About 12 years ago, hackers tried to take down Flushing Bank’s website.

It was a denial-of-service attack, in which cybercriminals attempt to overwhelm a website and render it unusable, often in search of financial gain and to the detriment of a business’s reputation — in this case, Flushing’s.

Flushing, though, had techniques in place to thwart the attack.

But “it brought home to us the necessity of really being on top of this aspect of the business,” President and CEO John Buran said.

It’s a lesson the bank took to heart. In March, Flushing ranked No. 1 on Forbes Most Cybersecure Banks list.

“We've been very cautious about talking about that, quite frankly. We don't want to be a target,” Buran said.

Forbes developed the list in partnership with research company SecurityScorecard, which rates banks on factors including breaches, vulnerabilities, the speed of applying patches, regulation compliance, and hacker chatter about possible next targets. Forbes said its list goes a step further, judging by factors including the presence of a chief information security officer and a cybersecurity professional on a bank’s board of directors.

Though Buran wasn’t told exactly what put Flushing above the other contenders — and Forbes’s list desk didn’t return a request from Banking Dive for more insight — he credits Chief Information Officer Allen Brewer and Chief Information Security Officer Rick White for running a tight ship.

“We have invested a lot in keeping the business secure from a technology perspective,” Buran said “Chief among those is something that I would call low tech, and that’s getting our people to be very cognizant of the suspicious emails, because one of the quickest areas for malware to be deposited into your system is clicking on a bad link. Getting those 500 people in our business to be cognizant of those risks is something that we monitor on a very, very regular basis.”

Flushing’s cybersecurity team pushes out phony phishing emails to staff, and when someone clicks on those emails, “we have a conversation with people,” Buran said. “That's the kind of stuff that has enabled us to stay in very good shape with respect to technology and what we think is a very good, secure infrastructure.”

Flushing also takes a low-risk approach in other aspects of the business, Buran said.

“One of the things that has kept us in good stead over the years is that we have really grown at a very measured pace,” he said, noting the bank’s compound annual growth rate in assets and deposits is 9% since 1995. Its loan portfolio CAGR for the same period is 12%.

“It's very, very easy to lose control with rapid growth, and I think that that's one of the things that has become more of a concern for banks lately,” the CEO said.

The degree of growth available to banks has “enhanced” in recent years, Buran said. And so, too, has the potential for banks to run into capital and liquidity problems by growing too much too fast. Banks need to know when — and how — to pump the brakes, he contends.

“What you do is you adopt a pricing strategy or a credit selection strategy that causes you to reduce the growth trajectory that you’re on,” he said.

In the current rate environment, it’s easy not to grow too quickly, he said, because customers are more reluctant to borrow now versus when interest rates are lower.

But “interest rates change on a continuous basis, and as we go through these cycles it’s important to be very cognizant [that] if you book all of your business in the 3% loan category, and your cost of deposits wind up growing more quickly as interest rates rise, you get into a margin squeeze.

“Fortunately, we've kept to loans that have five-year resets, for the most part, so over time, those five-year resets will take place and eventually catch up,” Buran said. “It's another example of how rapid change within market dynamics can have a negative effect on your business.”

Running a strong business comes down to the customer feeling safe, Buran said. It’s what keeps them coming back.

“I think it's that type of very basic approach to customer development — making them feel comfortable, understanding their needs,” he said.

Case in point: In January 2022, Flushing said it was launching bitcoin services with crypto custody and investment management firm NYDIG. The crypto market was performing well at the time, and it would be months before the dominoes — the myriad crypto firms that would be bankrupt by year’s end — began to fall.

Within six months, Flushing backed out of the partnership.

“It was a pilot, and we decided at the end of the pilot that it really wasn’t the right thing for us,” Buran said.

“The volatility of bitcoin, and the appropriateness for our customers” spurred the breakup, he said. “Being conservative, we certainly don't want to put our customers in any situation where they may be exposed to excessive risk and may not be understanding that excessive risk.”