Ryan Ikeler is the President of MOXFIVE, advancing business resilience and technical recovery for organizations navigating cyber incidents.
Recently, a wave of attempted cyberattacks hit some of the largest investment firms on Wall Street. If you don’t work in finance, that might sound like someone else’s problem. It isn’t.
The attackers didn’t use a sophisticated exploit. They used a phone call that impersonated someone the target already trusted, a technique called vishing. Of several targeted firms, Bloomberg reported that Two Sigma Investments said it blocked the attempt, while Point72 Asset Management confirmed it had been targeted and was still reviewing the incident.
Stopping an attack is always one objective of cybersecurity, but was it luck, or was it a successful implementation of controls and pattern recognition? Knowing the true answer is what lets underprepared firms turn a lucky break into a repeatable defense.
Before The Pattern Reached Wall Street
The tactics used against these firms are new spins on old tricks. Social engineering predates the existence of both the internet and Wall Street, and AI-powered voice and video cloning, also called deepfakes, makes these tactics much more dangerous. Similar vishing and voice-cloning activity has already been observed against law firms and professional services organizations, where attackers impersonate partners and IT staff to pressure employees into resetting credentials or approving urgent requests outside normal channels.
Deloitte’s 2025 report identified the exploitation of human behavior as a growing threat. Put simply, the same call that might have sounded generic and suspicious in the past can now be tailored to a specific employee, referencing real names and real projects and using a voice that sounds like someone they know.
Vishing is particularly effective because a social engineering call can bypass almost all the efforts organizations put into their security stack. Vishing triggers no alerts, has no indicators of compromise and trips no firewalls. Rather than combating technical controls, it allows threat actors to simply ignore them.
Regulators are responding accordingly. FINRA launched its Financial Intelligence Fusion Center in March 2026 to help member firms share timely intelligence about cybersecurity and fraud threats. That response recognizes a fundamental reality of modern attacks. When the same tactics appear across organizations, the firms that learn from the earliest incidents have an opportunity to act before the threat reaches them.
Very few industries have a resource like the Fusion Center, and most companies can’t build that kind of shared intelligence network on their own. That’s increasingly why organizations turn to outside partners who sit across many incidents at once and see the same tactics resurface across clients well before any single victim would notice the pattern on its own.
Turning Other Companies’ Incidents Into Your Early-Warning System
A mature security program needs a mechanism for turning current incidents into changes in its own environment, whether that discipline lives in-house or comes from an outside partner who’s seen the pattern before. That does not mean chasing every new headline or adding a control every time another company is attacked. It means asking disciplined questions:
• If an attacker successfully used a trusted voice to bypass an organization’s normal processes, would ours work differently?
• If the same tactic appeared against our employees tomorrow, where would the attacker encounter resistance?
• Where would a legitimate request and a malicious one look identical?
• Which controls depend on an employee recognizing that something sounds wrong?
These answers should lead to specific changes in procedures, technology or training. Looking at enough real incidents can reveal which controls hold up under pressure, which fail despite appearing effective on paper and which attacker behaviors repeatedly create openings—all valuable insights a theoretical risk assessment can’t offer.
In practice, security works best as a standing habit, not a one-time reaction. When a new incident trend surfaces publicly, a security team should dedicate a small window of time that same week, tracing it against existing defense procedures and flagging any gap to whoever owns that control. Small and frequent beats formal and rare.
The Broad Readiness Gap
PwC found that nearly two-thirds of employed U.S. respondents said their company had already experienced at least one major digital harm, including attempted financial scams or suspected data breaches. Yet only 9% believed the groups responsible for managing digital threats were keeping pace.
For financial services specifically, PwC also found that 76% of financial institutions planned to increase cybersecurity budgets in 2026, but only 24% were spending significantly more on proactive than reactive security measures.
The goal isn’t predicting the next attack perfectly; it’s reducing the number of surprises when it arrives.
Security teams have limited resources and cannot respond equally to every theoretical threat. That’s why leaders must determine which risks deserve attention now.
The Real Lesson
The organizations best positioned for the next wave of attacks will not necessarily be those with the newest security technology. They will be those with the strongest mechanisms for learning and adapting to ongoing attack trends. Today’s threat landscape is more dangerous, and its threats are more varied, than ever in the history of cybersecurity, and that trend seems poised only to increase over time.
That means treating current incidents as intelligence, not just news. When another organization gets attacked, leaders shouldn’t ask, “Could this happen to us?” They should instead ask, “What does this incident tell us to change before it does?”
The companies that adopt this habit can turn someone else’s breach into their own early-warning system. As attackers move successful playbooks from one industry to the next, the ability to learn from incidents before they become your own may be as important as the controls you deploy to stop them.
Forbes Technology Council is an invitation-only community for world-class CIOs, CTOs and technology executives. Do I qualify?