TLDR
Offensive security is consistently framed as expensive. Breaches, regulatory penalties, and incident response costs are consistently more expensive. This post breaks down how to think about offensive security as a financial decision, not just a technical one, and what that math actually looks like for a regional financial institution.
Security budgets at regional banks are built around a consistent pressure: every line item gets scrutinized, and anything that doesn’t map directly to a compliance requirement tends to require justification.
Offensive security testing sits in that uncomfortable middle ground. It isn’t mandated the way a SOC 2 audit is. It doesn’t produce a certification. And the price tag, typically ranging from $40,000 to $150,000 for a meaningful engagement, is visible in a way that breach costs never are until they happen.
The Flagstar Bank incidents illustrate what that math looks like on the other side. Flagstar was first compromised in 2021 through the Accellion File Transfer Appliance, a third-party vendor platform the bank used to handle sensitive content. The attack exposed data belonging to approximately 1.5 million customers, including names, Social Security numbers, addresses, and tax records.
That triggered mandatory regulatory notification, three separate class action lawsuits, and a $5.9 million out-of-court settlement. Then, in December 2024, the SEC imposed an additional $3.5 million penalty, finding that Flagstar had made materially misleading statements about the breach in its public disclosures. The breach cost wasn’t a single event. It compounded across years of litigation, regulatory examination, and reputational exposure.
The attack vector is worth noting for regional institutions specifically. Flagstar’s internal systems were not directly compromised. The exposure came through a vendor platform, meaning the attack surface that produced liability existed entirely outside the perimeter security investment was designed to protect.
That gap between where security investment is focused and where adversaries actually operate is where the economics of offensive security begin.
What a Breach Actually Costs a Regional Bank
IBM and the Ponemon Institute’s 2025 Cost of a Data Breach Report carries a finding worth noting before the headline number. While the global average breach cost fell 9% to $4.44 million, U.S. organizations moved in the opposite direction. Average breach costs for U.S. companies hit $10.22 million in 2025, an all-time high, pushed upward by steeper regulatory fines and detection challenges. Financial services remained among the five most costly industries in the study.
Those figures cover institutions of varying sizes and should be treated as directional rather than predictive for a $500 million community bank. But even discounted significantly, they reflect what the cost categories look like when you add them up across an incident’s full lifecycle.
For a regional institution, the immediate response alone is substantial. External forensics and incident response firms run $300 to $500 per hour for experienced teams and often take weeks to complete their work. Regulatory notification to the FDIC, OCC, or state banking regulators is now required within 36 hours of a significant incident under rules that took effect in 2022. The documentation burden requires substantial legal and compliance resources from the first day.
Customer notification triggers its own wave of costs: printing and mailing, call center volume, credit monitoring services, and identity theft restoration coverage for affected customers.
Then the tail begins. The Flagstar settlements totaled $5.9 million, and that didn’t include the $3.5 million SEC penalty that arrived more than three years after the original incident. Regulatory examination posture hardens after a breach, and for a regional institution, that scrutiny doesn’t disappear after the next exam cycle.
The 2025 IBM report found that 86% of breached organizations reported significant operational disruption, and that recovery typically extended beyond 100 days. For a bank, that timeline affects lending decisions, customer service capacity, and the attention of leadership that should be focused elsewhere. Customer attrition in a local market where trust is the primary competitive asset rarely shows up in an incident response invoice. It shows up over the following two years.
What Compliance Checks and What Offensive Testing Finds
Understanding what a breach costs is only half the equation. The other half is understanding why existing security investment may not prevent one.
Compliance frameworks do something valuable and specific: they confirm that controls exist. An examiner reviewing a bank’s security posture under FFIEC guidelines will look for documented policies, access control procedures, patch management programs, and evidence that security tools are deployed and monitored. Passing that review means the institution has the required infrastructure in place. It does not mean that infrastructure holds under realistic attack conditions.
The distinction shows up consistently in how offensive engagements actually unfold. A vulnerability scan identifies an open port on a system that shouldn’t have one. A red team engagement determines what an attacker can do once they’re past it, how far they can move laterally through the network, what credentials they can harvest, and whether they can reach systems that process customer financial data.
Those are different questions with different answers, and only one of them reflects how an adversary actually operates.
Multi-factor authentication is a useful example. Compliance reviews confirm that MFA is enabled across the environment. Offensive testing regularly finds legacy applications, vendor portals, or internal tools excluded from MFA rollout, either because they predate the policy or because integration was deprioritized. Those exclusions don’t appear in a compliance report as findings. They appear in a red team report as access paths.
The same gap exists with third-party integrations. Compliance frameworks ask whether vendor risk management programs exist. Offensive testing probes whether those integrations actually enforce the access controls the contracts require. Flagstar’s exposure came through exactly this kind of interface. The internal controls were intact. The perimeter that mattered was external.
Compliance spend and offensive security spend are not substitutes for each other. They answer different questions about different aspects of an institution’s exposure.
Building the Business Case
Translating breach risk into a budget conversation requires a framework a security leader can actually take into a room with a CFO or board.
Start with loss exposure. Given your customer base, asset profile, and regulatory environment, what does a realistic breach cost range look like for your institution? The 2025 IBM and Ponemon data establishes that U.S. financial services institutions face average breach costs well above the global average and that recovery typically extends beyond 100 days. Translate that into your institution’s specific terms, capturing direct response costs, litigation exposure, regulatory consequences, and customer attrition.
To make that concrete: consider a regional bank with 50,000 customers, a prior examination finding related to third-party risk, and $5 million in cyber coverage. A breach that triggers mandatory customer notification, a 90-day remediation period, class action exposure, and a coverage dispute over a known unpatched vulnerability produces a cost profile that looks nothing like the premium on the insurance policy. The engagement that might have identified and closed that vulnerability costs a fraction of any one of those line items individually.
Next, consider what the engagement actually addresses. An offensive security assessment scoped to your external attack surface, internal network, and third-party integrations produces a prioritized list of exploitable vulnerabilities and attack paths. Remediating those findings reduces specific, identified exposure. That shifts the budget conversation from whether the institution is spending money on security to whether it is reducing the specific conditions that would produce a breach.
Finally, account for the insurance dimension. According to Marsh’s Q4 2024 US Cyber Insurance Market Update, underwriters continue to evaluate cyber hygiene as a core part of the underwriting process, and institutions that demonstrate continuous improvement in security controls may access more favorable terms and pricing. Coverage exclusions for known vulnerabilities are real, and their implications at the moment of a claim are worth understanding before an incident occurs.
A well-scoped offensive engagement for a regional bank typically runs between $40,000 and $100,000. Set against a breach cost environment where U.S. financial institutions are absorbing costs that run into the millions, the question stops being whether the engagement is expensive. The question is what the institution is implicitly accepting by not conducting one.
Where Regional Banks Tend to Underinvest
Three patterns show up consistently when regional banks examine their security investment mix after an incident.
Testing frequency. Most regional banks conduct penetration testing annually, if at all, typically timed to satisfy an examination requirement. The threat environment those tests are designed to assess does not operate on an annual cycle. Adversaries probe continuously, and the attack surface of a regional bank changes every time a new vendor integration goes live or an employee’s credentials are compromised elsewhere. If your last penetration test predates your most recent vendor integration or infrastructure change, the findings are already stale.
Scope. Offensive engagements are often limited to known internal systems and network perimeters the institution’s own team has already mapped. Third-party integrations, legacy platforms, and vendor-facing portals frequently go untested, which is exactly where Flagstar’s exposure originated. If your engagement scope was defined by your internal IT team rather than by a threat model, it likely reflects your own blind spots rather than an attacker’s perspective.
Remediation follow-through. A penetration test that produces a findings report which then sits in a queue while remediation competes with other IT priorities is not a security investment. It is a documentation exercise. If your last report produced findings that remain open after 90 days, the engagement produced documentation rather than risk reduction. Offensive security produces value at the point of remediation, not at the point of the report.
A Note on Cyber Insurance
Cyber insurance is not a substitute for offensive security testing, and the insurance market itself is beginning to reflect that distinction more explicitly.
Coverage exclusions for known vulnerabilities are real. If an institution experiences a breach through a vulnerability that was previously identified and went unremediated, the insurer’s obligation to pay becomes a negotiated question rather than a settled one.
The Marsh Q4 2024 market update is direct on this point: underwriters are scrutinizing cyber hygiene as a core component of the underwriting process. The implication is that the insurance program and the security program need to be managed in coordination, not in parallel. A policy provides meaningful protection when the institution has done the work to demonstrate it took reasonable steps to identify and address its exposure. When that work is absent, the policy’s value at the moment of a claim is uncertain in ways that a premium payment cannot resolve.
Before the next renewal, pull your current policy’s exclusion language and compare it against your most recent assessment’s open findings. That is a 30-minute exercise that will tell you more about your actual coverage position than the premium amount will.
The Investment Decision
Every security budget is a statement of priorities, whether the institution intends it that way or not. The decision to conduct offensive testing, to scope it broadly, to remediate what it finds, and to repeat that process on a meaningful cycle reflects a specific judgment about what the institution is responsible for protecting and what a failure to protect it would cost.
It is worth acknowledging the honest counterargument: organizations conduct regular offensive testing and still get breached. Security is not a problem that gets solved. The case for offensive testing is not that it eliminates breach risk. The case is that it reduces specific, identified exposure, produces documented evidence of due diligence that matters to regulators and insurers, and forces remediation conversations that don’t happen any other way. That is a narrower claim than immunity, and it is a more defensible one.
For regional banks, the judgment carries particular weight. The asset being protected is not primarily technology. It is the trust of customers who chose a community institution over a national one, regulators who expect demonstrated competence rather than checkbox compliance, and a local market where reputational damage does not dissipate the way it might for a $100 billion institution with national brand recognition.
The institutions that approach offensive security as a financial decision rather than a compliance exercise will make different choices about frequency, scope, and remediation than those that approach it as a line item to be minimized. Over time, those choices compound in one direction or the other.