Grace Williams at Financial Planning reported that cyberattacks on financial firms were down in the first five months of 2026, and not for a good reason. Attackers have become more sophisticated, more patient and more selective. The question for an advisory firm is not whether an attempt will come but whether the firm is ready when it does.
I told her I approach cybersecurity the same way I approach a financial plan. One document is not enough, and it is useless if nobody updates it.
Our setup at Chesapeake Financial Planners has three parts. First, written policy covering both cybersecurity and the physical security of the branch office itself. Second, a business continuity plan the firm reviews at least annually, so we know what happens to client service if a system or a location goes down. Third, a managed security provider that monitors, patches and tests, because a two-partner firm is not going to out-engineer a professional threat actor on its own.
The plan is only as good as its last review. Frequent check-ins, staff training on what a real phishing attempt looks like, and a habit of verifying any money-movement request by phone are what keep the paperwork from being just paperwork.
For clients, the question to ask your adviser is simple: what is your plan, and when did you last test it?
Read the full article at Financial Planning →
