AI cyber risk in banking and the value of security spending

AI cyber risk in banking is putting pressure on how banks allocate security budgets. Tools that find software weaknesses faster can improve visibility while increasing the work needed to validate and address findings. For finance and risk leaders, the investment question is whether additional spending helps the bank address material exposure sooner.

 

This article is also available in podcast/video form. Watch the video below from our YouTube channel, or follow The Intuition Finance Digest on Spotify, Apple Podcasts, or Amazon Music.

Why the workload is growing

Intuition’s recent article on the economics of AI-enabled cybercrime examined falling attack costs. For banks using AI to find weaknesses, faster discovery can increase the work required to verify and address findings.

In its September 2026 review, the UK Financial Conduct Authority reported that firms were finding vulnerabilities faster than they could address them. Even after expert review discounted some AI-generated findings, genuine weaknesses could still strain engineering resources.

Finding a weakness also starts work that discovery tools may not complete. CERT-EU explains that AI can misidentify vulnerabilities or propose faulty fixes, making validation and testing labor-intensive. Remediation, the corrective work needed to address a vulnerability, therefore has costs beyond the tool’s license.

What a growing backlog means

A remediation backlog is the queue of confirmed weaknesses awaiting corrective action. Its size alone says little about whether a security investment is succeeding.

Consider a hypothetical bank that introduces an AI tool and discovers longstanding flaws in its software. The recorded backlog grows because visibility has improved. That increase does not, by itself, mean the software has become less secure.

The concern arises if serious, exploitable weaknesses remain unresolved as further findings arrive. A September Financial Stability Institute paper warns that AI is shortening the interval between vulnerability discovery and exploitation. A queue that was manageable under slower attack conditions may leave less time to reduce exposure.

Risk reporting therefore needs to distinguish improved visibility from delays in addressing known weaknesses. It should also show whether temporary protective measures are reducing exposure while a permanent fix is pending.

Get the latest finance news delivered directly to your inbox

Subscribe to our Financial Newsletter

newsletter image

Where the next security dollar could go

The spending decision depends on what prevents the bank from addressing its most consequential weaknesses.

In the hypothetical bank, suppose engineers already have a queue of verified fixes awaiting testing. Additional testing capacity could help the back deploy those fixes sooner. Another discovery tool would need to demonstrate enough additional value to justify the extra work it generates. Where important weaknesses remain unseen, better discovery may still be the priority. The ECB’s July 2026 letter to significant banks under its supervision asks management to assess whether budgets and staffing, including capacity to implement technology changes, can support faster patching. AI investment can also support the repair process. CERT-EU describes a defensive system that generates proposed patches for confirmed findings. Such capabilities may help engineers, but their financial value still depends on the cost of reviewing and safely deploying the fixes. How to judge whether spending is working.

A stronger investment case connects the full cost of a security capability with evidence that material exposures are being addressed sooner.

Useful measures include:

  • Time to address material exposures: Track how long exploitable weaknesses remain unresolved, alongside any temporary controls that reduce exposure.
  • Full delivery cost: Include engineering and testing costs alongside tool fees to assess whether automation savings are offset by work elsewhere.
  • Rework and disruption: Track fixes that fail or require further changes, including any disruption caused by deployment.

Comparisons should use a consistent scope and risk classification. Closing many minor findings can improve headline numbers while serious exposures remain.

For the next budget review, ask each proposal to identify the delay it would reduce and how the bank would verify the improvement. A proposal for more discovery capacity should explain how the additional findings will be addressed within the shrinking time available.

Intuition Know-How has a number of tutorials relevant to the content of this article:

  • Retail Banking – Cyber Risk
  • AI Applications – Regulatory Compliance
  • AI Applications – Fraud Detection & Prevention
  • Retail Banking – Operational Risk
intuition - text logo_ black
Intuition Know-How is the complete learning library for financial services

Recent Posts

Frequently Asked Questions

Not necessarily. Better tools can reveal weaknesses that already existed. Assessments should consider how exploitable the findings are, the systems affected and whether corrective action reduces the exposure. 

The appropriate allocation depends on the constraint. Banks may need stronger discovery, better validation or more capacity to implement fixes. AI can support several of these activities, so its value should be assessed across the whole process. 

Finding counts measure activity and visibility. An investment assessment also needs the full cost of acting on those findings and evidence that significant exposures are reduced. Estimated losses avoided remain estimates, rather than directly observed savings.