What 345 Days of Untested Exposure Looks Like at a Bank

In recent months, the cybersecurity landscape has been marred by a string of incidents that have compromised sensitive information and disrupted services. These breaches have highlighted the need for organizations to reassess their security measures and prioritize the protection of their systems and data.

What Happened

• A vulnerability in Marquis Software's infrastructure led to data breaches at over 70 financial institutions, despite the existence of a patch and recent penetration tests.
• Acer is working to address two maximum-severity zero-day vulnerabilities affecting its Wave 7 mesh routers, which could allow unauthenticated attackers to remotely access plaintext credentials.
• Google Gemini users are at risk of being tricked by malicious notifications that can hide social engineering attacks.
• Microsoft is introducing new controls to keep AI agents in check, as enterprises increasingly adopt AI-powered software development workflows.
• A major crackdown on illegal streaming operations has resulted in the dismantling of nine organized crime groups and the arrest of 29 suspects.

Why It Matters

The recent breaches and vulnerabilities underscore the importance of robust cybersecurity measures across industries. The financial sector, in particular, is a prime target for hackers, with CrowdStrike's 2026 Global Threat Report ranking financial services fourth in interactive intrusion targeting.

"AI is accelerating development and introducing new issues around insecure code, opaque models, data exposure, and compliance," said Aleš Holeček, chief architect at Microsoft Security.

Key Numbers

• 345 days: The average number of days in a year that are not covered by standard annual external penetration tests.
• 14 days: The median dwell time for adversaries in 2025, according to Mandiant's M-Trends 2026 report.
• 122 days: The average dwell time for espionage actors in 2025.

Key Facts

• Who: Marquis Software, Acer, Google, Microsoft, and various law enforcement agencies
• What: Data breaches, vulnerabilities, and crackdown on illegal streaming operations
• When: Recent months
• Where: Global
• Impact: Compromised sensitive information, disrupted services, and financial losses

What Experts Say

"The math is straightforward. A standard annual external penetration test runs two to three weeks of active testing. That leaves roughly 345 days of operational reality unvalidated," said a cybersecurity expert.

What Comes Next

As the cybersecurity landscape continues to evolve, organizations must prioritize the protection of their systems and data. This includes implementing robust security protocols, conducting regular penetration tests, and staying up-to-date with the latest security patches and updates.