The rise of AI is poised to pose a real threat to cybersecurity across industries, and banks are no exception. Issues that stem from generative AI in particular, notes a US Treasury report, can include lower barriers to entry for attackers, more sophisticated and automated attacks, and a shorter time for attackers to exploit a bank’s vulnerabilities. A bank’s AI algorithms can also be tampered with or attacked.

That raises the question of what banks can and should do about AI-driven cybersecurity risk. It’s complicated by bankers’ ability to understand AI systems and assess them in the context of technology and security risk management. Given the complexity of AI models and the dependence most banks have on vendors to implement them, bankers need to consider how they manage controls, in two parts.

The first part is by leveraging existing cybersecurity controls. The Treasury report recommends that banks use cybersecurity best practices to secure AI systems and “map their security controls to AI applications,” frequently train employees, diligently patch vulnerabilities, and pay close attention to the handling of data. Critically, this imperative includes even banks that don’t have their own AI systems, as it is important to beef up security to ward off increasingly sophisticated AI-based attacks.

The second part is the integration of AI systems using existing enterprise risk management. As we’ve written, banks will most likely rely on vendors for AI systems, which increases third-party risk, made more complicated by the financial, legal, and security risks related to the handling of data. The successful use of AI depends on addressing risk management and control issues in four areas, according to the Treasury report: