AI Changed the Economics of Hacking. Banking Hasn’t Changed the Economics of Defense

The uncomfortable truth for banks is not that artificial intelligence has made cyberattacks possible. It is that AI is making parts of cyber offense cheaper, faster, and easier to repeat across the same technology base that financial institutions have spent decades building across payments, identity systems, cloud services, fraud platforms, vendor tools, customer databases, and legacy core banking environments.

A bank can spend months negotiating a vendor remediation plan, weeks testing a patch, days escalating a risk exception, and hours determining who owns a system old enough that nobody wants to touch it. An attacker operates without those constraints. If AI helps that attacker find the weakness, write the exploit, imitate a vendor, and scale the campaign, the imbalance is no longer just technical. It is economic, operational, and architectural.

The recent banking scare around Anthropic’s Mythos model belongs in that frame because it shows what happens when vulnerability discovery stops being scarce. Mythos Preview identified thousands of critical software vulnerabilities across major operating systems and browsers, prompting Japan to form a financial cybersecurity task force and pushing European supervisors to seek access so banks are not evaluating the threat from the outside. The signal was not that banks suddenly discovered cyber risk. It was that a model built to find flaws at scale forced banks and regulators to confront how slowly institutional defense still moves.

Cyber risk was already rising before AI entered the argument. The IMF has found that cyberattacks have almost doubled since before the pandemic, nearly 1 in 5 reported cyber incidents over the past two decades have affected financial firms, and the largest direct losses from cyber incidents have more than quadrupled since 2017 to at least $2.5 billion. Financial firms have reported almost $12 billion in direct cyber losses since 2004. AI does not need to invent a new category of banking cyber risk to destabilize the sector. It only needs to accelerate the risks banks already struggle to govern.

Most banks have cybersecurity controls, security teams, vendor-management programs, incident plans, and regulatory obligations. The harder test is whether those controls can move at the speed of AI-assisted exploitation. Attackers scale through software; banks defend through organizations. That asymmetry is now the center of the problem.

Compressing the Attack Clock

Sources: NIST; Heiding, Lermen, Kao, Schneier & Vishwanath

AI Turns Cyber Labor into Attack Leverage

AI as a hacker can sound theatrical, but the practical mechanics are less cinematic and more consequential. AI can assist with reconnaissance by finding exposed systems, outdated software, public employee information, vendor connections, cloud misconfigurations, and weak points in digital operating environments. It can review code, APIs, authentication flows, and configuration patterns. It can help generate phishing messages, fake support scripts, synthetic documents, and convincing impersonations. NIST has identified AI-enabled attack paths including spear phishing, malicious websites, vulnerability exploitation, credential harvesting, lateral movement, and autonomous attack agents capable of operating across multiple phases of an intrusion.

Banks should not fixate on the most extreme version of a fully autonomous cybercriminal model. The more immediate risk is that AI lowers the cost of cyber labor. It helps weaker attackers perform tasks that once required stronger skills, and it helps sophisticated attackers move faster through reconnaissance, targeting, social engineering, and exploit adaptation. Controlled research on automated spear phishing has already shown how much the economics can change: fully AI-automated emails achieved a 54% click-through rate, roughly matching human experts, while AI-assisted phishing at larger scale was estimated to increase profitability by as much as 50 times.

Across banking architecture, weak points are becoming more valuable. Verizon’s 2025 breach data covered 22,052 security incidents and 12,195 confirmed breaches, the highest breach count in the dataset’s history. Third-party involvement doubled from 15% to 30%, human involvement remained near 60%, and vulnerability exploitation rose to roughly 1 in 5 breaches as an initial access vector. A vulnerability that once sat quietly in a backlog may become easier to find, a patch cycle that once seemed reasonable may become too slow, and a vendor weakness that once looked isolated may become a path into multiple institutions.

The attack side is gaining operating leverage while the defense side is still paying retail. A bank has to govern permissions, validate patches, preserve uptime, protect customers, satisfy regulators, manage vendors, maintain audit trails, and avoid breaking transaction flows. An attacker needs only one workable path through that architecture. AI does not erase the bank’s control environment; it taxes the delay built into it.

Time Matters: Attacker vs Defender

Sources: Verizon DBIR; ISC2; IMF

Banks Defend by Committee While Attackers Scale Through Software

Financial institutions already understand that cybersecurity matters, which is precisely why the problem is more difficult than a budget speech or procurement cycle can solve. A serious AI-era defense model requires people who understand cloud security, application security, identity management, fraud, incident response, AI systems, model governance, vendor risk, regulatory expectations, legacy technology, and business continuity. That combination is rare because it is not a single job description. It is an operating model that has to connect technical judgment, institutional authority, and business continuity under pressure.

Cybersecurity staffing pressure has moved beyond headcount into resilience. ISC2 workforce research shows that nearly 9 in 10 cybersecurity professionals have reported significant consequences from skills shortages, and 69% have reported more than one consequence. Inside banks, that shortage lands hardest where the work requires hybrid judgment: securing AI, cloud, identity systems, vendors, and legacy environments while translating unfamiliar technical failures into board-level and regulatory language.

Stretched security teams already monitor threats, respond to incidents, review vendors, support audits, advise product teams, investigate alerts, manage compliance, and approve new technologies. AI adds agent permissions, prompt-injection risk, AI vendor reviews, synthetic fraud, automated exploit testing, data governance, model access, and employee training. The work is expanding faster than many institutions are adding durable capacity, and the scarce roles sit at the intersection of security architecture, enterprise risk, product deployment, and regulatory accountability.

The operational friction becomes clearest when a critical vulnerability appears in a vendor tool connected to customer operations. Security wants it patched immediately, operations wants testing, legal wants contract clarity, compliance wants documentation, the vendor wants time, and the business wants uptime. Nobody is necessarily wrong. The institution may be behaving responsibly. Yet every internal dependency adds response latency, and the attacker does not have to wait for the meeting, the exception memo, or the next change window.

Defense by committee may be unavoidable in regulated banking, but AI turns committee time into exposure time. The governance challenge is not to bypass controls, but to design controls that can escalate, isolate, approve, and remediate at operational speed. Banks that cannot shorten the distance between detection and decision will find that their formal control environment exists on paper while the attack chain moves through production systems.

Technical Debt Means Security Debt

Sources: Verizon DBIR; DORA; IMF

Technical Debt Becomes Security Debt in AI-Era Banking

Banks are not starting from a clean slate. They operate on decades of accumulated technology, old code, layered integrations, vendor dependencies, and systems that cannot easily be replaced because they still process transactions, support customers, and keep the business running. Replacing them can mean touching core operations, regulatory reporting, fraud systems, customer records, and vendor contracts, with every change carrying operational, legal, customer, and supervisory consequences.

Viewed through an AI-enabled threat model, technical debt becomes unpriced security debt. Old systems are often harder to patch, harder to monitor, harder to isolate, and harder to understand. Deferred modernization becomes a balance-sheet problem in everything but accounting treatment: older systems, fragile integrations, undocumented dependencies, vendor lock-in, and manual workarounds accumulate as hidden risk until an incident forces the institution to recognize the cost all at once.

The same exposure extends beyond the bank’s walls. A bank may own the customer relationship, but the customer experience may depend on cloud platforms, fraud vendors, identity tools, fintech partners, payment processors, data providers, software suppliers, and AI providers. EU regulators have already designated 19 major technology companies as critical third-party computing providers for the financial sector under DORA, bringing firms including AWS, Google Cloud, Microsoft, Bloomberg, IBM, London Stock Exchange Group, Orange, and Tata Consultancy Services into direct operational-resilience oversight.

AI does not merely attack the bank as a standalone institution. It attacks the seams between bank and vendor, vendor and cloud provider, cloud provider and identity system, identity system and customer account, customer account and payment flow. For an AI-enabled attacker, the architecture is not a compliance map. It is a search space.

The Economics of Defense Still Do Not Work

A serious response requires more than another security tool. A bank may need to hire scarce talent, modernize legacy systems, redesign access controls, automate security operations, improve monitoring, tighten third-party oversight, slow certain technology deployments, test AI tools before use, improve customer protections, and give security leaders more authority. Each step competes with revenue projects, product deadlines, vendor road maps, regulatory commitments, and the constant pressure to preserve uptime.

Cybersecurity has an internal sales problem because revenue projects promise visible gains, while security investments often promise losses that do not happen. AI sharpens that tension by reducing the cost of attack while forcing banks to raise the speed and quality of defense. Defensive investment has to be approved, staffed, integrated, audited, and maintained; offensive capability can scale through tools, scripts, service reuse, and automation.

IBM’s 2025 breach research placed the global average cost of a data breach at $4.4 million. Among breached organizations, 63% either lacked an AI governance policy or were still developing one, only 37% had approval processes or oversight mechanisms in place, and 1 in 6 breaches involved AI-driven attacks. Weak AI oversight has become a direct cost amplifier rather than a governance abstraction.

For banks, those numbers expose an allocation problem: how much to spend today to prevent a breach that may never happen, on a system that still works, through a vendor that may resist changes, using talent that is difficult to hire, under a budget process that rewards visible returns. A patch is deferred to protect uptime, a modernization program is slowed to control cost, a vendor exception is granted to preserve a product launch, and an AI tool is piloted before governance catches up. Each decision can make business sense in isolation. Together they create the security float between known risk and fixed risk, and AI taxes that delay.

Third-Party Concentration Turns Vendor Weakness Into Sector Exposure

Sources: DORA; Reuters; Financial Stability Board

Consumers Inherit the Lag

Banking cybersecurity protects more than account balances. It protects identity data, payroll deposits, transaction histories, mortgage records, small-business cash flow, credit access, retirement accounts, and the ability to participate in daily economic life. When institutional defense slows, the consumer consequence is a frozen account, a fraudulent transfer, a delayed paycheck, a compromised small-business login, an identity-repair process, or weeks spent proving that a transaction was not legitimate.

AI makes that burden heavier because it improves the quality and volume of deception. Fraudsters can produce better emails, more realistic support messages, fake documents, voice impersonations, and tailored scams based on personal data. The user facing the attack may not know whether the message is machine-generated, whether the voice is synthetic, whether the support link is false, or whether the account warning is real.

Reported U.S. fraud losses reached more than $12.5 billion in 2024, up 25% from the prior year, even though the number of fraud reports remained broadly stable. The share of people reporting a financial loss rose from roughly 1 in 4 to more than 1 in 3. Investment scams accounted for $5.7 billion, and imposter scams generated 845,806 reports and $2.95 billion in losses. Personal cybersecurity is becoming part of personal finance, not a side issue for awareness campaigns.

For banks, a secure product will increasingly require stronger transaction controls, account lockdown tools, clearer fraud warnings, faster dispute handling, identity protection, family protections, and AI-enabled detection systems that work for the customer rather than against them. AI can make fraud cheaper to produce, while consumers pay in time, stress, lost access, identity repair, and reduced trust. A financial system that asks individuals to spot machine-generated fraud on their own is externalizing part of the bank’s defense latency onto the customer.

Governments Inherit the Concentration Risk

Bank cybersecurity is not only a private business issue because banks move money, settle payments, distribute credit, support payroll, process government benefits, safeguard savings, and maintain trust in the financial system. At sufficient scale, a cyberattack on financial institutions becomes an attack on economic coordination, especially when critical functions such as payments, custody, cloud technology, identity systems, and market data depend on common providers or tightly coupled networks.

Financial cyber resilience is increasingly treated as a stability issue because severe incidents can erode confidence, disrupt critical services, and spill across institutions. Smaller U.S. banks have seen modest but persistent deposit outflows after cyberattacks, and the 2023 ransomware attack on ICBC disrupted U.S. Treasury market clearing. The system has not yet experienced a systemic cyber run, but the architecture for one is visible: concentrated providers, real-time payments, shared software, common cloud platforms, and customers who can lose confidence faster than institutions can explain what happened.

Response timing should become a regulatory concept, not just an internal security metric. In AI-era cybersecurity, the policy question is how quickly a bank can detect the failure, escalate the decision, coordinate with vendors, protect customers, report the incident, and recover critical services. Capital protects against financial loss, liquidity protects against funding stress, and cyber resilience protects the system’s ability to function when digital trust is under attack.

The institutions that adapt will not be the ones with the most impressive cyber slide decks. They will be the ones that reprice the economics of defense through faster detection, faster escalation, faster patching, faster vendor accountability, faster customer protection, and faster recovery. That requires architecture built for containment, governance built for urgency, procurement built for accountability, and regulation built around operational speed rather than static compliance.

AI has changed the economics of attack. Banking now has to change the economics of defense by treating time as the scarce security asset. The central test is no longer whether banks own cybersecurity controls. It is whether those controls can move before the exploit does.

TL;DR Summary

• AI has changed hacking by making vulnerability discovery, phishing, impersonation, exploit adaptation, and campaign scaling cheaper and faster.
• Banking’s cyber problem is now economic because attackers scale through software while banks defend through organizations.
• Response latency is the decisive metric: detection, escalation, containment, vendor action, customer protection, reporting, and recovery.
• Anthropic’s Mythos scare matters because it showed how AI can make software weakness discovery less scarce and more institutionally destabilizing.
• Legacy banking systems have become unpriced security debt because old integrations, vendor dependencies, and manual workarounds compound hidden cyber risk.
• Third-party concentration turns vendor weakness into financial-sector exposure across cloud, payments, identity, fraud, and data infrastructure.
• Cyber talent scarcity is an operating constraint, not a staffing footnote, because AI-era defense requires hybrid technical, regulatory, and business judgment.
• Breach economics now include AI governance because weak oversight of models, data access, and automation can directly raise institutional loss exposure.
• Consumers inherit institutional delay through frozen accounts, fraudulent transfers, identity repair, dispute friction, and reduced trust in digital banking.
• Personal cybersecurity is becoming part of consumer finance as AI makes fraud cheaper to generate and harder for individuals to detect.
• Regulators are moving toward operational resilience because cyber incidents can disrupt critical services, market confidence, and financial stability.
• The strongest banks and fintechs will reprice defense around speed, containment, vendor accountability, and recovery rather than static compliance.

Sources

• Reuters; Japan launches financial task force amid AI security fears; – Link
• Reuters; EU should seek access to Anthropic’s Mythos, Bundesbank says; – Link
• IMF; Global Financial Stability Report, April 2024, Chapter 3: Cyber Risk: A Growing Concern for Macrofinancial Stability; – Link
• NIST; Cybersecurity Framework Profile for Artificial Intelligence, NIST IR 8596; – Link
• Heiding, Lermen, Kao, Schneier, and Vishwanath; Evaluating Large Language Models’ Capability to Launch Fully Automated Spear Phishing Campaigns; – Link
• Verizon; 2025 Data Breach Investigations Report; – Link
• ISC2; 2025 ISC2 Cybersecurity Workforce Study; – Link
• IBM; Cost of a Data Breach Report 2025; – Link
• Reuters; Amazon, Google named by EU among critical tech providers for finance industry; – Link
• FTC; New FTC data show reported fraud losses reached $12.5 billion in 2024; – Link
• FTC; Consumer Sentinel Network Data Book 2024; – Link
• Financial Stability Board; Format for Incident Reporting Exchange: Final Report; – Link