The FCA has published findings from a multi-firm review into how frontier AI could affect cyber resilience in financial services. Frontier AI refers to the most advanced AI models available at any given time. The review considers both the opportunity for firms to use these models to identify and analyse cybersecurity vulnerabilities and weaknesses in their own software, systems and infrastructure and the risk that malicious use could increase pressure on firms, their customers and the wider financial system.
Five key takeaways
Vulnerabilities may be discovered faster than firms can respond
Frontier AI is increasingly helping firms identify, validate and prioritise cybersecurity weakness more quickly. This can give firms a better view of potential attack paths, but it may also create more findings than cyber and engineering teams can readily access.
Some findings will prove to bee theoretical or irrelevant after expert review. However, even the genuine issues can put pressure on validation, engineering, patch testing and changer management. Firms need to consider whether they can increase remediation speed while maintaining service stability and appropriate change controls.
Frontier AI tests organisational resilience, not just technology
Some firms are using targeted deployments to understand how well their existing processes can handle AI-generated findings before scaling up. These trials can reveal where validation slows down, who is responsible for fixing weaknesses and whether change processes can absorb more work.
This makes organisational readiness a central issue. Firms need clear ownership, sufficient engineering capacity and teams able to distinguish a theoretical weakness from a credible route an attacker could exploit.
The surrounding environment matters to the value of frontier AI
The FCA calls the controls and processes around an AI model “harness engineering”. Models are more useful when they have reliable information about the systems they are assessing, specialist tools, robust validation and human expertise. Firms can also set guardrails, such as limiting system access or requiring human approval for higher-risk actions.
Without that context and control, models may produce large numbers of plausible findings that are difficult to verify or prioritise. The model’s capability alone does not ensure that firms can act effectively on its output.
Strong cyber and operational foundations remain essential
The review describes frontier AI as a potential stress test of firms’ existing cyber and operational resilience. Asset and dependency mapping, clear risk ownership and effective remediation processes help firms understand which weaknesses matter and how they could affect important business services. Firms also need to consider dependencies on suppliers, cloud services and shared technology, including whether suppliers can validate findings and manage increased patching demands.
Human specialists remain essential to assess whether findings are relevant and exploitable, judge their potential business impact and decide what to address first. The FCA also notes that senior leaders may need better visibility of how AI affects remediation capacity, supplier dependencies and the resilience of important services.
Effective governance and human judgement remain critical
AI can speed up vulnerability discovery, code analysis and prioritisation, but firms told the FCA that specialist human oversight remains essential. Experts need to validate findings, assess whether they are relevant and exploitable, and judge their potential business impact before deciding what to address first.
Governance and escalation routes may also need to keep pace with AI-enabled discovery. The FCA says senior leaders may need better visibility of the impact on remediation capacity, supplier dependencies and operational resilience. Firms should distinguish between observed risks, evidence specific to their environment and more speculative scenarios so they can respond promptly and proportionately.
What this means for firms
The FCA’s findings provide an opportunity for firms to assess whether their cyber and operational resilience arrangements can keep pace with developing AI capabilities. Key considerations include clear accountability, effective escalation processes, remediation capacity and supplier readiness.
Ultimately, faster vulnerability discovery must be matched by the ability to respond effectively. Firms will need to combine AI capabilities with strong governance, operational foundations and expert human judgement to maintain cyber resilience.