On October 15, CSBS published a blog post identifying three primary concerns that adversarial use of AI poses for financial institutions, warning that institutions must sharpen their focus on cybersecurity as threat actors adopt the technology.

First, CSBS highlighted that advanced AI models can uncover large numbers of vulnerabilities, including zero-days, and are reportedly capable of generating proof-of-concept exploits, raising concerns about patch volume, vulnerability severity and prioritization, and the capabilities of smaller institutions and their service providers. CSBS cautioned that faster patching alone will not be sufficient, and that institutions should reexamine patch and vulnerability management processes and strengthen underlying controls. Second, CSBS noted that AI is making social engineering, including phishing, vishing, and deepfakes, more efficient and effective by automating the profiling and targeting of victims at scale. And third, CSBS raised that AI is being used across the attack lifecycle to design, develop, and deploy malware, including malware that adapts to the environments it enters, adding that there is reason to believe many ransomware-as-a-service platforms use AI, making them more attractive to less sophisticated actors.

To address these threats, CSBS outlined nine recommendations drawn from the European Central Bank, among other sources, which call on institutions to: (i) strengthen their security perimeter; (ii) reevaluate vulnerability prioritization and shorten patching timelines; (iii) validate and update critical asset inventories; (iv) replace end-of-life technology and strengthen related management processes; (v) enforce strong user access controls and privilege management; (vi) govern the use of open-source software; (vii) use available AI models for defense; (viii) verify that third-party risk management practices are fit for purpose; and (ix) build and test incident response and resilience capabilities. CSBS also pointed institutions to its December 2025 cyber hygiene guidance and its Ransomware Self-Assessment Tool, and recommended that all institutions review these resources.