Progress And Frustration With IBM i Security, Fortra Finds

June 8, 2026 Alex Woodie

Thanks to tougher default configurations by IBM and general awareness, the state of IBM i security has improved somewhat, Fortra says in the 2026 installment of the State of IBM i Security report. But other aspects of security show little to no improvement, leading to frustration among the company’s IBM i security experts.

For its 23rd annual State of IBM i Security report, Fortra analyzed the security configurations of 163 IBM i server partitions. The anonymous real world data came from Fortra customers and prospects who either agreed to allow the company perform a security scan on their IBM i system or who contracted with Forta for some security work.

While the data for the State of IBM i Security reports comes from different and random systems every year, one can still draw some broad conclusions about the overall state of security, which is what Fortra did. “For the third year in a row, the results of this study indicate an overall improved security posture across the pool of participants,” the company states in the study.

One of the highlights of the report is that 87 percent of systems are running at QSECURITY level 40. Since it delivered IBM i 7.5, IBM has shipped IBM i servers with security level 40 enabled, as there is a documented security vulnerability in level 30. IBM also restricted the use of security level 20 to only in-place upgrades, and removed the capability to move back to it.

You can access Fortra’s 2026 State of IBM i Security report and the Fortra webinar by clicking the image above.

Amy Williams, a principal security services consultant with Fortra, applauded the news. “I think we’ve seen IBM start to take a heavier hand with the security of the system out of the box,” she said during a Fortra webinar on the security report. “So is not as much up to the customer as it was previously, which I think is a really positive note and is setting that tone going forward.”

However, not everything is hunky dory on the world’s IBM i servers, particularly when it comes to passwords. While Fortra has seen progress made over the past few years, there was a decided drop off this year, especially with the number of default passwords in use.

Fortra found that 10 percent of systems had default passwords, up from 8 percent in the 2025 study, while 31 percent had more than 30 user profiles with default passwords, which was down from 36 percent last year. However, it also found 49 systems with 1,000 or more profiles with default passwords, and one with more than 11,000 user profiles with default passwords, 80 percent of which were enabled.

IBM has given administrators the power to set and enforce tougher password rules, and some of them are taking advantage of it. For instance, 32 percent of the systems checked by Fortra had minimum password lengths of 12 characters, which meets PCI DSS 4.0 requirements. However, the most popular minimum password length was eight characters, which meets less stringent NIST requirements and is borderline acceptable, while 19 percent had a minimum password length of six characters, which meets nobody’s standard. Five systems enforced passwords with just a single character, up from a single system last year.

Sandy Moore, Fortra’s principal solutions engineer, expressed frustration that real progress could be made in one aspect of passwords while customers went backwards in another.

“Even with that big increase, we saw with the with this year’s data on the password rules usage, we saw the biggest number of systems where they were using a default password for their profiles,” Moore said. “This is something that, without a doubt, is one of the easiest things to remediate. And probably one of the first things that should be done, and one of your biggest risks for credentials on the system.”

It was a mixed bag when it comes to special authorities, which is a perpetual source of heartburn for security folks. The good news is that only 8 percent of users had *ALLOBJ authority, which is down from 11 percent last year. That continues a multi-year trend, Moore said.

User of *ALLOBJ authority has decreased over time.

“About six years ago, we had a huge spike. Everybody was given *ALLOBJ. Nobody knew what to do,” she said. “We quickly saw that correct in 2023, and we’ve kind of seen that ebb and flow I would say in the next few years. I’m going to give a little bit of credit to IBM because they’ve put a new highlight on how those profiles are being created on those systems out of the box.

The bad news is that the use other special authorities went up. The average system had 889 users with *JOBCTL and 649 users with *SAVSYS authority, both of which are up significantly from 2025.

“*JOBCTL and *SAVSYS are winning the race, which is just terrible,” Williams said. “People don’t realize that *JOBCTL can end your system. It’s still dangerous. It shouldn’t just be handed out to everybody. There are other ways to be able to ensure that users can do what they need to do.”

A lot more attention is being paid to *AUDIT and *SECADM, which is good, Williams said. “But nobody except the admins and maybe your IBM CE, if you’ve still got one of those that comes around, should have that *SERVICE special authority.”

Admins should be the only ones with special authorities, and even then, they should only have access to them part of the time, Williams said.

“Think about doing temporary elevations, giving them administrative profile that they have to check out, and then having an everyday profile that they use for just the daily tasks,” she said. “You will find the more you take these away, the fewer and fewer users actually end up requiring those special authorities.”

The percentage of IBM i shops using these recommended settings for recovery of objects has improved, Fortra said.

Fortra’s report found that 73 percent of systems had exit programs in place over exit points, which enable outside access to the IBM i server via network protocols like FTP, ODBC, and TCP/IP. That’s up from 58 percent last year and up from 35 percent in 2024. The number of systems with full coverage of the 27 most popular network exit points has also gone up considerably. Fortra found 31 percent had the full gamut of exit programs in place this year, compared to 28 percent last year and just 7 percent in 2024.

Of course, the devil is in the details. And in the case of exit programs, the devil may be exploiting the lack of precision to compromise your IBM i server.

“For this last year, we saw about the same amount of systems with that full exit program coverage. But what concerns me is that it’s not always configured properly,” Moore said. “You want to make sure that that exit program is doing the right thing, that it’s monitoring access and determining if someone should be accessing the system, and then sometimes even restricting what that person can do based on which access point they’re coming through.”

Use of the built-in security audit journal is nearly ubiquitous, with 96 percent of systems enabling turning it on, which was up one percentage point from last year. That’s the good news, because having the audit journal turned on is one of the easiest ways that IBM i users can protect themselves.

“The power of the audit journal is that it is a built in security log for IBM i,” Williams said. “You don’t have to buy extra tools. You don’t have to buy extra software. It is built in to log everything and anything that happens on your IBM i. It is absolutely the tool used in a forensic analysis. If anything does happen on your IBM i, when you want to know who deleted that library or deleted that program that you swore was there yesterday, this is how you’re going to find that information out.”

The problem with the audit journal is that actually analyzing the information can be a challenge, requiring staff with specialized skills or the purchase of special software to decipher the data. But that’s something that can be acquired on an as-needed basis. Without the actual data from the audit journal, the odds of tracing how an unauthorized user traversed your system is somewhere between “slim” and “none.”

The percentage of IBM i shops scanning for viruses on open has increased.

Virus scanning is another mixed bag. Fortra found that 54 percent of systems are set to scan files in real time when they’re opened, which is the recommended way to use antivirus on IBM i (the other method being batch scans). That’s down from the 62 percent that were scanning on-open last year, but it’s still a solid increase from 2024, when only 41 percent were doing that.

Configuring your system to can for viruses on-open is good, Moore said, but it’s also important to have an actual anti-virus engine installed. “We saw some gaps where the system values were set for virus scanning, but there’s no actual program in place to do the scanning,” she said. “That’s kind of like turning on the light switch, but not putting a bulb in the lamp.”

There are multiple ways that IBM i shops can shoot themselves in the foot if they’re not paying attention to details around security.

For instance, a customer might have thought they were doing everything right and had the audit journal functioning, but didn’t realize the QAUDCTL system value set to *NONE. “It allows things to happen on your system that you don’t realize if you’re at a level below 40,” Williams said.

A similar situation can happen with invalid sign-in attempts. An IBM i administrator may have initially set the number of invalid sign-ins before access to the system is blocked at three, but someone else may have changed a user profile to allow 25 failed attempts, Williams said. Or an admin may have set the system to require tough passwords with numbers and special characters, but have a minimum password length of one.

“It’s really about making sure that you check all of those settings, not just one,” Williams said. “Those are things where it can create a gap that you can’t necessarily see by looking at the system value, so keeping an eye on your user profiles is really important.”

All in all, the 2026 State of IBM i Security was a mixed bag, with progress in some areas, but frustrating regressions in others.

“We have been doing this for over 20 years, and sometimes I feel like we’re having the same conversation every year,” Moore said. “And what it comes back to is, what are the main inhibitors to actually getting to that better IBM i security? There’s got to be something that is holding us back and not getting it done.”

Williams suggested that consolidations may be a factor.

“We’re working a lot with companies that are either acquiring other companies that have an IBM i, and they’ve never seen one before, or we’ve got multiple companies that rely on them, but they use them and configure them in very, very different ways,” she said. “And so bringing all those pieces together, educating brand new teams that have never been responsible for an IBM i is huge, and I think we’re seeing more and more of that every year.”

You can access the 2026 State of IBM i Security report and the Fortra webinar featuring Moore and Williams here.

This Issue Sponsored By

Table of Contents

Content archive

Recent Posts

Subscribe

Pages

Search