Artificial intelligence is changing the cybersecurity landscape, creating new opportunities to detect digital threats while also giving malicious actors tools to automate and refine their attacks. For financial institutions, the central concern is no longer limited to whether an individual bank or payment provider can be compromised. It is also whether an AI-enabled cyber incident could spread across interconnected institutions and disrupt the wider financial system.

This challenge will be examined on October 16 during a discussion featuring Bo Li of the International Monetary Fund (IMF), Marlene Amstad of Switzerland’s Financial Market Supervisory Authority (FINMA), Paulo Picchetti of Brazil’s Central Bank (BCB), Michael Sellitto of Anthropic and Andréa Maechler of the Bank for International Settlements (BIS). The session is scheduled for 4:15 p.m. Indochina Time (ICT).

The discussion focuses on a critical question for financial regulators and technology companies: when does an increase in cyber risk become a threat to the stability of the entire system?

AI Is Changing the Economics of Cybercrime

AI tools can help security teams examine large volumes of data, identify unusual activity and respond to potential intrusions more quickly. They can also assist with software testing, threat intelligence and the analysis of suspicious communications.

The same capabilities, however, can be misused. Criminals may use AI to generate convincing phishing messages, adapt fraudulent communications to different targets, automate reconnaissance or accelerate parts of an attack. As these tools become easier to access, some forms of cybercrime may require less specialised knowledge than before.

AI does not make every attack successful, nor does it eliminate the technical barriers involved in compromising secure systems. Nevertheless, the technology can change the speed, scale and cost of certain malicious activities, placing additional pressure on organisations responsible for defending critical infrastructure.

Why Financial Institutions Face Particular Exposure

Modern finance depends on a complex network of banks, payment processors, cloud providers, market infrastructures, software vendors and other technology partners. These connections improve efficiency, but they can also create pathways through which an incident at one organisation affects others.

A cyberattack on a single institution may be contained if its systems are isolated and recovery procedures work effectively. The consequences can be more serious when the affected organisation supplies essential services to many financial firms or operates infrastructure that cannot easily be replaced.

For example, a disruption involving a widely used technology provider could affect several institutions simultaneously. If payment processing, transaction confirmation or access to essential records were interrupted, the incident could create operational difficulties across multiple markets.

AI could intensify these risks if malicious activity becomes faster or more adaptable, particularly when institutions share common technology dependencies.

When Does Cyber Risk Become Systemic?

Not every data breach or cyberattack threatens financial stability. A systemic risk emerges when the consequences extend beyond an individual organisation and threaten the functioning of a wider network of institutions or essential financial services.

Several factors can increase the likelihood of such an outcome.

Concentration of critical services: If numerous institutions depend on the same cloud provider, software platform or security product, a single failure could affect many organisations at once.

Speed of disruption: Rapidly spreading attacks can reduce the time available for institutions to identify the source of a problem and coordinate their response.

Loss of confidence: Uncertainty about the security or availability of financial services can influence customer behaviour and market expectations, potentially worsening an operational incident.

Limited recovery capacity: Institutions may struggle to restore services if backups, alternative providers or emergency procedures are inadequate.

Interconnected exposures: Problems can spread through shared counterparties, service providers and operational networks, making the consequences more difficult to contain.

The key issue is therefore not simply the sophistication of an AI-enabled attack. It is the interaction between the attack, the institutions it reaches and the capacity of the financial system to absorb and recover from disruption.

Regulators Must Look Beyond Individual Banks

Traditional cybersecurity programmes often focus on protecting each organisation’s own systems and information. That remains essential, but systemic threats require a broader perspective.

Regulators need to understand which technology providers serve multiple institutions, where critical dependencies exist and how disruptions might spread through financial networks. They also need reliable channels for sharing threat information across institutions and jurisdictions.

Stress testing and scenario exercises can help authorities evaluate how a major cyber incident might affect payments, liquidity management and essential market functions. Such exercises are most useful when they test not only the initial attack but also the response of interconnected organisations under pressure.

Cross-border coordination is particularly important because financial institutions and technology providers frequently operate in multiple countries, while regulatory responsibilities remain divided among different authorities.

Building Defences for an AI-Enabled Environment

Financial institutions can strengthen resilience through several complementary measures. These include continuous monitoring, stronger identity verification, secure software development, regular vulnerability testing and clear procedures for responding to incidents.

Organisations should also review their dependence on external technology suppliers and establish practical alternatives for essential services where feasible. Recovery plans need to be tested rather than simply documented, with responsibilities clearly assigned before an emergency occurs.

AI itself can contribute to defence by helping security teams detect anomalies and prioritise alerts. However, automated systems also require oversight, testing and safeguards against errors or manipulation. Overreliance on a single AI-based security tool could create additional vulnerabilities if its limitations are not understood.

Staff training remains important as well. Employees need to recognise increasingly convincing fraudulent communications, report suspicious activity and understand how to use AI tools without exposing sensitive information.

Cooperation Between Finance and Technology

Addressing systemic cyber risk requires cooperation among financial regulators, central banks, international institutions and technology developers. Each group holds different information about emerging threats, operational dependencies and available defensive capabilities.

International discussions can help clarify shared priorities, improve communication and identify areas where existing safeguards may be insufficient. They can also encourage institutions to treat cyber resilience as a collective concern rather than solely an internal technology issue.

The October 16 session brings together perspectives from international finance, banking supervision, central banking and AI development to examine this evolving challenge.

Resilience Will Matter as Much as Prevention

As AI becomes more widely used, preventing every cyber incident may become increasingly difficult. Financial stability will therefore depend on the ability to limit the damage when attacks occur, maintain essential services and restore operations quickly.

The most important distinction is between an incident that remains contained and one that propagates through shared infrastructure, undermines confidence or interrupts critical financial functions. Identifying that threshold requires a detailed understanding of dependencies, vulnerabilities and recovery capabilities.

AI is changing the tools available to both attackers and defenders. Whether its wider impact threatens financial stability will depend on how institutions manage those capabilities, how effectively regulators coordinate their responses and how resilient the underlying financial infrastructure remains.