Cybersecurity Policy Report, Johnson details AI’s budding risks, rewards across the digital and cyber landscape, (Jun 2, 2025)

By Suzanne Cosgrove

Firms need to be able to “fight fire with fire,” and use AI in the fight against AI-driven cyberthreats, the commissioner suggested.

Cyber resilience is a critical gateway issue for protecting market integrity, CFTC Commissioner Kristin Johnson told a group last week at the Federal Reserve Bank of Dallas, adding that discussions of cybersecurity and artificial intelligence have become increasingly intertwined.

Keeping to a theme she explored in speeches previously, Johnson said the news about AI is both good and bad. “I have closely followed these topics and the increasing volume and severity of cyberattacks in part due to the rise in AI used by bad actors to perpetrate these attacks,” she said.

Speaking in a keynote address to the Fed’s Symposium on Innovation in Derivatives Markets, Johnson pointed to a recent Financial Stability Oversight Council (FSOC) report that noted there are gaps in financial firms’ cybersecurity preparedness, risk management and business continuity practices with respect to AI. The report noted that AI’s data intensity and higher complexity, as well as increased reliance on third-party vendors of AI technology “can complicate the ability to fend off attacks.”

“While these cyber attacks are neither new nor unique to AI, AI tools may make these attacks much easier for a less sophisticated adversary,” according to the FSOC report.

The good news. At the same time, the use of AI in financial markets has enhanced the efficiency and execution of back-office and compliance functions that were previously sources of consternation 40 or 50 years ago, she noted.

Three distinct phases of AI have marked the most recent chapter of financial markets’ development and evolution, she told the group -- the creation of supervised and unsupervised machine learning algorithms, the creation of generative AI (GenAI), and the launch of agentic AI.

In general, a user inputs a specific prompt into an interface to produce synthetic content with tools like ChatGPT and Claude, applying the model to produce text, audio and images based on the input.

While current GenAI models may not comprehend certain real-world roadblocks because they rely heavily on user input and training data to predict patterns, there is tremendous potential for GenAI to facilitate execution of regulatory reporting and compliance obligations, she said. Regulators supervising markets may use GenAI for supervisory technology (SupTech) to better enable oversight of know-your-customer (KYC) and anti-money laundering (AML) compliance.

In fact, supervisory authorities’ use of SupTech has increased, she noted, with 59 percent of authorities surveyed using various applications in 2023, a five-percentage point increase from 2022. “With the data that it collects and its responsibilities for market oversight, it is easy to imagine how the CFTC could start to explore how SupTech could facilitate the agency in advancing many aspects of its mission,” Johnson said.

AI advances. More recent efforts of technologists have generated a next-level AI model that does more than supply synthetic content. Agentic AI makes decisions, takes action and adapts to changing inputs.

In the context of producing systems that can complete tasks without human oversight, like creating robust compliance and reporting systems that can create tangible operational efficiencies and increase compliance with applicable regulations, agentic AI builds upon GenAI in every discernable way, Johnson said.

Possible applications of this technology are widespread, she said. In the financial services industry, the potential found in agentic AI presents an array of cost savings and efficiencies. For example, manual transaction reviews typically conducted in different types of auditing can be completed by AI agents that autonomously scan financial statements and flag transactions that are out of compliance.

The task ahead. But with every great opportunity comes risk, Johnson said. Agentic AI’s outputs are only as good as inputs—if the training model data is biased, incomplete, or otherwise compromised, agentic AI outputs may be similarly inadequate.

“At the risk of sounding like a broken record, I urge everyone to be thoughtful about these issues and what steps we can take to strengthen market participants and our broader derivatives and global financial markets,” Johnson said.

“Effectively combatting cyber threats will require a coordinated effort among regulators and industry, and I believe there is a lot we can accomplish across a number of different areas, ranging from considering best practices for governance and effective risk management to leveraging technology through SupTech or RegTech innovations,” she concluded.

RegulatoryActivity: AINews CFTCNews CyberPrivacyFeed DataSecurity ExchangesMarketRegulation DataPrivacy