A credit union’s playbook for proving security effectiveness

44% of financial services ransomware victims were breached through security gaps they did not know existed, according to Sophos 2025.

For credit unions, this is a critical warning. They face the same ransomware, identity, and control failure risks as large banks, but with leaner teams and rising pressure from NCUA examiners to prove that security controls actually work.

In this on-demand fireside chat, Greg Schaffer, a veteran security executive with extensive experience as a CISO and advisor to financial institutions, joins Picus Security CEO Alper Memis to discuss why credit unions are moving from assumed protection to validated evidence.

Watch this session to learn:

• Why unknown security gaps continue to expose financial institutions
• Why credit unions need evidence of control effectiveness
• How NCUA expectations are changing security validation requirements
• How lean teams can start validating defenses without adding complexity