UK regulator warns AI finds cyber flaws faster than banks can fix

In short: The UK’s Financial Conduct Authority says AI tools are uncovering cyber security flaws in financial firms faster than those firms can fix them.

What's going on

The Financial Conduct Authority (FCA) said financial services companies are increasingly using “frontier AI” models, meaning very advanced AI systems, to hunt for weak spots in their cyber defenses. A cyber security vulnerability is like a broken lock on a door. If you find too many broken locks at once, you need enough people and time to fix them.

The FCA warned this can create a backlog, because the AI flags a continuous stream of issues and teams struggle to keep up. The regulator said this can lead to “bottlenecks,” and in the worst case, “operational instability,” meaning normal business could be disrupted by the pace of needed changes.

The problem is not only the number of issues found, but also the difficulty of deciding what to fix first. Andrew Jones of Adaptive Security said teams can waste time on low-risk problems while high-risk ones remain open. The FCA advised firms to make sure they have enough specialist engineers to check the findings and to test and install software patches (updates that repair security holes) while keeping systems running.

Older, complex systems can make this harder. Consultant Craig Parkin of Kroll said attackers may exploit a new flaw within hours, while some companies still take weeks or months to patch, especially on older “legacy” systems that can be difficult or even impossible to update.

What to watch

The FCA’s warning follows wider concerns from UK officials, including Bank of England governor Andrew Bailey, about AI increasing cyber risks. Watch for tougher rules on how financial firms use advanced AI in security work, and for more spending on staff and processes that can sort and fix the most dangerous issues first.

Source: Financial Times