Ransomware + Vendor Risk Are Converging on Money Managers-Regulators Are Watching

2025 changed the attack path for money managers

The risk landscape changed in 2025. Finance saw a 30% year-over-year increase in ransomware incidents, and the vendor ecosystem became materially more dangerous at the same time. That shifts the focus from "did our perimeter hold?" to "where did the attacker enter?" The answer can be a shared vendor, a stolen credential, or an AI workflow your team already trusts.

The old idea of strong firms and weak vendors no longer tells the full story. In practice, one compromised MSP reached 32 financial institutions, and a vendor vulnerability exposed 74 or more U.S. financial institutions. For money managers, the damage is not only data loss. It can also show up as client friction, regulatory scrutiny, and reputational harm.

FINRA made third-party cyber risk a 2026 oversight priority

Why now? Because FINRA put these topics front and center in its 2026 oversight agenda. The report covers the third-party risk landscape, generative artificial intelligence, and cyber-enabled fraud, while broader oversight messaging flagged a rise in cyberattacks and outages tied to third-party vendors and called for regular risk assessment and monitoring of third-party risk.

Firms also still have direct duties under SEC Regulations S-P and S-ID. For money managers, that means vendor and identity risk is no longer just an IT issue. It is an operating and compliance issue as well.

Identity, vendors, and AI are the main transmission paths

How risk moves beyond the perimeter

The key question is no longer whether a money manager's own perimeter held. It is how an attacker moves from one weak control into critical workflows. That path often runs through identity controls. From there, risk can spread through vendor connections and accelerate when attackers use AI tools: 16% of breaches now involve AI-driven attacks, and 97% of AI-related incidents lacked proper AI access controls.

The modern attack stack: identity → vendor → AI

Exposure no longer travels only through the weakest firm in the network. It can travel through any vendor, MSP, or AI workflow that can touch data, approvals, or client records.

• Identities come first. Credentials remain a direct path into systems that already trust the user.
• Vendors extend the reach. FINRA has highlighted the third-party risk landscape as a live oversight topic, and industry commentary has flagged a rise in cyberattacks and outages tied to third-party vendors.
• AI can speed the attack. When AI tools are used without proper access controls, the risk goes beyond smart phishing. It includes faster social engineering and weaker guardrails around systems that touch business workflows.

From initial access to business and regulatory impact

Once attackers reach identity and vendor paths, the impact can move quickly into core money-manager processes:

• Research and decision workflows: compromised access can disrupt messaging, documentation, and audit trails.
• Order and trade workflows: vendor-mediated access can introduce delays or execution errors during market hours.
• Custody and file-transfer workflows: connected vendors can affect approvals, instructions, and timing.
• Client reporting and disclosures: disruption can delay or degrade reporting if data paths are impaired.

That is why this stops being a purely technical incident and becomes a business event. Regulators are increasingly focused on the full chain: vendor oversight, identity access, continuity controls, and the protection of client information.

What due diligence should focus on now

The near-term issue is not just that attackers are active. It is whether a firm can show that its third-party, identity, and AI controls are strong enough to limit cascading damage. After ransomware incidents climbed 30% and one MSP compromise spread across 32 financial institutions, investors should look for proof of resilience rather than generic cyber fear.

What good control hygiene looks like

Stronger firms are the ones treating security as an operating standard. The clearest signals include movement toward continuous monitoring, enforcement of multi-factor authentication, regular assessment of third-party risk, and proper AI access controls.

Why does that matter now? Because FINRA's 2026 oversight agenda already covers cybersecurity and cyber-enabled fraud plus the third-party risk landscape, while firms still carry duties under SEC Regulation S-P. In that context, disclosure quality matters: firms that can demonstrate control effectiveness should stand out.

Watchlist for equity and operational due diligence

Focus on the vendor graph, not just broad threat headlines:

• How the firm maps and monitors critical vendor and MSP connections
• Whether identity controls and multi-factor authentication are widely enforced
• How AI tools are governed, especially access controls and data-handling rules
• Whether continuity and incident-response procedures cover vendor-mediated failure paths

What would improve the setup

The sector's risk premium can ease when control progress becomes visible:

• clearer vendor oversight and tighter onboarding controls
• stronger identity and access management across core systems
• evidence that AI tools are governed with the same rigor as other critical applications
• clean regulatory and compliance follow-through on cybersecurity expectations