Third-party and administrator vulnerabilities are among the biggest cyber risks facing defined benefit (DB) pension schemes, analysis from Howden Retirement has shown.

The firm’s Retirement Runway research, which surveyed 50 professional trustees of DB schemes, found that 70 per cent identified third-party or administrator vulnerabilities as a key cyber risk, while 50 per cent highlighted the protection and security of member data.

The findings also suggested that cyber preparedness remains uneven across schemes.

Seven in 10 trustees said they regularly assess third-party or administrator cyber risk, while 60 per cent have board-level reporting and clear responsibilities in place for cyber incidents.

However, fewer than half (44 per cent) regularly test their incident response plans through simulations, despite 38 per cent identifying incident response and recovery capabilities as a notable concern.

Meanwhile, the research also highlighted concerns around preparedness for pensions dashboards.

While more than three-quarters (78 per cent) of trustees said they were on track to meet the 2026 pensions dashboards deadline, 16 per cent warned they could struggle to do so.

Howden Retirement managing director, Alex Pocock, said: “As schemes approach the pensions dashboard deadline, the preparation involved will inevitably shine a light on where vulnerabilities are still present, and cybersecurity is clearly one of these areas.

“While third-party cyber risk is already being regularly assessed by trustees, it still stands out as one of their greatest concerns.

“This is perhaps understandable given schemes are relying on external providers for increasingly critical parts of their operations.”

Pocock added that cyber resilience required schemes to go beyond identifying risks and ensure both their own operations and third-party providers were prepared to respond effectively to incidents.

“Trustees need confidence that both their own scheme and the providers they rely on are ready to respond when something goes wrong,” he concluded.

“This will be particularly vital as protecting member data and minimising disruption comes into sharper focus ahead of the pensions dashboard deadline.”

---