--- title: "NopSec x Fitch: Understanding Cyber Exposure in U.S. Public Finance" description: Fitch Ratings and NopSec examine why credit deterioration after a cyber incident tends to come from how an organization responds rather than from the breach itself. --- [![nopsec\_primary\_logo-black](https://resources.nopsec.com/hs-fs/hubfs/Images/Logos/nopsec_primary_logo-black.png?width=215&height=78&name=nopsec_primary_logo-black.png) ![nopsec\_primary\_logo-black](https://resources.nopsec.com/hs-fs/hubfs/Images/Logos/nopsec_primary_logo-black.png?width=215&height=78&name=nopsec_primary_logo-black.png)](https://www.nopsec.com) [![nopsec\_primary\_logo-black](https://resources.nopsec.com/hs-fs/hubfs/Images/Logos/nopsec_primary_logo-black.png?width=215&height=78&name=nopsec_primary_logo-black.png)](https://www.nopsec.com) - [CTEM Platform](https://www.nopsec.com/platform/) - [Platform](https://www.nopsec.com/platform/) - [Aggregate](https://www.nopsec.com/discover/) - [Prioritize](https://www.nopsec.com/prioritize/) - [Operationalize](https://www.nopsec.com/remediate/) - [Validate](https://www.nopsec.com/simulate/) - [Insights](https://www.nopsec.com/measure/) - [Agentic AI Pen Test](https://www.nopsec.com/resources/adversarial-emulation/continuous-adversarial-emulation/) - [Services](https://www.nopsec.com/our-services/) - [Managed Vulnerability Management](https://www.nopsec.com/our-services/managed-vulnerability-management/) - [Penetration Testing](https://www.nopsec.com/our-services/penetration-testing/) - [JumpStart Program for Kenna Customers](https://www.nopsec.com/resources/jumpstart-program/nopsec-jumpstart-for-cisco-kenna-customers/) - [Resources](https://www.nopsec.com/resources/) - [Blog](https://www.nopsec.com/blog/) - [Webinars](https://www.nopsec.com/resources/#webinars) - [Case Studies](https://www.nopsec.com/resources/#case-studies) - [White Papers & eBooks](https://www.nopsec.com/resources/#whitepapers-ebooks) - [Data Sheets](https://www.nopsec.com/resources/#data-sheets) - [Just in Time Bulletins](https://www.nopsec.com/resources/#just-in-time) - [Knowledge Base](https://help.nopsec.com/hc/en-us?hsLang=en) - [CTEM Platform](https://www.nopsec.com/platform/) - [CTEM Platform](https://www.nopsec.com/platform/) - [Platform](https://www.nopsec.com/platform/) - [Aggregate](https://www.nopsec.com/discover/) - [Prioritize](https://www.nopsec.com/prioritize/) - [Operationalize](https://www.nopsec.com/remediate/) - [Validate](https://www.nopsec.com/simulate/) - [Insights](https://www.nopsec.com/measure/) - [Agentic AI Pen Test](https://www.nopsec.com/resources/adversarial-emulation/continuous-adversarial-emulation/) - [Services](https://www.nopsec.com/our-services/) - [Services](https://www.nopsec.com/our-services/) - [Managed Vulnerability Management](https://www.nopsec.com/our-services/managed-vulnerability-management/) - [Penetration Testing](https://www.nopsec.com/our-services/penetration-testing/) - [JumpStart Program for Kenna Customers](https://www.nopsec.com/resources/jumpstart-program/nopsec-jumpstart-for-cisco-kenna-customers/) - [Resources](https://www.nopsec.com/resources/) - [Resources](https://www.nopsec.com/resources/) - [Blog](https://www.nopsec.com/blog/) - [Webinars](https://www.nopsec.com/resources/#webinars) - [Case Studies](https://www.nopsec.com/resources/#case-studies) - [White Papers & eBooks](https://www.nopsec.com/resources/#whitepapers-ebooks) - [Data Sheets](https://www.nopsec.com/resources/#data-sheets) - [Just in Time Bulletins](https://www.nopsec.com/resources/#just-in-time) - [Knowledge Base](https://help.nopsec.com/hc/en-us?hsLang=en) [![Schedule a Demo Call to Action](https://no-cache.hubspot.com/cta/default/20334580/f214f44d-4d1d-4ca2-b138-3f8202de9650.png)](https://cta-redirect.hubspot.com/cta/redirect/20334580/f214f44d-4d1d-4ca2-b138-3f8202de9650) ###### NOPSEC X FITCH ## Understanding Cyber Exposure in U.S. Public Finance Webinar **Watch the full replay below**   # Credit Deterioration After a Cyber Incident Rarely Comes From the Breach. It Comes From the Response. Public finance entities get attacked constantly and most of them work through it without any effect on their rating. The ones that do not tend to have the same thing in common, and it is not the sophistication of the attacker. It is whether the organization had the preparedness, the plan, and the cash on hand to recover quickly. Meanwhile the threat landscape facing municipal entities keeps widening, and AI is compressing the timeline on nearly every part of it. In this session, Omid Rahmani, who leads the cyber risk practice for U.S. public finance at Fitch Ratings, and NopSec CTO Michelangelo Sidagni walk through the risks reshaping the municipal sector and what Fitch has actually observed in its rated portfolio. ## What You'll Learn **Why the municipal sector sits at the tip of the spear:** Omid explains the structural reasons, from budgets that cannot compete with the private sector for security talent to the public interfacing nature of the work itself, which creates headline exposure other sectors do not carry. He also breaks down which parts of public finance are furthest along and which are furthest behind, including why the water sector remains fragmented across roughly fifty thousand drinking water systems that each set their own risk appetite. **What nation-state activity against public infrastructure looks like now:** Omid distinguishes destruction-motivated activity from politically motivated activity and from ordinary financially motivated crime, since each has different goals and different implications. The discussion covers a breach at a large California water utility that reached the billing and records environment without touching industrial control systems, the wiper weapons the same actor group has been documented deploying elsewhere, and large-scale infiltration campaigns designed to establish latent access rather than steal anything immediately. Michelangelo adds why operational technology environments running end-of-life systems cannot simply be patched and have to be handled through network segregation instead. **Why vendor risk is now your risk:** A municipal entity may do business with hundreds of other organizations and allow dozens of vendors to connect into its network, and each of those connections is a way in. Michelangelo walks through how a well-known federal supply chain compromise worked, where the attacker went after a widely deployed software vendor rather than the eventual targets and injected malicious code into that vendor's development lifecycle. Omid makes the point that every organization sets its own risk appetite, and the effective ones extend that assessment to the defensive capability of everyone connected to them. **Two social engineering precedents the bond market should know:** Omid covers a township where a criminal actor impersonated officials convincingly enough to change wiring instructions for bond proceeds, with roughly eight million dollars never recovered, the voter-approved project stalled, and litigation that will shape how the industry handles cybercrime going forward. The second case involved a New Jersey school district and about 4.8 million dollars, close to nine percent of its budget. Most of that was not clawed back, and the district issued debt to return to normal operations, passing the cost to its tax base. Both were preventable with practices other entities in the sector already use. **Where AI actually changes the math, and where it is just noise:** Michelangelo separates real risk from vendor-driven fear, then gets specific. Language models make convincing phishing pretext trivial to produce, including messages written well enough to clear spam and anti-phishing filters, which lowers the skill floor for attackers considerably. They also accelerate vulnerability discovery, which puts pressure on every downstream step of triage, prioritization, and patching. He notes that this capability is not confined to the largest frontier systems. Smaller and cheaper models are already capable of chaining vulnerabilities into workable attack paths. **What Fitch has seen in its own portfolio:** Two cyber incidents have influenced downward rating changes, and both started as unremarkable ransomware. Omid explains that the deterioration did not happen at the point of attack. It happened in the response phase, where one entity could not deploy its resources effectively and that failure cascaded into a multi-notch downgrade. **Annual testing against continual validation:** An annual penetration test is a compliance exercise that captures a snapshot of posture on the day it is run. Michelangelo explains how agentic testing changes the cadence, letting organizations validate internal and external exposure repeatedly across the year rather than once. ## Watch the Full Session Omid's closing observation is worth sitting with. Across the sector, digital infrastructure still is not treated like physical infrastructure when it comes to capital planning and investment. Closing that gap is where the sector has the most room to improve. ![Customer Bar Small](https://resources.nopsec.com/hs-fs/hubfs/Images/Landing%20Page%20Images/Customer%20Bar%20Small.png?width=900&height=43&name=Customer%20Bar%20Small.png "Customer Bar Small") ## Schedule a Product Demo Today! See how NopSec's end-to-end Cyber Exposure Management platform can organize your security chaos. [![Schedule a Demo CTA](https://no-cache.hubspot.com/cta/default/20334580/7d649357-4eb4-428e-91ab-995954390400.png)](https://cta-redirect.hubspot.com/cta/redirect/20334580/7d649357-4eb4-428e-91ab-995954390400) ©2026 NopSec Copyright. All rights reserved. [Privacy Policy](https://www.nopsec.com/privacy/) ```json { "@context" : "https://schema.org", "@type" : "VideoObject", "contentUrl" : "https://20334580.fs1.hubspotusercontent-na1.net/hubfs/20334580/video_assets/218746451558/inherited/web_optimized.mp4", "dateModified" : "2026-08-05T13:36:11.903Z", "duration" : "PT55M31S", "height" : 720, "name" : "fitch-nopsec-1", "thumbnailUrl" : "https://resources.nopsec.com/hubfs/fitch-nopsec-1.mp4/medium.jpg", "uploadDate" : "2026-08-05T13:36:11.901Z", "width" : 1280 } ```