AI Is Finding Cyber Vulnerabilities Faster Than Financial Firms Can Fix Them

The Financial Conduct Authority has published a review of how financial firms are preparing for frontier AI in cybersecurity, and its most important finding is operational rather than futuristic. AI can help identify and analyse vulnerabilities faster, but finding more weaknesses only improves resilience if firms have the people, governance and engineering capacity to remediate them.

The FCA is explicit that the 2 September publication does not introduce new rules, guidance or regulatory expectations. It summarises observations from firms and is intended to help the wider market, particularly smaller and medium-sized businesses, learn from current practice and prepare for AI-enabled threats.

AI changes the speed of discovery before it changes the duty to fix

In May, the FCA, Bank of England and Treasury said the cyber capabilities of current frontier models were already exceeding what a skilled practitioner could achieve, at greater speed, scale and lower cost. Used defensively, that can compress vulnerability research that previously required scarce specialist time. Used maliciously, the same capability can make attacks easier to scale.

The imbalance is that remediation remains stubbornly physical and organisational. A firm still has to patch software, test systems, replace dependencies, schedule downtime, manage suppliers and make decisions about legacy infrastructure. AI can make the queue of known problems longer before it makes the organisation capable of clearing that queue.

The FCA's harness-engineering point is easy to miss

The review also stresses that model capability is only part of the result. The surrounding harness, including tools, prompts, access, workflow design and controls, affects what a frontier model can actually do. Two firms using the same underlying model can therefore create very different risk profiles.

That has a regulatory consequence even without a new AI rulebook. Existing governance and operational-resilience expectations still apply to the way a firm deploys technology. Buying a powerful model does not outsource accountability for how it is connected to systems, data and security tooling.

The emerging UK model is sector regulation, not one AI compliance checklist

The FCA review fits a broader pattern in UK regulation. Rather than waiting for one comprehensive AI statute to answer every operational question, sector regulators are applying existing duties to new technology. The relevant rule for a bank may be operational resilience; for an auditor it may be audit quality, evidence and professional judgement.

That makes 'UK AI regulation' harder to reduce to one calendar. A company can face AI-related expectations through cybersecurity, consumer protection, data protection, audit, financial services or competition law depending on what the system does and where it is deployed.

The FRC shows how agentic AI is being absorbed into existing accountability

The Financial Reporting Council used its 3 September regulatory vision to highlight guidance it had already published for audit firms using generative and agentic AI. That guidance identifies risks such as deficient outputs and non-compliant methodologies, and asks firms to obtain appropriate confidence through system design, certification, staff education, governance and human review.

Most importantly, the FRC says accountability for audit quality does not move to the model. Firms and responsible individuals remain accountable. This is a useful signal for other regulated sectors: AI may change how work is performed, but regulators are unlikely to accept 'the model did it' as a substitute for a control framework.

What financial firms should take from the review now

The practical response is not to ban frontier AI or deploy it everywhere. Firms need to know where AI is being used, who owns the risk, what systems it can access, how vulnerabilities are prioritised and whether remediation capacity can keep pace with discovery. Smaller firms also need to avoid assuming that model providers absorb those responsibilities.

The most valuable metric may become time-to-remediation rather than number of vulnerabilities found. If AI doubles discovery but the backlog grows faster, measured activity has increased while resilience may have deteriorated.

What to watch next

The FCA says it will continue work on frontier AI and cyber resilience. The important next signal will be whether observations from this review begin appearing in supervisory practice, sector guidance or firms' own operational-resilience disclosures.

For BBR's regulation coverage, the story is therefore bigger than one FCA review. UK regulators are beginning to establish a practical doctrine for AI inside regulated business: adopt the technology where it improves work, but preserve named human accountability, evidence quality and the capacity to manage the risks it exposes.