Fed cybersecurity report says its information security program was rated not effective

The Federal Reserve's new cybersecurity report says a 2025 inspector general assessment rated the Board's information security program "not effective," at level 3 on a five-level maturity scale. Level 4 is the threshold considered effective.

The Board attributes the weakness primarily to governance rather than to technical controls. It says multiple third-party assessments reached the same conclusion, while maturity scores in the other security domains either rose or held steady. A new information security operating model is being put in place.

Nothing here describes a breach.

The report says federal banking agencies have not observed material effects on the financial sector from the heightened threat environment. It does, however, add frontier artificial intelligence to the risk list: new models can find previously unknown vulnerabilities, devise methods to exploit them and connect several flaws into an attack that runs at machine speed.

Geopolitical tensions, cybercrime, outside technology providers and the future risk to encryption from quantum computing make up the rest of the report's emerging-threat section.