Skip to content

BENCHMARKING REPORT · 2026 IT, cyber security and AI in SME financial services firms 2026

Is your firm doing IT right? It’s the question we hear most from directors, COOs and operations leads. So we set out to answer it.

This report combines results from our IT Maturity Scorecard with 598 calls and meetings with investment firms, wealth managers, asset managers and funding businesses. It sets what we found against guidance from the FCA, the ICO and the NCSC, with a section on DORA for firms with EU business. The result is a clear picture of where SME financial services firms are strong, where the gaps are, and what the best-run firms do differently.

 

What’s in the guide

  • How firms compare: average scores across seven areas of IT maturity, and why strategy and insight are the weakest.
  • What regulators expect in 2026 and 2027: the FCA’s incident and third-party reporting rules from March 2027, and where DORA applies.
  • Cyber readiness: why certification is becoming a condition of doing business, and how training and risk assessments affect a firm’s security score.
  • The outside view: what anyone, including an attacker, can see about your email and website security before they ever contact you.
  • The first 72 hours: who does what when an incident hits, from your IT provider to your accountable senior manager and data protection lead.
  • What the leaders do differently: how budgets, monthly staff training and certification separate the top-scoring firms from the rest.
  • AI in financial services: why existing rules already apply to AI, where firms are falling short, and six questions every board should be able to answer.
  • Ten actions for your next board meeting: a practical checklist you can take straight to the board.

Still have questions?

Speak to our team