AI Is Finding Cybersecurity Flaws Faster Than Financial Firms Can Fix Them
Frontier AI models are uncovering cybersecurity vulnerabilities in UK financial firms faster than those institutions can remediate them, according to the Financial Conduct Authority. The regulator has warned that the resulting backlog risks creating operational instability at some companies.
Financial services organisations have begun using advanced AI systems to scan their own defences. The models identify weaknesses at a volume and speed that traditional security teams and change-management processes struggle to match. The FCA noted that firms are finding it difficult not only to assess the continuous flow of findings but also to prioritise and fix them without overwhelming engineering resources.
Bank of England governor Andrew Bailey raised the issue with G20 central bank governors and finance ministers, highlighting the growing cyber risk that frontier AI poses to financial stability. Joint guidance from the Bank of England, FCA and HM Treasury has urged firms to strengthen vulnerability management, improve patching capacity and prepare for a higher volume of AI-driven discoveries.
The problem is especially acute for institutions that rely on complex legacy systems built through years of mergers and acquisitions. While attackers can exploit newly discovered flaws within hours, remediation on older platforms can take weeks or months. Industry specialists describe a widening gap between detection capability and operational follow-through.
Defenders are also exploring AI to help close that gap. Specialised “harness” systems that wrap frontier models can filter findings, reduce false positives and present actionable results. Yet regulators stress that technology alone is insufficient. Firms need clearer ownership of remediation, better change-control processes and realistic testing of how quickly they can respond under pressure.
For the UK financial sector the episode underlines a new reality: AI is accelerating both the discovery of weaknesses and the potential for systemic disruption if those weaknesses remain unaddressed. Operational resilience now depends as much on the speed of fixing problems as on the sophistication of finding them
