Sharing your cybersecurity policies and practices with members should be a “best practice”

Stay with me for a moment. I suspect you don’t think this is a good idea. I’ve heard many times, when asking CISOs and CIOs about their cybersecurity practices, “we do not talk about what we do; we don’t want to help the hackers by telling them how to attack us.” And I get that, at a granular level. Details don’t need to be shared.

But hear me out. When it comes to broad policies applied and software applications used, the bad guys already know. You aren’t unique or special; but you are invested in your efforts, and you should share enough to ensure your members know that you are engaged and working hard. It will help you in both your security efforts (members are more likely to pay attention to your security education initiatives) and your member satisfaction efforts (it’s always better if they know and understand the value of the effort you are making).

In today’s digital-first economy, members increasingly embrace online banking, mobile payments, and digital investing, and these advances have also become fertile ground for cybercriminals. From phishing scams to ransomware and identity theft, cyber threats are escalating in complexity and frequency. As stewards of some of the most sensitive personal and financial data, credit unions are rightly investing heavily in cybersecurity.

Yet, a crucial opportunity remains largely untapped in your efforts to protect members’ data: openly sharing your cybersecurity policies and practices with members (no deep details, but enough information to impress upon them your efforts and their needed participation). Transparency can build trust and foster a collective approach to cyber defense. I hope you will consider doing it.

By making policies more transparent and accessible, your organization can empower your members to understand the mechanisms protecting their data and to take proactive measures themselves, measures you encourage. This approach transforms cybersecurity from a solely institutional concern into a shared responsibility, fostering a more resilient relationship and financial ecosystem.

The financial services industry is among the most targeted by cyber attackers. According to the IBM X-Force Threat Intelligence Index, financial services consistently rank in the top three most-attacked industries. Attackers are often driven by the potential for high-value gains: access to banking credentials, account numbers, or credit card data.

Common attack vectors include:

Amid this landscape, financial institutions spend millions annually to fortify their defenses, often implementing tools like:

But while institutions defend their perimeters, customers and members remain one of the weakest links. And a compromised customer account can have as much financial impact as a breach of the institution’s own infrastructure. This is true because of the possibility of broad access gained through a singular breach and, also, because of class-action legal claims prompted by account and personal data theft.

We like to think TRUST is the cornerstone of any customer relationship in financial services. In surveys, large majorities of banking customers have said cybersecurity and data privacy were top factors in choosing a financial provider. Yet few can articulate what their bank or credit union does to protect them.

I suspect some of that large majority “believe they should care about how you perform”, so they say it, but they don’t really make their decision based on it. Still, perception counts, as does aspiration. And when you fail and are breached, and you will be if you haven’t already, you must contend with the fall-out.

If you share your cybersecurity policies—that you encrypt data, monitor threats, vet third parties, and more—you provide members with evidence that their safety is a priority. Transparency fosters trust, particularly when paired with easy-to-understand explanations and user guidance. This practice can only help when the time comes to lean on members’ faith and loyalty—both of which you worked to earn.

Much financial fraud begins with a customer mistake: clicking a malicious link, using a weak password, or failing to recognize social engineering. By educating customers about common threats, safe practices, and what to do when suspicious activity is observed, institutions can significantly reduce risk.

Some banks and credit unions already offer:

But I see more institutions starting to publish their cybersecurity frameworks, outline the technologies used to secure interactions, and share updates on new threats or procedures. They see gains to be made for their security and with their customers.

Although privacy disclosures and breach notifications are typically required by regulatory bodies, institutions that proactively share aspects of their cybersecurity governance with customers and members demonstrate leadership and due diligence—both, as I mentioned earlier, will prove useful in the event of future breaches or litigation.

It’s neither practical nor advisable for credit unions to publish every technical detail of their cybersecurity infrastructure—such disclosures could help bad actors. Instead, you should focus on sharing information that empowers members without compromising defenses. Here are five key areas:

Provide summaries of internal cybersecurity strategies, such as:

This helps members understand that your institutional safeguards are robust and evolving. And by pointing out “all you are doing” you strengthen your bond with your members, as opposed to the posture we see in privacy and data breach notices which come across as “CYA” and weaken that bond. Being proactive is simply better.

Offer plain-language tips, FAQs, and guidelines on how customers can protect themselves, including:

Many credit unions are engaged in the above, but it will prove more valuable and effective when packaged with discussion of your institutional efforts, and of the broader environment.

Credit unions should issue real-time alerts about known scams or active fraud campaigns affecting their members. This can be done via email, SMS, push notifications, or a dedicated security center on the institution’s website (Yes, make this part of your public profile).

Examples include:

When incidents do occur, how you communicate can make or break your reputation. Sharing:

…can reassure members and minimize panic. Proactive communication outperforms reactive damage control every time. But don’t stop. Don’t underplay what has happened. Don’t gloss over what must happen. Don’t fall short and leave the impression that it is business as usual. See https://www.cuinsight.com/sisyphus-is-still-pushing-that-rock/ for my fuller complaint regarding breach notifications. And, no, regulatory requirements aren’t a strong argument for what you’ve been doing. You can do more.

Members increasingly want to know whether their credit union shares data with vendors and, if yes, whether those vendors meet rigorous cybersecurity standards. Members read the news too. They have heard about supply chain risk. So, you should consider:

While sharing cybersecurity practices offers clear benefits, it isn’t without challenges:

Creating and maintaining clear, customer-facing cybersecurity content requires dedicated teams—often across departments like IT, compliance, legal, and marketing. This can stretch your already overburdened resources.

Over-disclosure of internal controls could arm attackers with too much insight. You must walk a fine line between informative and overexposed.

Even well-designed cybersecurity communications can fall flat if your members ignore them. To drive engagement, you must deliver content through the right channels (mobile apps, email, account dashboards) and at key moments (e.g., during onboarding, after a suspicious transaction, or as part of regular digital hygiene checkups).

Cybersecurity is no longer the sole domain of IT teams hidden behind firewalls and data centers. It’s a shared responsibility—and, likely, a competitive differentiator in the future. By sharing cybersecurity policies and practices transparently, you can move from passive guardians to active partners in your members’ digital safety, lowering risk and strengthening relationship bonds.

The future of secure banking lies not only in advanced threat detection or regulatory compliance, but in how effectively you engage and empower your members. Succeeding in this effort can reduce fraud, earn trust, loyalty, and lasting brand value. So…

Because in cybersecurity, silence isn’t golden—it’s a missed opportunity.