Financial Services and Insurance Test More Than Most. Remediation Hasn't Kept Pace.

Financial services and insurance run security like the regulated sectors they are: programmatic, measured, and confident. This report combines five years of Cobalt pentest findings with a 2026 survey of 65 financial services and insurance security leaders and practitioners to profile how these sectors find, fix, and think about security risk.

48%
Test AI applications programmatically (highest of any sector)

9%
Have had an AI or LLM security incident (lowest of any sector)

55 days
High-risk vulnerability half-life, only mid-pack across 10 sectors

What’s Inside:

• How financial services and insurance compare to nine other sectors on remediation speed
• Why strong AI testing discipline isn't closing the remediation gap
• The red teaming blind spot in two sectors that test more than anyone else