Purpose: This study aims to examine how accounting data vulnerabilities emerge and how vulnerability assessment is practiced in microfinance institutions, as well as to develop a context-based vulnerability assessment model.

Methodology: This research was conducted in Surakarta, Indonesia, involving Rural Banks, Islamic Rural Banks, and savings and loan cooperatives. A multi-case qualitative approach was used through semi-structured interviews, focus group discussions, and document analysis. Data were analyzed using thematic analysis to identify patterns of vulnerability and assessment practices.

Results: The findings show that accounting data vulnerabilities are influenced by technical limitations, human resource constraints, weak governance, and short-term managerial decisions. Vulnerability assessment practices are mostly reactive, informal, and not well integrated into organizational processes.

Conclusions: The study proposes a process-based vulnerability assessment model consisting of four stages: capacity-based identification, vulnerability evaluation, managerial decision integration, and organizational learning, positioning vulnerability assessment as an iterative socio-technical process.

Limitations: The study is limited to a small number of cases within a single regional context and mainly reflects internal organizational perspectives.

Contributions: This study contributes to accounting information systems and cybersecurity research by providing a practical and context-sensitive framework for microfinance institutions, offering insights for managers, regulators, and policymakers to strengthen accounting data security and organizational resilience.