Cybersecurity and progress don’t have to be at odds. Yet for many credit unions, Security and Compliance can feel like hurdles to clear before moving forward with a new technology, partnership, or initiative.
But what if they were viewed differently?
At MDT, Joseph Pelukas, Vice President of Security & Compliance, believes Security and Compliance can play a very different role: as strategic business enablers—not obstacles to progress.
He notes that when Security and Compliance are involved from the start, the focus can shift from saying “no” to finding the safest way to say “yes.” That lets leaders weigh risks, explore options, and move promising initiatives forward responsibly—while strengthening trust with members, partners, and prospective customers.
That perspective is particularly important as cyber threats become more sophisticated and technology environments more complex. And becoming more secure does not necessarily mean buying another tool or trying to defend against every conceivable attack. Instead, credit unions can focus on something more practical: becoming a harder target.
Start With What Matters Most
“You can’t eliminate every single cyber risk, but you can make your credit union a harder target,” adds Jason Sharabani, Senior Manager of Internal Audit & Compliance at MDT.
That starts with understanding the environment. Credit unions need to know which systems, data, and other assets are most critical; who has access to them; how information moves; and where third parties connect.
From there, familiar cybersecurity fundamentals come into sharper focus: keeping systems patched and supported, regularly reviewing access, controlling administrative privileges, and ensuring protections are actually working—not simply documented.
The goal is not to create roadblocks, but to put the right protections in place for the level of risk—without unnecessarily limiting employees or slowing the credit union’s progress.
AI Raises the Stakes
AI is also rewriting some of the familiar rules of cybersecurity.
Remember when misspellings, awkward phrasing, and broken English were telltale signs of a phishing attempt? AI can eliminate many of those clues, helping cybercriminals create polished, convincing messages in seconds. And the concern goes beyond better-written phishing emails. Montana Arble, Senior Security Architect at MDT, says AI can dramatically lower the technical expertise needed to act maliciously, putting increasingly sophisticated capabilities within reach of more bad actors.
But AI is a double-edged sword.
Security teams can use it to process information, monitor activity, and automate repetitive tasks, freeing employees to focus on higher-value work and rapidly evolving threats.
“Organizations need to start leveraging AI to help automate the low-value tasks—the day-to-day minutiae that takes up their time and their ability to respond to these rapidly evolving attacks,” Arble says.
Bottom line? “We need AI to defeat AI.”
Make Security Practical
Even the best security technology can’t account for every decision an employee makes. That’s why people remain such an important part of a credit union’s defense.
But building a cybersecure culture takes more than annual training and reminders about what not to do. Employees need to understand what’s expected—and feel comfortable speaking up when something doesn’t look right or when they make a mistake.
Sharabani stresses that security also needs to be approachable. Technical jargon and overly complicated explanations can make cybersecurity feel intimidating or disconnected from employees’ everyday responsibilities. Instead, training should translate security into practical behaviors people can recognize and use.
Clicked something suspicious? Report it quickly. Received an unusual request? Don’t rely on appearances—verify it through a trusted channel. Something simply doesn’t feel right? Speak up.
Sometimes, one of the strongest cybersecurity controls is also one of the simplest: pause, verify, then act.
Make Sure the Controls Work
Having the right security controls in place is important. Knowing they actually work is even more important.
Consider multifactor authentication. It provides limited protection if critical accounts—such as privileged administrative accounts—fall outside its scope. The same goes for technology packed with security capabilities that are never properly configured, enabled, tested, or maintained. And an incident-response plan? Having one is only the beginning. The real test is whether the credit union can execute it when an incident occurs.
Instead of simply asking, Do we have the control? leaders should take the next step: Is it working? Is it addressing the risk we intended it to address?
Those questions can also lead to smarter technology investments. Before adding another security product, consider the risk you’re trying to solve. Could existing capabilities address it? Does the credit union have the expertise and resources to implement, test, and maintain something new? And how will you know the investment is actually reducing risk?
A Harder Target, Not an Impenetrable One
Cybersecurity does not have to mean eliminating every risk—or slowing the organization down in pursuit of perfect security.
That means understanding what matters most, focusing resources on priority risks, and making sure essential protections work. When Security and Compliance are part of business decisions from the beginning, they can help the organization evaluate tradeoffs and find a responsible path forward.
That is what makes cybersecurity a business enabler: it helps credit unions manage risk while continuing to innovate, grow, and serve their members with confidence.
MDT works alongside credit unions to bring technology, Security and Compliance expertise together to help identify risk, evaluate controls, and support informed decision-making.
Want to take a deeper look at how your credit union can become a harder target? Download MDT’s new white paper, Making Your Credit Union a Harder Target: A Practical Approach to Cybersecurity in an Evolving Threat Landscape.