By Ken Kulawiak, Wipfli
For credit unions, cybersecurity risks are numerous and growing. Phishing scams, ransomware attacks and third-party vendor risks all pose financial and operational dangers, while AI creates a wave of threats all its own – both in the hands of attackers and when used by your own team.
To better protect themselves, their data, and their members, more credit unions are hiring a virtual or fractional chief information security officer (vCISO). Keep reading to learn how a vCISO can make your credit union safer, plus how to kick-start the hiring process.
Credit union leaders must already navigate a growing range of complex, powerful cybersecurity threats. These include direct cyberattacks, risks around internal AI usage, disaster recovery challenges, and third-party vendor risks.
Major risk areas include:
Business email compromise: More commonly known as a phishing scam, business email compromise allows an unauthorized outsider to gain access to your systems.
Ransomware attack: One of the worst-case outcomes of business email compromise is a ransomware attack, in which an attacker locks you out of your data or core systems and forces you to pay a ransom in order to regain access.
Business continuity disaster recovery: More credit unions are embracing cloud-based systems, but have not updated their disaster recovery strategies to account for this shift.
AI: Beyond helping hackers launch cyberattacks, AI also creates internal risks like poor governance and shadow AI use that could result in private data being inadvertently shared with public AI models. Your third-party software vendors may also add AI into existing solutions you’re already using, which means your employees could start feeding it data before your IT can assess for operational and security risk.
Third-party data risks: Whenever your credit union shares data with software vendors or third-party IT support, you create additional risk exposure – because a data breach at one of those vendors could put your data at risk as well. For credit unions and other financial institutions, this is actually a bigger risk than a direct attack.
Tackling these risk areas takes strategic-level thinking and management skills, which is why more credit unions are hiring a chief information security officer (CISO) to provide that support.
A vCISO is essentially a quarterback for your cybersecurity and risk management efforts. Your vCISO’s main job is to manage your short- and long-term risks in areas like technology and data security, while being comfortable working with both your senior executives and your boots-on-the-ground IT team.
Look to a vCISO to:
Strengthen your cybersecurity: A vCISO will serve as your point person on cybersecurity as both a C-suite executive and frontline manager by identifying gaps in your current defenses and overseeing efforts to implement a modern cybersecurity strategy.
Lead AI governance and security efforts: A vCISO will also guide your credit union to implement effective AI governance and security policies. Strong governance can help ensure that your team only uses approved AI tools, which mitigates your risk of exposing private or member data with unauthorized or public AI systems.
Mitigate third-party data security risks: Understanding and taking steps to manage third-party data security risks is also part of a vCISO’s purview. A vCISO will know how to map out your third-party risk points and ask the right questions to assess whether your vendors are protecting your data responsibly.
Bridge the gap between C-suite and IT: As part of your executive team, a vCISO thinks strategically and can talk with your leadership team about cybersecurity and risk in layman’s terms. But a vCISO also has the technical knowledge to engage directly with your IT team, serving as a bridge between IT and leadership.
Now, if a vCISO is such an asset, why doesn’t every credit union just hire a full-time CISO instead?
As a fractional team member, a vCISO provides the same knowledge, experience and strategic capabilities of a full-time CISO at a dramatically lower cost. A vCISO also helps keep regulators happy and typically offers a broader perspective on how your peers are tackling cybersecurity.
Key benefits to hiring a vCISO include:
An in-house CISO could cost you mid-six figures plus benefits and bonuses – even if you don’t actually need 40+ hours a week of information security leadership. A vCISO will often cost only a small fraction of a full-time hire, while providing exactly the amount of CISO support that makes sense for your credit union.
A vCISO can scale alongside your credit union. What may start out as a 10-hour-a-week engagement could grow to more if your needs change – or scale back if you only want CISO support during a particular project or systems implementation. A vCISO can also toggle between strategic leadership and program management, “get it done” type tasks.
Regulators increasingly frown on credit unions that put a single person, like an IT director, in charge of managing both IT and cybersecurity. Hiring a vCISO also avoids putting cybersecurity oversight in the hands of your CFO or COO, as this is outside of their primary disciplines. (Forward-thinking institutions may want to hire a full-time CIO to lead overall technology strategy and then a vCISO to tackle cybersecurity.)
The average vCISO will typically have experience working with dozens of organizations. This means they’ll bring that broader industry perspective to your C-suite than most in-house hires, with a deeper understanding of best practices or how your peers are solving today’s biggest cybersecurity challenges.
Finally, you may have in-house IT director or manager who wants more responsibility but doesn’t yet have the strategic skills to take on a CISO role themselves. Your vCISO can serve as a bridge, coaching your top IT talent and preparing them to step into higher leadership roles when ready.
Hiring a vCISO should be a relatively straightforward process:
Find a cybersecurity and risk management advisory firm.
Work with them to assess your specific needs.
Onboard a vCISO (typically provided by the advisory firm) to meet them.
However, be sure to choose a cybersecurity advisory firm that will customize your vCISO service to the specific needs of your credit union. If you only need two hours of vCISO support per week, that’s all you should be paying for.
You should also ask a potential vCISO to do a full cybersecurity and technology risk assessment and provide a risk management roadmap before you sign a contract.
Connect with Wipfli to learn more.