There are significant gaps in the key protections firms use to safeguard sensitive financial and client data.