FDIC’s Cybersecurity Challenges: Banks Vulnerable Amid IT Talent Shortage

FDIC’s Cybersecurity Challenges: Banks Vulnerable Amid IT Talent Shortage

Summary

• A March 2025 report from the FDIC’s Office of Inspector General lists IT security as a top challenge for the agency.
• More than half of the FDIC’s advanced IT examiners were eligible to retire in 2024, and that share rises to 63% by 2028.
• The report warns that banks’ reliance on shared third-party providers means one failure could affect many banks.
• The number of “problem” banks rose to 66, with $87.3 billion in assets, up from 44 a year earlier.

An IT Expertise Gap at the Bank Regulator

The Federal Deposit Insurance Corporation is losing the people who check banks’ IT and cyber defenses. That is the warning in the 191-page Top Management and Performance Challenges report released March 20, 2025, by the FDIC’s Office of Inspector General (OIG). Banks face threats from cyberattacks and from weaknesses in their third-party relationships, and the examiners who spot those risks are nearing retirement.

The FDIC’s Current Predicament

The OIG put it plainly: “Currently the FDIC faces risks in ensuring that it has examiners with the requisite skillsets to perform IT examinations using existing examination procedures.”

The numbers are stark. Of examiners classed as advanced IT subject matter experts, 53% were eligible to retire in 2024, rising to 63% in 2028. For examiners with intermediate IT expertise, eligibility climbs from 16% to 27% over the same period.

Why IT Exams Matter

IT examinations show where a bank is exposed to IT and cyber risks and whether its management can control them. The results can affect a bank’s safety and soundness rating, which in turn shapes how the FDIC supervises it.

In the latest fiscal year, FDIC examiners made supervisory recommendations in 90 cases tied to information technology, alongside 104 tied to risk management.

Third-Party Risk Across Banks

The OIG flagged a growing concern. Several banks often rely on the same third-party providers, and “an operational issue at one such third party has the potential to affect many banks.” The report said it is critical that the FDIC maps those links to understand possible points of failure and cyber contagion.

Banks’ growing use of outside providers for Bank Secrecy Act, anti-money laundering and sanctions compliance may also require different exam processes or examiners with different skills.

What the FDIC Can Do

The OIG’s findings point to two jobs: hire and train more IT examiners before experienced staff retire, and update exam methods for a banking system that leans more on outside technology providers.

Competition for skilled security staff is fierce, and public-sector pay often trails private offers. That makes the hiring job harder.

The Bottom Line for Banks

Problem banks are rising. The number of banks on the FDIC’s problem list for safety and soundness concerns rose to 66, with $87.3 billion in assets, from 44 banks with $54.5 billion a year earlier.

If the agency loses its most experienced IT examiners faster than it can replace them, cyber and third-party risks at banks could go unchecked. Bank leaders should expect continued focus on vendor risk in their exams.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.