New TransUnion Research Highlights Incident Response Vulnerabilities
By Roy Urrico
As cyberattacks powered by the newest AI tools increase against large and mid-sized businesses, organizations — including financial institutions — must prepare to respond and recover through planning, practice and partners. That is a recommendation from Strengthening Organizational Resilience with the Right Incident Response Provider, a commissioned study, conducted by Forrester Consulting on behalf of TransUnion, the Chicago-based information and insights company.
The research, based on a survey of 327 director-level and above decision-makers, found 40% indicated their organization lacks an end-to-end incident response partner; while 37% said they do not have a comprehensive incident response plan in place. The study began in February 2026 and was completed in March 2026.
The study also found organizations recognize the need for comprehensive support from expert partners. More than three in four respondents (76%) indicated that end-to-end incident response readiness and response support are either “very important” or “mission-critical” when selecting a partner.
In addition, more than 70% of respondents said their organization already uses at least one external incident response provider. However, only 46% said their current provider delivers that capability very well or extremely well, which explains why 41% plan to reevaluate their external incident response providers in the next 12 months.
“The aftermath of a cyberattack is very chaotic and complex, and most businesses cannot adequately prepare for it on their own,” said Matt Cullina, head of TransUnion’s global cyber insurance business,
which helps organizations minimize harm and restore consumer confidence. “Having the right partner can help minimize the damage and get businesses back to normal much faster.”
Cost Versus Protection
One of the biggest barriers to adequate incident response support is the cost of retaining outside expertise, especially for midmarket and below organizations with smaller budgets, suggested the report.
Financial institutions can weigh cost versus protection by focusing on covering the basics first,” Eder Ribeiro, Director, Global Incident Response at TransUnion told Finopotamus. “There's always a lot of buzz about the latest, next-gen cyber threats, but social engineering attacks remain the biggest problem today.”
Ribeiro noted it is not enough for organizations to just do the basics, like multi-factor authentication. “Cyber threats are getting more sophisticated—and so are defenses—but most successful attacks still happen because someone basically forgot to lock the front door.”
The study provided several recommendations for maximizing the investment, including:
Utilize retainer time for proactive readiness preparation, such as initial readiness assessments and internal first responder training.
Organize cross-functional incident tabletop exercises and realistic crisis simulations to stress test and refine the incident response team’s capabilities.
Prepare external breach communications to customers, partners and employees in advance of an incident. Involve privacy counsel, public relations and human resources to hone messaging and have it approved and ready to deploy.
After exercises or incidents, update plans and playbooks with lessons learned.
“Incident response should be treated as a continuous readiness cycle, not a one-time plan,” added Cullina. “The organizations best positioned to withstand cyber events are those that test their playbooks, include legal, communications and executive stakeholders in tabletop exercises, and continually reevaluate whether their providers can meet today’s threat environment.”
Helping Credit Unions
“The most important finding is that most businesses' confidence in managing cybersecurity risks exceeds their actual readiness,” Ribeiro warned. “A big part of that gap comes from thinking they can handle it on their own, as not enough businesses have proper end-to-end cyber partners they can rely on. Mid-market firms especially are at greater risk than they realize, as most are underinvested in cyber protection.”
“TransUnion provides proactive and reactive cyber solutions ranging from expert advice to digital forensics incident response, ransom negotiation, data mining and breach notification support,” Ribeiro, maintained. “Our solutions and services ensure that any credit union or bank undergoing a cyber incident can be adequately supported through the event with an efficient, dedicated and empathetic group of professionals at their side.”
Cyber readiness is not a one and done thing, it’s continuous and requires a constant cycle of risk assessment and preparation, expressed Ribeiro. “Credit unions often don’t have the resources of big banks, so staying vigilant and up to date on security is a burdensome task. However, dealing with a major cyber incident because due to the lack of cyber measure is far more burdensome.”
End-To-End Incident Response
Beyond the basics, it is difficult to overstate the value of having an external partner who handles cybersecurity and incident response on a daily basis, suggested Ribeiro. “There is a cost to retaining that partnership, but it is far less than the cost of a major cyber incident or even a small, mismanaged incident.”
With that in mind, it's also important to use that partnership proactively, conveyed Ribeiro. “Spend some of the hours you've already paid for to get their help with training and assessment. The real value will come from better odds of preventing an attack in the first place. Also, the mitigation and response process after an incident will be smoother and more effective if the partner is familiar and integrated with the organization.”
TransUnion provides a full-service incident response platform ranging from client intake, first notice of loss, claims management, incident management with dedicated incident coordinators, full suite of digital forensic incident response services and breach notification. TransUnion can also support credit unions, banks and other financial entities in receiving support from other experts in the field as needed on a case-by-case basis.
