Frontier AI as a Cyber Risk Multiplier

Artificial Intelligence (AI) is increasingly helping financial entities improve efficiency, detect fraud and strengthen cybersecurity. However, European institutions and national authorities have warned that frontier AI may significantly enhance the capabilities of malicious actors. Advanced AI models are increasingly capable of identifying software vulnerabilities, generating proof-of-concept exploits and automating elements of the cyberattack lifecycle. As a result, attacks may become faster, more scalable and sophisticated, significantly reducing the time available for organisations to detect and remediate weaknesses. Frontier AI also lowers the expertise required to conduct sophisticated attacks, widening the range of potential threat actors. This creates significant challenges for defenders, who must identify and respond to vulnerabilities before they can be exploited.

Concentration Risk and Strategic Dependencies

The growing dependence on a small number of frontier AI, cloud and technology service providers outside the European Union, gives rise to additional complexities. While these providers deliver significant benefits, their concentration may give rise to operational, strategic and geopolitical vulnerabilities. More importantly, AI-enabled attacks could target multiple entities, sectors and jurisdictions simultaneously through common technology platforms, increasing the risk of widespread disruptions. These concerns were highlighted by the Financial Stability Board (FSB) in its August 2026 letter to G20 Finance Ministers and Central Bank Governors, which warned that frontier AI may materially alter the speed, scale and impact of cyber incidents, potentially undermining the resilience of the financial system.

Why It Is a Financial Stability Concern

Severe cyber incidents could affect financial stability through three key transmission channels:

• Disruption of critical financial services - Cyberattacks affecting payment systems, online banking platforms or financial market infrastructures could prevent businesses and households from carrying out routine transactions.
• Loss of confidence - Incidents affecting multiple financial entities simultaneously could undermine confidence in the financial system, potentially leading to market disruption and liquidity pressures.
• Systemic contagion - Financial entities are interconnected through payment networks, cloud infrastructures, and shared technology providers, which therefore would make AI-enabled attacks spread more rapidly than traditional cyber incidents.

 Strengthening Resilience

The challenges associated with frontier AI and cybersecurity are being recognized across Europe as issues with potential implications for financial stability, operational resilience and economic confidence. In response, European authorities are strengthening supervisory expectations and regulatory frameworks to enhance preparedness across the financial sector.

The ECB has called on banks to strengthen vulnerability management, monitoring and detection capabilities, third-party risk oversight and incident response and recovery arrangements. At the same time, the ESRB has emphasized the importance of building the EU’s capacity, expertise, and strategic autonomy in AI and cybersecurity. These efforts are complemented by broader initiatives, including the European Commission's Action Plan on Cybersecurity and Artificial Intelligence, as well as frameworks such as DORA, Network and Information Security Directive 2 (NIS2) and the >Cyber Resilience Act and subsequent amendments. Together, they aim to strengthen cybersecurity, operational resilience and the safe adoption of advanced technologies across the EU. The European Supervisory Authorities have also encouraged financial entities to reassess their ICT risk management frameworks in light of frontier AI-related threats.

At the global level, the Financial Stability Board has highlighted the need to support the safe and responsible development and deployment of frontier AI models while strengthening cyber resilience, particularly in relation to critical third-party providers and shared technology dependencies. These developments are highly relevant to Malta and align closely with the MFSA's supervisory focus on operational resilience, ICT governance, cybersecurity and third-party risk management, as reflected in its 2026 Supervisory Priorities.

Looking Forward

As frontier AI continues to evolve, cyber resilience can no longer be viewed solely as a technical or operational matter. Its potential implications for market confidence, operational continuity and financial stability make it a strategic priority for financial entities, regulators and policymakers alike.

While regulatory and supervisory initiatives provide an important foundation, effective resilience ultimately depends on actions taken at the individual level. Financial entities should act proactively by strengthening vulnerability management processes, reviewing dependencies on critical third-party providers, assessing exposure to AI-enabled cyber threats and enhancing incident response and recovery capabilities. Regular cyber resilience exercises and scenario testing can also help prepare for increasingly sophisticated attack scenarios. Equally important is ensuring that frontier AI-related cyber risks receive appropriate attention at board and senior management level.

Given the pace at which frontier AI capabilities are developing, postponing action may significantly increase exposure to emerging cyber risks. Entities should therefore take early and proactive steps to assess vulnerabilities and strengthen resilience before threats fully materialise.