Financial institutions should assume cyber defenses will eventually be breached and put recovery, inventories and continuous testing at the center of resilience. Risk leaders warn that AI is accelerating threats while cloud concentration, third-party dependencies, outdated reviews and misplaced confidence in supplier assurance are creating increasingly complex vulnerabilities.
Financial
institutions should operate on the assumption that cyber defenses will
eventually be breached and build their resilience strategies around recovering
critical services when preventative controls fail.
As
AI accelerates the speed and sophistication of attacks, confidence based on
yesterday’s defenses is becoming an increasingly dangerous measure of
preparedness.
Speaking
at CeFPro’s 2026 Risk Evolve event, a Cybersecurity Risk Oversight Lead at a
major banking group said prevention and detection remain essential, but
recovery now deserves equal or potentially greater attention.
Recent high-profile attacks outside
financial services have already prompted his organization to reconsider
recoverability, including whether critical applications could be rebuilt from
scratch.
“The mentality these days should be,
assume you will be breached and focus on recovery,” the cyber risk executive
said.
AI is adding urgency to that shift.
A Head of Operational Resilience and
Business Transformation at an international bank said developments involving
frontier AI had already prompted executive discussions over whether third
parties should be questioned about their use of AI for vulnerability scanning,
patching and monitoring. Annual reviews, she argued, no longer reflect the
speed at which exposures are changing.
The cyber risk executive agreed that
debate over whether emerging AI threats represent hype may ultimately be
irrelevant. If current technology cannot yet deliver fully autonomous attack
capabilities, subsequent generations could.
A Vice Chairman at a global
cybersecurity professional association highlighted another imbalance.
Financial institutions must subject
new technology to governance, policies, approvals and risk assessments.
Criminal organizations face none of those constraints.
“What you all have that they don’t is
bureaucracy,” he said, warning that criminals can adopt AI ruthlessly while
legitimate organizations deliberate over implementation.
AI-assisted development can also
dramatically compress the time required to build functional applications,
increasing the potential volume and velocity of attacks.
Responding effectively starts with
visibility. The cyber risk executive identified inventories as fundamental to
security, covering data, systems, suppliers, cloud assets and increasingly AI
models.
Without knowing where technologies
and dependencies exist, institutions may struggle to respond when
vulnerabilities emerge.
Scenario testing provides another
critical defense. The operational resilience executive described a surprise
exercise involving the outage of a third party supporting an important payments
service.
Executives believed the simulated
incident was genuine and rapidly began escalating and considering actions
including stopping APIs.
