Bowman: AI cyber threats need 'proactive risk management'

• Key insight: The Federal Reserve sees artificial intelligence as a security threat, but one that is the primary responsibility of bank leaders. 
• Expert quote: "Cybersecurity requires proactive risk management by boards of directors and senior management. It also requires strategic investments in people, processes, and technology that are aligned with the risk and complexity of the institution." — Federal Reserve Vice Chair for Supervision Michelle Bowman
• Forward Look: Bowman has spearheaded a report from the Financial Stability Board outlining "Sound Practices for Responsible Adoption of AI." The group is sorting through public comments on the report collected during the summer.

The Federal Reserve's top regulator wants bank directors and executives to be vigilant about new cybersecurity threats posed by artificial intelligence.

In brief remarks delivered Tuesday morning at a Fed cyber workshop for community banks, Vice Chair for Supervision Michelle Bowman said the security threats banks face have increased "exponentially" because of the proliferation of both traditional hackers and AI agents.

These changes have clear impacts on banks — they must continuously evolve cyber defense strategies and tactics," Bowman said in video recorded remarks played at the Denver event. "Defending against these risks begins with strong cyber hygiene — up-to-date asset inventories, phishing-resistant multifactor authentication, strong identity and access controls, and robust vulnerability identification and patch management programs."

Bowman said these beefed up practices should include "comprehensive employee training and periodic incident response program testing." She also noted that responsibility for managing these risks lies first and foremost with bank leadership.

"Cybersecurity requires proactive risk management by boards of directors and senior management," she said. "It also requires strategic investments in people, processes, and technology that are aligned with the risk and complexity of the institution."

As she has done previously, Bowman encouraged banks to incorporate AI technologies into their own defense schemes. 

"Many of you are already exploring how to safely and strategically deploy AI for these purposes," she said. "Understanding when, where, and how to properly use AI is instrumental to balancing innovation with sound risk management."

Read more:

• As fintechs nab bank charters, what's happening to BaaS?
• Overheated data center knocked 23 credit unions offline
• Chris Britt still says banking is broken, but Chime can fix it
• Credit unions bulk up a business that banks long dominated
  

Through her role on the Financial Stability Board, Bowman spearheaded a report outlining best practices for AI adoption and oversight. The group solicited comments from the public on the report over the summer. 

Bowman noted that regulators would have a role in ensuring these risks are being addressed, but oversight would be tailored in such a way that the biggest and most cyber-exposed banks are given the most scrutiny while smaller, simpler banks are given less.

Bowman said the Fed will continue to host workshops and other events as part of its "ongoing commitment to identify and equip community banks with resources that may be necessary to combat cyber risks."