XML 54 R40.htm IDEA: XBRL DOCUMENT
v3.25.4

Cybersecurity Risk Management and Strategy Disclosure | 12 Months Ended
--- | ---
Dec. 31, 2025
Cybersecurity Risk Management, Strategy, and Governance [Line Items] |
Cybersecurity Risk Management Processes for Assessing, Identifying, and Managing Threats [Text Block] | Our Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness. A summary of our processes involved in evaluating the effectiveness of information and cybersecurity controls is below. Risk Assessment Process. On an annual basis, a risk assessment and maturity analysis is performed for the FNB environment based on various frameworks such as CRI 2.0. FFIEC, CIS and NIST CSF. The risk assessment takes into consideration a combination of risks related to the identification, prevention, detection, response, and recovery from cyber events. The risk assessment considers the inherent risk and controls implemented in the FNB environment and measures the residual risk to ensure it is within the FNB risk tolerance. Vulnerability Management Process. Regular internal and external vulnerability scanning is conducted at varying intervals to proactively identify configuration weaknesses, missing patches and other vulnerabilities in the FNB information systems environment. Identified vulnerabilities are classified and scored based on their Common Vulnerability Scoring System, known exploitation or malware impacting the vulnerability, and the age of the vulnerability in the environment. We prioritize the patching and remediation of critical and severe vulnerabilities. We also evaluate the effectiveness of our Security Awareness Program, including results from simulated phishing exercises, to measure user susceptibility and identify areas requiring enhanced training and control focus. Threat Management Process. In addition to regular and routine vulnerability scanning, we rely on various threat intelligence feeds for the identification and awareness of potential threats that could impact the FNB environment. With the assistance of third-party vendors, threats are integrated into our monitoring solutions, email filtering, web-browsing controls, malware detection, and perimeter firewalls to proactively prevent, detect and deter threats with the capability to impact the FNB environment. Independent Penetration Testing. On an annual basis, we engage with an independent third-party provider to perform various penetration tests of the environment. The penetration tests review our customer-facing applications, our response to social engineering activities, overall external attack surface and internal vulnerabilities. Penetration test issues are prioritized by risk level and subject to ongoing tracking and escalation to ensure that remediation efforts are completed effectively and verified before closure. Security Architecture. To ensure the secure configuration, design, and implementation of our internally hosted and third-party hosted systems, security architecture reviews are conducted. Architecture reviews involve asking a structured set of questions and collecting the required documentation for any proposed system changes or new implementations. The responses and materials are then reviewed collaboratively with internal IT teams and relevant third-party vendors to confirm that the design aligns with policy requirements, follows strong security practices and implements appropriate access controls. Access Management. Utilizing a least privilege, need-to-know access methodology, access is controlled through a centralized user access management function responsible for the provisioning, transfer and deprovisioning of users’ access. Access management also performs routine reviews of application and systems access to ensure access remains appropriate. For third-party hosted environments, access management works with security architecture to ensure single sign-on controls are employed or additional factors are utilized to prevent unauthorized access to these environments. Network Security Management. The security of the FNB network infrastructure is maintained via: •internal and perimeter firewalls with intrusion detection, •the use of some network segmentation to isolate access to certain applications and systems, •VLANs or virtual local area networks, •email filtering to identify spam, malware, and phishing messages in received email messages, •malware detection, •data loss prevention controls to prevent the theft, or mass exfiltration of data, •Virtual Private Networks to control remote access to our network, •intrusion detection capabilities, •network access controls to prevent unauthorized assets from connecting to the network, and •web filtering. Security Event Monitoring. A centralized security monitoring team is responsible for the response to alerts generated from a consolidated log collection system. Log collection occurs from various assets and hosted environments. The monitoring tool is third-party provided SIEM, and enables threat identification, detects suspicious activity in the environment using the MITRE Att&ck® framework, performs user behavior analytics, and endpoint detection and response. Alerts are investigated to ascertain whether a cyber incident is occurring or not. Security Awareness. Annual security training is conducted for all employees, and routine phishing tests are administered routinely. We also post articles regarding common cybersecurity schemes on our intranet for our employees’ awareness. We have a Third-Party Risk Management department that established policies and procedures to follow when utilizing third-party vendors and ensures that key risk components are mitigated based on our standards. Third-party vendors are thoroughly vetted, approved and inventoried before partnership begins. To date, we have not experienced cybersecurity incidents that have materially affected our business strategy, results of operations or financial condition. For additional information regarding cybersecurity threats, see Item 1 of this Report, “Business – Cybersecurity” and Item 1A of this Report, “Risk Factors—5. Operational Risk—An interruption in or breach in security of our information systems, or other cybersecurity risks, could result in a loss of customer business, increased compliance and remediation costs, civil litigation or governmental regulatory action, and have an adverse effect on our results of operations, financial condition and cash flows.”
Cybersecurity Risk Management Processes Integrated [Flag] | true
Cybersecurity Risk Management Processes Integrated [Text Block] | Our Information Security Department uses the National Institute of Standards and Technology framework for improving critical infrastructure by measuring and evaluating the effectiveness of information and cybersecurity controls. We have various processes for risk assessment, vulnerability management, threat management, independent penetration testing, security architecture, access management, network security management, security event monitoring and security awareness.
Cybersecurity Risk Management Third Party Engaged [Flag] | true
Cybersecurity Risk Third Party Oversight and Identification Processes [Flag] | true
Cybersecurity Risk Materially Affected or Reasonably Likely to Materially Affect Registrant [Flag] | false
Cybersecurity Risk Board of Directors Oversight [Text Block] | The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. An Information Technology (IT) and Information Security Risk Assessment is conducted to identify further opportunities for improvement and are presented to Enterprise Risk Management and the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. In addition, the Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership, ensuring direct involvement by our management in assessing and managing cybersecurity risk.
Cybersecurity Risk Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. In addition, the Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership, ensuring direct involvement by our management in assessing and managing cybersecurity risk.
Cybersecurity Risk Process for Informing Board Committee or Subcommittee Responsible for Oversight [Text Block] | The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. An Information Technology (IT) and Information Security Risk Assessment is conducted to identify further opportunities for improvement and are presented to Enterprise Risk Management and the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. In addition, the Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership, ensuring direct involvement by our management in assessing and managing cybersecurity risk.
Cybersecurity Risk Role of Management [Text Block] | The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis. An Information Technology (IT) and Information Security Risk Assessment is conducted to identify further opportunities for improvement and are presented to Enterprise Risk Management and the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto. In addition, the Chief Risk Officer regularly reports to our Risk Management Council, which is comprised of our senior leadership, ensuring direct involvement by our management in assessing and managing cybersecurity risk.
Cybersecurity Risk Management Positions or Committees Responsible [Flag] | true
Cybersecurity Risk Management Positions or Committees Responsible [Text Block] | The Information Security Department reports to the Chief Information Security Officer (CISO) and then directly to the Chief Risk Officer, to ensure the coordinated and consistent implementation of risk management initiatives and strategies on a day-to-day basis.
Cybersecurity Risk Management Expertise of Management Responsible [Text Block] | We believe our management has the appropriate expertise, background and depth of experience to manage risks arising from cybersecurity threats including applicable knowledge gained through industry experience, education, ongoing internal and external training and regular discussions with consultants and peers with applicable knowledge and expertise. See the following details of certain cybersecurity personnel. The CISO has served FNB since 2016, and has a career over 25 years in information technology, enterprise risk and information security controls. The CISO is a Certified Information Systems Security Professional (CISSP), has a Bachelor’s degree in Criminal Justice with a minor in Computer Science and is supported by several managers including the following: •Director of Information Technology Risk and Compliance - CISSP with over 20 years of Information Technology, Data Center and Security Engineering experience. •Manager of Cyber Security - CISSP with over 20 years of Information Technology and Systems Engineering experience. •Manager of Security Architecture - CISSP with over 20 years of experience in Information Technology networking, network security and security engineering. •Manager of Security Access Management - A+, Network+ and Server+ certifications with over 20 years experience in Information Technology and Systems Administration. The CISO chairs an Information Security Committee made up of other risk professionals, Information Technology and line of business leaders to maintain an understanding and balance between security and business functionality.
Cybersecurity Risk Process for Informing Management or Committees Responsible [Text Block] | the Board Risk Committee. The Board Risk Committee is primarily responsible for overseeing risk management, including risks associated with cybersecurity and potential threats thereto.
Cybersecurity Risk Management Positions or Committees Responsible Report to Board [Flag] | true

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskBoardOfDirectorsOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementExpertiseOfManagementResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleReportToBoardFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementPositionsOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskManagementProcessesForAssessingIdentifyingAndManagingThreatsTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph i Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph i + Details
Name: | cyd_CybersecurityRiskManagementProcessesIntegratedTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K + Details
Name: | cyd_CybersecurityRiskManagementStrategyAndGovernanceLineItems
Namespace Prefix: | cyd_
Data Type: | i:stringItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskManagementThirdPartyEngagedFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskMateriallyAffectedOrReasonablyLikelyToMateriallyAffectRegistrantFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 1 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 1 + Details
Name: | cyd_CybersecurityRiskProcessForInformingBoardCommitteeOrSubcommitteeResponsibleForOversightTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 -Subparagraph ii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 -Subparagraph ii + Details
Name: | cyd_CybersecurityRiskProcessForInformingManagementOrCommitteesResponsibleTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection c -Paragraph 2 Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection c -Paragraph 2 + Details
Name: | cyd_CybersecurityRiskRoleOfManagementTextBlock
Namespace Prefix: | cyd_
Data Type: | dtr-types:textBlockItemType
Balance Type: | na
Period Type: | duration

X
- References Reference 1: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Regulation S-K -Section 106 -Subsection b -Paragraph 1 -Subparagraph iii Reference 2: http://www.xbrl.org/2003/role/presentationRef -Publisher SEC -Name Form 20-F -Section 16K -Subsection b -Paragraph 1 -Subparagraph iii + Details
Name: | cyd_CybersecurityRiskThirdPartyOversightAndIdentificationProcessesFlag
Namespace Prefix: | cyd_
Data Type: | i:booleanItemType
Balance Type: | na
Period Type: | duration