FSI Occasional Paper No. 28
Frontier AI models can autonomously identify vulnerabilities and conduct sophisticated cyberattacks — but does that require a new regulatory framework, or a faster execution of existing ones?
The Financial Stability Institute (FSI) of the Bank for International Settlements (BIS) has published FSI Occasional Paper No. 28, examining how frontier AI is transforming the cyber threat landscape for financial institutions and how financial authorities are responding. Unlike earlier generations of AI, frontier models can autonomously identify critical vulnerabilities, develop effective exploits, and conduct complex multi-step cyber operations — reducing the expertise, time and resources needed to carry out sophisticated attacks, while also offering significant defensive opportunities in threat detection and incident response.
For financial institutions, the risks arise on three fronts: compressed cyber remediation windows, as frontier models collapse the gap between vulnerability discovery and exploitation; higher likelihood of breach, with unpatched software becoming the leading initial access vector; and amplified third-party dependencies, as reliance on common cloud, software and AI providers introduces concentration and sovereign access risks that can cascade across firms and jurisdictions.
Financial authorities are converging on a pragmatic response: rather than introducing new AI-specific cyber regimes, they are reinforcing existing cyber risk management and operational resilience frameworks while adapting supervisory expectations. Policy responses increasingly emphasise governance capable of supporting timely decision-making, accelerated patching, and enhanced response and recovery capabilities. Frontier AI does not fundamentally change the foundations of cyber resilience — but it significantly increases the speed and intensity with which established practices need to be executed.
Read the full report → | Read the report overview →
