Banking and Finance Law Daily Wrap Up, FINANCIAL TECHNOLOGY—BPI warns AI makes cyber defense harder, but tools are available, (Jun 22, 2026)
Organizations Mentioned:Anthropic | Bank Policy Institute | OpenAI
By Suzanne Cosgrove
New analysis proves action points for corporate boards and directors seeking to support AI readiness, mitigate risks.
While AI has made the job of cyber defenders harder, a recent report by BITS, the technology policy division of the Bank Policy Institute, found most financial institutions have the foundations in place to address these risks. The challenge for corporate leaders, according to the group, is to increase the speed of changes and program upgrades at a faster rate and greater scale than institutions had originally planned.
The report found new and more advanced AI models, such as Anthropic’s Mythos and OpenAI’s GPT 5.5-Cyber, are rapidly changing the cyber threat landscape, both as “a threat accelerant and transformative capability.” As a result, financial institutions must rethink their approach to traditional defensive measures and their ability to withstand the disruptions that are likely to occur.
Threat accelerant. According to the BPI analysis, AI is accelerating vulnerability discovery, compressing the time between disclosure and exploitation, and increasing the need for institutions to run current software, tighten patching cycles and embed security into AI development and deployment.
The speed, scale and investment needed to adopt cutting-edge AI tools for cyber defense will require the agreement of senior management and support of the board of directors, BPI noted.
Facilitating readiness. To help corporate leaders and board members prepare for AI-enabled threats, BPI published eight recommended discussion points. An abbreviated summary of the questions follows:
Are our critical systems and software dependencies running on current, supported versions? Given the scale of vulnerabilities that frontier AI models can discover, major software providers are likely to prioritize remediating vulnerabilities in the latest versions of their products. Institutions should maintain an inventory of business-critical systems, including internet-facing assets, which remain on outdated versions.
How quickly are known vulnerabilities being remediated, and are we prepared for a wave of new patches? Board directors should look at current targets for deploying patches, whether the institution is meeting those targets, and if they are being revised in response to new frontier AI models.
Where is deferred maintenance or aging infrastructure causing operational bottlenecks that slow remediation? Identify where legacy architecture, manual testing, limited engineering capacity or other constraints could delay the deployment of security fixes in a faster-moving threat environment. The primary bottleneck is often organizational capacity and the ability to introduce software updates without taking systems offline.
What is the plan to eliminate or mitigate the risk associated with end-of-life systems and unsupported components? Financial institutions should identify legacy platforms, obsolete code libraries and unsupported hardware or software, as well as target dates, funding needs and accountability for retirement or replacement.
What AI tools are we using today to scan code, detect vulnerabilities, automate triage and support defensive operations? Institutions should evaluate and deploy AI-enabled defensive capabilities in areas such as cybersecurity alert triage, vulnerability analysis and remediation support. While access to the Mythos frontier model is limited, AI enabled defensive capabilities can be implemented using other advanced models.
Have resilience, incident-response and recovery plans been updated for attacks and incidents powered by AI? How quickly can the institution detect, contain, recover from and communicate through a material cyber or operational incident? Have plans been tested through realistic exercises and simulations?
Do we have a current view of third-party software exposure and concentration risk? Institutions should have visibility into key dependencies, including software providers, outsourced operations, open-source components, and other external technology relationships whose disruption or compromise could materially affect the institution.
How are we engaging critical third-party software and service providers on AI-enabled cyber risk? Ask whether key providers are preparing for larger patch volumes, faster disclosure cycles and the increased strain on cybersecurity and technology teams. Boards and executive management also should understand contingency strategies for critical services, such as how the institution would operate if a key provider were compromised for an extended period.
Investment in modernization. The challenge is to significantly increase the speed of changes and program upgrades at greater scale than institutions had originally planned, BPI said, adding, “This is no easy task and doing so will require increased focus on investment in modernization.”
Incidents and outages may be more likely to occur, BPI said. “An intense focus on cybersecurity, technology modernization and resilience planning now can go a long way to protecting the institution in the months and years to come.”
Companies: Anthropic; Bank Policy Institute; OpenAI
IndustryNews: AINews BankingOperations CyberPrivacyFeed DataPrivacy DataSecurity FinancialIntermediaries FinancialStability FinTech GCNNews OversightInvestigations