on. Finally, there is the inevitable “cloud,” which the study finds to have the greatest areas of vulnerability.“File transfer software, cloud storage platforms and customer communication tools were the most common vectors for third-party breaches,” the study found. “Fintechs must audit these integrations regularly and require partners to demonstrate secure implementation practices.”When deciding on a fintech service, remember to ask who is looking out for them, and make sure they can provide receipts of their own internal audit. All tech services rely on a vast array of other services. This may seem like a tangled mess, but all good fintechs should be able to provide a clear path of the chain they use to be in business and how they monitor their own vendors’ successes or failures in the challenging area of digital security.