PTLog inRequest access
Menu
Sector · Finance

Banking secrecy does not expire when the contract ends.

A financial institution holds data that must remain secret for terms longer than the useful life of any technology protecting it today. That distance between the secrecy term and the cryptography term is what defines the sector's HNDL exposure, not the quality of its current configuration.

Sector median · Finance66.3High
7,574companies
62.2–68.2Half of the cohort between p25 and p75
The comparison available

The middle half of the finance cohort sits in a narrow range: most organizations fall in the same risk band, and the distance between median and third quartile is small.

That carries an uncomfortable practical consequence: sitting at the sector median distinguishes no one, and moving off it requires structural change, not a configuration tweak.The aggregates describe the cohort on the date the ruler was generated, with an anonymity floor. No organization is identifiable in them, and individual position requires its own assessment.

Cohort distribution by band

  • High80.0%
  • Moderate3.4%
  • Minimal16.6%
Data shelf life

Credit records, contracts, customer data, and transaction history retain value for long periods.

Traffic captured today and decrypted later would still reveal sensitive information. That is the operational definition of HNDL risk.

Data the sector keeps for a long time

  1. Customer and relationship data, with persistent value.
  2. Contracts and collateral with multi-year terms.
  3. Transaction history used in models and disputes.
  4. Internal communication about structured deals.
What distinguishes the sector

Finance combines long retention obligations, hard-to-replace core systems, and a dense third-party chain: processors, bureaus, correspondents, and integrations all running on the same cryptography.

The sector's HNDL context. The relevant threat here does not require a quantum computer today: it requires someone to store traffic today and decrypt it when the capability exists. In a sector whose data stays sensitive for many years, the window between capture and break fits comfortably inside the period where secrecy still matters.
  1. Regulatory retention measured in years, not product cycles.
  2. Core systems with cryptography embedded in old layers.
  3. A volume of external integrations that widen the negotiated surface.
  4. Continuity requirements that restrict change windows.

Typical dependencies

  • Processors and acquirers in the payment mesh.
  • Infrastructure and hosting providers for digital channels.
  • Certificate authorities used on exposed channels.
  • Core banking and regulatory module vendors.

What applies

In a sector with a dense chain and meaningful peer comparison, the three capabilities below are the ones that produce decisions.

01Exposure ReportIndividual readout from public signals, no integration.In production
02Sector BenchmarkPosition against the finance cohort, with percentile and band.In production
03Third-party assessmentRanking the supplier portfolio by observable exposure.In production

See a sample report →

See the limits of this reading and what it is measured against

The limits of this readout

  • IEQ does not assert compliance with any sector standard or regulatory requirement.
  • Public collection does not reach core systems with no external face, which is where part of the legacy lives.
  • Sector medians authorize no conclusion about a specific institution.
  • The ruler is a static reference base, with no automatic update between runs.

Boundary

Measurement ends at the technical change in the environment. Measuring exposure does not reduce it: reduction requires changing configuration, replacing certificates, switching negotiation policy, or migrating libraries. That work is carried out by the organization's own teams and suppliers. After the change, GWK re-collects public signals and recalculates IEQ on the same ruler, when contracted to do so.

Why measuring does not reduce exposure

What this comparison is measured against

Ruler generated
October 7, 2026
Population
80,182 companies
Sectors
15 sectors in the engine taxonomy
Anonymity floor
K = 30

Limits of the comparison

  • The ruler is a static reference base, not a continuous measurement: there is no automatic update between one run and the next.
  • Comparison is always against anonymous aggregates, never against another organization's individual result.
  • A public-mode result does not compare to a complete-mode result, because the two readings start from different kinds of evidence.

Start from your position

A public-signal readout requires no integration or change window, and already shows where the institution sits within the sector cohort.

Discuss an assessmentSee a sample report →