Cyber Resilience Demands Constant Reinvention

Cyber resilience must become a continuous discipline rather than an annual compliance exercise if financial institutions are to withstand an increasingly sophisticated threat landscape, according to senior industry leaders.

Speakers during a panel discussion argued that traditional approaches to cyber risk management are struggling to keep pace with advances in artificial intelligence, increasingly interconnected technology ecosystems, and growing dependence on third and fourth-party providers.

Instead, firms should focus on constant adaptation, regular scenario testing, and deeper visibility across their operational environments to strengthen resilience before the next major incident occurs.

One senior operational resilience executive explained that organizations can no longer assume periodic assessments are sufficient.

Discussing the rapid evolution of AI-enabled cyber capabilities, the executive said: "Everything is changing in AI so quickly that now the one year periodic review doesn't actually make sense anymore."

Instead, the speaker described how the organization immediately began reassessing exposure across its third-party ecosystem following reports surrounding new AI capabilities, including reviewing how suppliers use AI for vulnerability management, patching, monitoring, and cloud-based services.

A cybersecurity risk oversight lead at a major UK bank echoed that concern, arguing that whether the latest AI developments prove to be immediate threats or not is almost beside the point.

"It doesn't quite matter because it's here," he said. "If it's not now, it'll be what comes next."

He explained that the arrival of increasingly autonomous AI models capable of supporting offensive cyber activity has already attracted board-level attention, with directors and regulators seeking briefings on the potential implications for financial institutions.

The discussion repeatedly returned to the speed at which both defenders and attackers are adopting AI.

A cybersecurity governance specialist warned that organized criminal groups are embracing emerging technologies without the governance structures that financial institutions must navigate.

"We all have access to the same technology," the executive said. "What you all have that they don't is bureaucracy."

He argued that cyber criminals can rapidly deploy new AI capabilities while regulated organizations must work through governance, policy approvals, and risk assessments before implementing similar tools.

That imbalance, he suggested, is fundamentally reshaping the cyber threat landscape.

Rather than viewing AI solely as an additional source of risk, however, speakers emphasized its growing potential to strengthen resilience.

The operational resilience executive described opportunities to use AI to automate elements of third-party risk management and identify vulnerabilities more quickly, while noting that organizations must also establish clear internal guardrails around how AI is used and what information employees are permitted to enter into internal language models.

Maintaining current knowledge was identified as another critical challenge.

The cybersecurity governance specialist argued that formal education alone can no longer keep professionals current.