Artificial intelligence is changing the cyber-risk equation. This technology helps financial institutions accelerate analytics, automate processes and strengthen threat detection. However, the same capabilities can also significantly reduce the time, cost and expertise needed to identify and exploit vulnerabilities.
In its “Dear CEO” letter of July 7, 2026, the European Central Bank describes this as a long-term shift in the cybersecurity landscape. Emerging AI models can identify software vulnerabilities and generate functioning exploits at unprecedented speed. As a result, the window between vulnerability discovery and exploitation is compressed. The ECB’s key message is important: AI does not necessarily create an entirely new category of cyber risk – but it materially increases the speed and scale at which existing risks can materialise.
For financial institutions, the central question is therefore no longer whether cyber controls exist. It is whether those controls remain effective when attacks become faster, more scalable, and increasingly interconnected with AI technologies and external dependencies.
Three forces are reshaping the threat landscape
The change is not limited to attackers having access to better technology. AI affects cybersecurity across three interconnected dimensions.
Threat acceleration
AI can accelerate activities that traditionally require substantial time and specialist expertise: vulnerability discovery, exploit development, phishing preparation, malware adaptation, and attack-path analysis. CERT-EU describes a turning point in the process of vulnerability discovery: AI-powered capabilities are increasing discovery and exploitation speed while placing additional pressure on traditional patch cycles and remediation capacity. For financial institutions, this may translate into:
- Faster vulnerability discovery
- Shorter remediation windows higher patch volumes
- Greater pressure on change capacity and incident response
Consequently, the issue is therefore not simply whether a vulnerability-management process exists. It is whether it can operate effectively when the volume and velocity of critical vulnerabilities materially increase.
AI becomes part of the attack surface
As financial institutions embed AI into business processes, development environments, customer interactions and security operations, the technology itself introduces additional avenues of attack.
Relevant AI-related security risks include among others:
- prompt injection and jailbreaking,
- data or model poisoning,
- adversarial manipulation,
- model extraction,
- sensitive data breaches,
- insecure AI-generated code, as well as
- uncontrolled or shadow AI usage.
Dependency amplification
AI adoption also increases dependencies. Financial institutions increasingly rely on interconnected ecosystems involving cloud infrastructure, external models, APIs, open-source libraries, specialised AI providers and ICT supply chains. This can create new concentration risks and reduce visibility over vulnerabilities that originate beyond the institution’s direct control. An institution may therefore have strong internal controls and still be exposed through the vulnerability-management capability, security architecture, or response speed of a critical third party.
Taken together, these three forces create a different resilience challenge:
Cyber defence must now cope with greater attack velocity, a broader technology perimeter and increasingly complex external dependencies – at the same time.
AI-enabled cyber risks as an immediate supervisory priority
The ECB’s intervention reflects growing concern that AI-enabled cyber risks may outpace existing defensive capabilities. For supervised institutions this broader threat development now comes with a concrete deliverable.
The ECB requires SIs to assess the evolving threat landscape and develop a comprehensive action plan building on their existing cyber-risk strategy.
The plan should identify concrete measures, allocate the necessary resources, establish clear roles and responsibilities, and define implementation timelines.
It must be submitted to the relevant JST by October 31, 2026. JSTs will subsequently engage with institutions on the plans and monitor progress, while the ECB intends to perform a horizontal assessment across submissions.
This is therefore more than a policy update. The ECB explicitly places responsibility with management bodies and indicates that ICT resources and risk-tolerance frameworks may need to be revisited. It also expects existing supervisory findings in relevant ICT and security areas to be addressed without delay. These include findings from On-Site Inspections, targeted reviews and the 2024 cyber-resilience stress test.
What does the ECB expect institutions to address?
The action plan is structured around six focus areas, combining immediate priorities with structural resilience measures.
Four immediate priorities:
- Prioritise the protection of potential attack surfaces. Institutions should identify relevant ICT assets, including third-party software and open-source components, continuously monitor externally exposed assets and prioritise perimeter technologies, cloud environments and critical internal infrastructure.
- Accelerate vulnerability and patch management at scale. Institutions should prepare for faster and higher-volume vulnerability discovery and remediation. The ECB specifically points to prioritised scanning, more frequent patching and change-management arrangements capable of supporting rapid risk-based remediation without undermining operational stability.
- Enhance monitoring, detection and AI-enabled defensive capabilities. Monitoring of application and access logs, network traffic and other indicators should support earlier detection of compromise or exploitation. AI-based tools can contribute, but the ECB expects them to be subject to appropriate risk assessment, safeguards, validation and human oversight.
- Strengthen governance, funding, awareness and supply-chain assurance. Management should assess whether staffing, budgets, tooling and change capacity remain sufficient. Risk-appetite metrics may need recalibration, while ICT providers should be challenged on their preparedness for accelerated vulnerability disclosure and patching.
Two structural resilience measures:
- Reinforce defence-in-depth, cyber hygiene and infrastructure modernisation. The ECB points to segmentation and micro-segmentation, zero-trust principles, least privilege, MFA, secure configuration, comprehensive logging, security-by-design and remediation of unsupported or end-of-life technologies.
- Improve operational resilience, response and recovery. Crisis management, incident response, backup, failover and recovery arrangements should be tested under more demanding conditions, including high-speed and high-volume attacks, zero-day compromise, ransomware, destructive attacks and cloud or supply-chain disruptions.
The emphasis on capacity and operating effectiveness is particularly important. The plan is not simply expected to describe the existing control environment. It should instead demonstrate how that environment is being adapted to the changed risk profile.
How do these six focus areas translate into concrete priorities for your institution? Contact us for guidance on the key implementation considerations and pragmatic approach for responding!
The ECB response within the broader EU AI-Cybersecurity agenda
The ECB action plan should not be addressed in isolation. Its “Dear CEO” letter was published on the same day as another important development: the European Commission’s EU Action Plan on Cybersecurity and Artificial Intelligence.
This broader initiative addresses both sides of the AI-cyber relationship: advanced AI can increase cyber risk, but it can also strengthen defensive capabilities. The Commission describes the initiative as a coordinated response involving Member States, industry and EU-level organisations.
Importantly, the Action Plan does not establish another standalone cybersecurity regime for financial institutions. Instead, this Commission policy roadmap complements existing EU frameworks. These include the EU AI Act, Cyber Resilience Act (CRA), NIS2 Directive, DORA and Cyber Solidarity Act.
Implications for Financial Institutions
For financial institutions, three elements are particularly relevant:
- The direction is to use – not duplicate – the existing regulatory architecture. The Action Plan reinforces implementation of existing cybersecurity legislation rather than establishing another parallel control framework.
- AI is treated as both a threat and a defensive capability. The Commission encourages institutions and organisations to start using available AI capabilities – including open-source models where appropriate – to identify and address vulnerabilities more quickly and strengthen prevention and response capabilities. Thus, the implication is not that institutions should replace established security controls with AI. Instead, AI-enabled defensive capabilities can augment vulnerability management and threat detection, provided they are subject to appropriate governance and risk controls.
- Testing and evaluation capability is becoming increasingly important. The Commission intends to strengthen EU capacity to evaluate advanced AI models and, together with ENISA, establish a blueprint for secure access to advanced AI for cybersecurity purposes. A secure testing platform is envisaged for critical sectors, explicitly including finance.
This creates a bridge between traditional cyber resilience and AI governance: AI systems increasingly need to be evaluated not only for functionality and regulatory classification, but also for their security characteristics and their impact on the institution’s wider cyber-risk profile.
What has actually changed for the control environment?
The regulatory frameworks may largely exist – but the assessment method needs to evolve. Among the conventional cyber gap assessment questions, including: “Is the control designed and documented appropriately?”, “Is it implemented?”, “Is it operating effectively?”, – the AI-enabled threat environment introduces an additional question:
Does the control remain effective when attack speed, volume and complexity materially increase?
AI-enabled cyber risks are no longer limited to isolated attack scenarios. They affect vulnerability management, third-party dependencies and a recovery framework, simultaneously.
A vulnerability-management process may, for example, meet today’s remediation Service Level Agreements (SLAs), but it does not demonstrate that the institution can manage a sudden increase of critical findings.
Similarly, for third-party risk, it is not enough to demonstrate due diligence and contractual clauses. Institutions increasingly need to understand whether critical providers can themselves react at the speed required by the new threat environment.
Furthermore, an established recovery framework may not yet have been tested against repeated or concurrent attacks occurring before recovery from the initial incident has been completed.
The shift is therefore from static control compliance towards demonstrated resilience under changed threat conditions.
Implications beyond Significant Institutions
The emerging regulatory message is consistent:
- The ECB is asking SIs to respond now.
- The Commission is strengthening the wider EU policy framework around AI and cybersecurity.
- And existing frameworks such as DORA, the EU AI Act, NIS2 and the CRA already address the underlying control architecture. What has changed most significantly is the environment in which those controls must operate.
The October 31, 2026, JST submission is specific to ECB directly supervised SIs. It is not presented as a direct requirement for LSIs, small and medium investment firms or other financial institutions and organisations.
However, the underlying threat development is broader. Investment firms and other financial entities rely on many of the same cloud environments, software ecosystems, external models, open-source components and critical technology suppliers.
For those institutions and organisations, the ECB letter can therefore serve as a forward-looking resilience benchmark, while DORA and the institution’s applicable AI, cyber and prudential requirements remain the legal basis for action.
The Commission’s EU Action Plan reinforces this broader relevance: it explicitly positions financial services among the critical sectors for future secure AI testing and places AI-enabled cybersecurity within a wider EU resilience agenda.
Thus, for the wider EU financial sector, the strategic question is longer term:
Are cyber controls designed for yesterday’s attack velocity still resilient enough for tomorrow’s AI-enabled threat landscape?
The answer should not be another isolated framework. It should be a connected resilience architecture that uses DORA as the financial-sector backbone, AI governance for AI-specific risks, applicable EU cyber legislation for complementary requirements and threat-led testing to determine where current controls need to evolve.
Explore Your Next Steps with ADVANTA
ADVANTA supports financial institutions in translating the ECB’s expectations and the broader EU AI-cybersecurity agenda into a focused, evidence-based resilience programme.
Our approach combines regulatory interpretation with practical risk and control assessment. For SIs, this includes preparation of a JST-ready action plan, regulatory traceability, Board-level challenge, and preparation for supervisory dialogue.
For other EU financial institutions and organisation, the same approach provides a proportionate direction. The key step is to assess whether existing DORA, cyber and AI-governance capabilities remain adequate as the threat environment evolves.
Let’s discuss what the evolving AI-cyber threat landscape means for your institution – from regulatory expectations to practical priorities. Book a briefing session with us!