Mainframe Security
Every Terminal Emulator Is an Endpoint You Are Patching
By SDS • 7 min read • October 2026
Ask a mainframe team how many people can reach the system, and you will get a precise answer. RACF, ACF2, or Top Secret knows. The number is auditable, and somebody owns it.
Ask how many pieces of software can reach it, and the answer gets vague.
That second question is what the 2026 breach data keeps pointing to, and it is not really a mainframe question at all. It is a question about everything sitting between a user and the platform.
What the report measured
IBM and the Ponemon Institute’s 2026 Cost of a Data Breach Report studied 602 organizations across 17 industries and 16 countries. Alongside the headline figure of USD 4.99 million as the global average breach cost, the researchers analyzed 30 contributing factors and measured what each one added to or removed from that average.
Three of those factors describe the same problem from three angles.
Security system complexity added USD 208,265, the second largest cost amplifier in the entire study. The report’s own explanation is direct: complexity makes all security operations more difficult and more time-consuming.
Lack of visibility into the number and location of applications added USD 201,165. The report files this under shadow IT, but the mechanism is broader than unsanctioned SaaS. It’s about knowing what is installed and where.
Endpoint detection and response saved USD 177,710. Which is a useful number in the other direction: the endpoint is worth defending because that is where things happen.
None of these is about the mainframe’s own security model. The platform’s controls are genuinely strong. They also stop at the platform edge.
Where the attacks actually land
The 2026 report is clear about how breaches start, and it has been consistent for four years running.
Phishing was the top initial attack vector for the fourth consecutive year. Voice and SMS phishing was used in 17% of attacks and led to the highest average breach cost of any vector at USD 5.29 million. Social engineering, which the report defines to include IT and helpdesk impersonation and MFA fatigue, was used in 13% of attacks at USD 5.23 million. Abusing valid accounts averaged USD 5.07 million and took 243 days to identify and contain.
Every one of those starts with a person at a desk. None of them starts on z/OS.
So the useful exercise during Cybersecurity Awareness Month is not hardening the mainframe further. It is counting what stands between a person and the mainframe, and asking who is responsible for keeping each of those things current.
The emulator nobody counts
A TN3270 emulator is software. It gets installed on a desktop. It has versions, patches, a vendor, a license, a support path, and a configuration that somebody set up once and may not have revisited.
Multiply that by the number of desktops that need mainframe access. Then add the ones on laptops that leave the building.
A few questions worth asking your own team this month:
- How many desktops have a 3270 emulator installed? Not how many users have mainframe access. How many machines carry the software?
- What version are they on, and when was the last update pushed? If the answer involves a spreadsheet, that is the finding.
- Do any of them depend on a Java runtime or an HLLAPI layer? Those have their own patch cadence and history.
- When somebody leaves, what removes the emulator from their machine?
- Can you produce that list for an auditor today?
If those answers are hard to assemble, that is the lack-of-visibility factor the report priced at USD 201,165. It is not a hypothetical. It is an inventory problem with a measured cost.
What changes when the browser is the client
This is where Virtel Web Access differs structurally from a better emulator.
Virtel Web Access serves 3270 screens as HTML web pages to plugin-free web browsers. SDS puts it plainly: it doesn’t rely on distributed (typically Java or HLLAPI) clients or plugins, and nothing needs to be installed or supported outside the mainframe. The web browser is the 3270 TE client. Deployment is pointing a browser at a predefined URL.
The security consequences follow from that, and they are worth stating carefully because each one results from removing software rather than adding a control.
No desktop emulator exists to inventory, patch, or remove. The item on the list is no longer on the list. That is the complexity and visibility argument, and it is the whole point.
The connection is encrypted. Virtel Web Access serves 3270 screens over FIPS 140-2 compliant HTTPS connections. In a year where 53% of breached organizations were not encrypting sensitive data at rest and in motion, a transport that is encrypted by default rather than by configuration is worth something.
Access controls attach at the access layer. Virtel Web Access integrates with any IP security technology, including SSO, proxy servers, and multi-factor authentication services. That matters because the report found identity and access management was the second-largest cost reducer in the study at USD 225,622, and excessive privileges and poor role management added USD 177,313. Putting MFA in front of a 3270 session without changing the application is a practical way to act on that.
The host keeps control. SDS says the host retains full control of access to its own assets. Access decisions stay where the audit trail already is.
Users get the interface they already know. TN3270 users get the same 3270 terminal ergonomics they know. This matters more than it sounds. Security changes that require retraining tend to get deferred, and deferred changes are the ones that are still open at the next audit.
And because the browser is the client, access works with any web-enabled device, from traditional Windows PC workstations to Apple, Android, or Chrome mobile devices.
What this does not do
Worth being straight about the boundaries, because overselling a security control is its own risk.
Removing the desktop emulator removes software from the endpoint. It does not harden the endpoint itself; it does not stop a user from being phished, and it does not by itself prevent data from being copied out of a session. A browser is still a browser.
What it does is take one item off the list of things with a path to your mainframe, replace it with an encrypted transport, and give you a place to attach MFA. In a study, complexity and an unknown application footprint together account for more than USD 400,000 in added breach costs, so removing an item from the list is no small move.
Where to start
If this is worth an hour of your October:
- Count the emulator installs. Get an actual number.
- Check what they depend on. Java runtimes and HLLAPI layers carry their own exposure.
- Ask whether MFA sits in front of mainframe sessions today. If not, ask what would have to change for it to.
- Compare the annual cost of licensing, patching, and supporting distributed emulators against browser-based access.
The first number usually starts the conversation, because almost nobody has it on hand.
Source: IBM and Ponemon Institute, “Cost of a Data Breach Report 2026: The AI Tipping Point.” Findings referenced above appear on pages 15, 21, 23, 25, 50 and 66. Figures are global averages across the study population and are not specific to any platform, product, or organization. Virtel Web Access capabilities as described on sdsusa.com.
Free Demo/Trial
We offer individualized product demonstrations by request. Your organization can also try SDS Software on your system for 30 days, free of charge.
Phone: (800) 443-6183
Phone: (763) 571-9000
200 Village Center Drive, Suite 250
North Oaks, MN 55127
USA
