NewsPublished 3 Jun 2026

What 345 Days of Untested Exposure Looks Like at a Bank

Source Bleeping Computer

Description

This report highlights the security risks posed by relying solely on annual penetration testing in financial institutions. A real-world example showed that a third-party vendor's mortgage portal exposed sensitive staff and organizational data via an unauthenticated API, which was not detected in prior annual tests. The exposure was due to changes in infrastructure and vendor platforms occurring between tests, leaving roughly 345 days of unvalidated attack surface. Regulatory frameworks expect testing to respond to infrastructure changes, but many institutions treat annual tests as comprehensive. Continuous testing that adapts to dynamic infrastructure changes is recommended to close this gap and reduce exposure.

Impact

The impact includes prolonged exposure of sensitive organizational and staff data across multiple financial institutions sharing a vendor platform, enabling potential fraud, phishing, and compliance incidents. The vulnerability allowed unauthenticated access to detailed staff information and the ability to submit fraudulent loan applications attributed to legitimate officers. This exposure affects the institutions' regulatory compliance posture and increases risk of reputational damage and financial loss. The example demonstrates that annual penetration tests alone do not adequately validate the security posture of dynamic, evolving infrastructures, leaving institutions vulnerable for extended periods.

Defensive guidance

The vendor advisory does not indicate a specific patch but emphasizes that annual penetration testing is insufficient to cover dynamic infrastructure changes. Institutions should adopt continuous penetration testing and attack surface management practices that trigger testing in response to infrastructure changes, including third-party vendor platforms under their domains. Scoping for penetration tests should include newly onboarded assets and vendor-operated portals accessible under the institution's domain. Automated scanning should be supplemented with active human testing to validate exploitability and downstream impact. These measures align with regulatory expectations that testing occurs after significant changes rather than on a fixed annual schedule.

Summary

The threat arises from the structural limitations of annual penetration testing in financial institutions, where significant infrastructure changes—such as cloud migrations, fintech integrations, and third-party vendor platforms—occur frequently. An example detailed a vulnerability in a third-party mortgage origination portal operated under a bank's subdomain, exposing sensitive staff data and enabling fraudulent loan application submissions via an unauthenticated API endpoint with permissive cross-origin policies. This vulnerability was not detected by automated scanners or annual tests due to scope limitations and the dynamic nature of the attack surface. Regulatory guidance (PCI DSS, FFIEC, NYDFS) mandates testing in response to changes, but many institutions do not meet this operational expectation. Continuous penetration testing and attack surface management are proposed as effective mitigations to address the 345-day gap of unvalidated exposure inherent in annual testing models.

References

bleepingcomputer.com/news/security/what-345-days-of-untested-exposure-looks-like-at-a-bank/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 3 Jun 2026, 22:56 UTC

References

Community reviews