Frontier AI will not break finance. Slow cyber decisions will

The scariest thing about frontier AI is that it gives lazy criminals better legs.

That sounds flippant until you watch how cyber failure works. I have seen that weakness in many costumes: A server waiting for a patch, an access path nobody wants to touch, a supplier marked “low risk” because the contract said so, and a legacy system kept alive by one person who retired years ago.

It is a known weakness with no owner.

Frontier AI only needs to find them faster, join them better and act before the committee has finished admiring the heat map.

On 15 May 2026, the Bank of England, the FCA and HM Treasury warned that frontier AI models carry serious cyber and operational resilience implications for regulated firms and financial market infrastructures. Cyber capability is getting faster and cheaper to scale.

The European Systemic Risk Board (ESRB) warned in June 2026 that frontier AI models with cyber capabilities can discover vulnerabilities, generate working exploits and execute attacks at a speed, scale and accuracy beyond those of earlier models. It also warned that this may reduce response time, increase concentration risk and weaken resilience across the financial system. Three weeks earlier, a US executive order directed the Treasury, along with CISA and the NSA, to establish an AI cybersecurity clearinghouse and a pre-release evaluation framework for frontier models with advanced cyber capabilities.

The clock has changed

For years, cyber programmes lived on borrowed time.

A weakness appeared. Someone logged it. Technology needed a change window. Procurement checked the supplier. Legal asked what could be said. Everyone was busy. Nobody was idle. Yet the decision moved like a suitcase with one broken wheel.

Frontier AI punishes that rhythm.

The Institute of International Finance (IIF) staff paper says frontier AI has lowered the barriers to discovering, exploiting and combining vulnerabilities. It also says the answer is not a new risk framework, but faster use of existing ones, with more senior ownership and faster remediation.

A patching process that looked mature when attackers needed weeks may look quaint when exploitation can follow in hours. A vulnerability backlog that once looked like a queue can become a menu. And menus are for customers. Not attackers.

When firm weakness becomes market fragility

In finance, a cyber incident can travel.

A bank does not sit alone. A payment system does not hum in a private corner. A firm and financial market infrastructure (FMI) does not clear and settle trades as a hobby. These institutions share technology, suppliers, market data, cloud services, open-source code, identity systems and habits. When one pipe shakes, another pipe may feel the vibration.

That is why the ESRB treats frontier AI as a systemic risk, rather than a security issue. It points to shared technology stacks, common service providers, open-source dependencies and the risk of incidents spreading across critical functions. It also warns about asymmetry: Some firms and jurisdictions will have better skills, tools and access than others, while attackers may benefit sooner than defenders.

For FMIs, the useful question is blunt: What failure would stop the market completing the day? Not “which system is red?” Not “which supplier scored medium?” If this breaks, who cannot pay, clear, settle, price, report or trust?

In finance, one firm’s backlog can become another firm’s outage.

Governance means naming the decision

There will be a new policy. A renamed committee. A dashboard that tells directors what everyone already knows: the risk is high.

Fine. Keep the dashboard. But do not confuse it with movement.

Supervisors have already moved this to the top table. On 7 July 2026, the ECB, as banking supervisor, has asked significant institutions to assess the changed threat environment without delay and to deliver a full action plan by 31 October 2026. The ESRB says financial authorities should ensure boards are fully committed to mitigating frontier-AI-driven cyber risks, with clear governance, planned, timely responses and internal investment.

Governance should name the decisions before the incident names them for you. Which important services are most exposed? Which vulnerabilities must be fixed first? Which patching risks will the board accept to avoid a worse cyber risk? Which suppliers can hurt the firm? Which defensive AI tools are safe enough to use, and under whose authority?

Each important business service should have a Frontier AI Cyber Risk Position. One page. Service. Scenario. Owner. Gap. Decision. Funding. Date. Proof.

If it cannot fit on one page, it may not be due to complexity. It may be fog.

A policy says the firm noticed. A decision says the firm moved.

Threat modelling must grow up

Old threat models ask what an attacker might do. Useful, yes. But frontier AI adds a sharper question: What does the model make easier?

The Frontier Model Forum says cyber risk frameworks use capability thresholds, capability assessments and extra safeguards when models reach levels that could enable serious harm. Two thresholds matter for finance: Models that give meaningful uplift to less-skilled attackers, and systems that can carry out parts or all of an attack chain with little human direction.

So do not only ask whether phishing improves. Ask whether a novice can now perform work that once needed a specialist. Ask whether vulnerabilities can be discovered, chained, tested and used against hardened targets.

The Frontier AI Risk Management Framework offers a useful lens: Deployment environment, threat source and enabling capability. In plain English: Where is the tool, who can misuse it and what does it let them do that they could not do before?

Patching is now a resilience test

Patching used to be treated like hygiene. Necessary, dull and easy to postpone.

Not anymore.

The ESRB warns that current patching practices in finance are largely reactive. They rely on periodic updates and ad hoc responses. That may fail if frontier AI increases the volume of critical vulnerabilities. Firms may then face an ugly choice: Leave systems exposed or reduce patch testing, risking outages.

The IIF paper adds another sting. A published patch can become a signal. Attackers can inspect the fix, infer the weakness and move faster than firms can test and deploy it. In that world, “we are waiting for the next maintenance window” starts to sound less like discipline and more like hope in a suit.

Firms need a patch-wave model: Asset visibility tied to critical services, component visibility, exploitability scoring, attack-path analysis, emergency change lanes, rollback plans and senior visibility when the clock collapses.

Do not let CVSS become theatre. A lower-scored weakness on a live path to a critical service may matter more than a higher-scored weakness buried in a corner.

A patch is not always the end of the story. Under pressure from frontier AI, it can be the starting gun.

Your supplier map is part of your attack surface

No firm owns its full risk anymore.

Some of it sits on cloud platforms, in managed services and in open-source packages maintained by tired volunteers, software vendors and AI providers whose access decisions may depend on governments, export rules or commercial priorities.

The IIF paper notes that weaknesses now being surfaced are not unique to financial services. They live in operating systems, browsers, cloud platforms and open-source software used across the wider economy. The capacity to fix many of them sits with technology developers, platform firms and governments.

A contract clause does not patch a supplier. A right-to-audit clause does not restore settlement at 3 a.m. A service credit does not rebuild confidence.

Firms and FMIs need sharper dependency maps. Which providers support important services? Which have production access? Which hold sensitive data? Which supplier failure would stop the day?

Ask for proof. Patch proof. Incident routes. Recovery test results. Component lists. Exit options that can survive contact with reality.

Procurement should not buy what resilience cannot recover. Your perimeter ends at the contract. The attacker’s path does not.

Use AI for defence, but keep humans in authority

Frontier AI can help search code, correlate signals, support testing and speed up triage. The ESRB accepts the defensive value, but warns that offensive gains may arrive sooner than defensive maturity. The IIF paper says firms that move faster to build defensive capability will be better placed as the threat shifts.

So yes, use AI to test, find weak paths, help the SOC cut noise and scan code before deployment.

But do not let speed smuggle in authority.

If a containment action could affect payments, settlement, customer access or market operations, a named human must own the call. AI can suggest. AI can rank. AI can warn. It should not inherit a mandate by accident.

Agents that write code, test controls, scan infrastructure or act in workflows need scoped permissions, monitoring, logs and kill switches. They also need owners who understand what the agent can touch.

Use AI to gain speed. Do not let it become the ghost in the control room.

Assurance must reconstruct the story

After an incident, the question will not be, “Did you have controls?”

It will be sharper. What did you know? When did you know it? Who decided? What did they reject? Why was the choice reasonable? Where is the proof?

Assurance means following the decision trail from threat signal to board action to funding to remediation to test result. Evidence should include board papers, risk decisions, expired acceptances, supplier attestations, incident timelines, recovery tests and lessons learned.

The scrutiny will keep moving. The ESRB will reassess these risks at each quarterly meeting of its General Board. Supervisors are calibrating expectations to the trajectory of AI capability because anything anchored to today’s models will be stale before it lands.

One caution runs the other way. Firm-level disclosure of live vulnerabilities can itself concentrate targeting information. Push for aggregate reporting where the rules allow, and remediate before you broadcast.

Internal audit should ask one brutal question: Could a competent stranger reconstruct the decision six months later? If the answer is no, you may have done work rather than built defensibility.

Conclusion

Frontier AI will not break finance by magic. It will test whether finance can move before its own processes turn against it.

Frontier AI will punish firms that treat it as a chore and reward those that treat the next 12 months as a decision problem with a clock on it.

The EU and the US reached the same conclusion by different routes: The rulebook already exists. DORA, the AI Act and the new US clearinghouse point to frameworks in place today. The variable is the speed, ownership and evidence with which firms apply them.

The board questions are plain. Do we know our important services? Do we know the paths that can break them? Which suppliers and which models can hurt us? Can we patch in hours? Can we contain without guessing? Can we recover within tolerance? Can we prove who decided what, when and why?

This article is published as part of the Foundry Expert Contributor Network.
Want to join?