Australian Banking Regulator Flags AI-Cybersecurity Mismatch
The Australian Prudential Regulation Authority (APRA) has sent a clear message to the country’s lenders: their cybersecurity measures are falling behind the rapid progress of artificial intelligence (AI). The regulator warns that this lag could lead to larger and faster cyber intrusions.
Financial Sector Vulnerabilities to AI
APRA’s concern is that the swift advancements in AI technology are posing an increasing risk to Australia’s financial sector. The authority is not proposing additional requirements at this time, but it does expect significant improvements in how entities manage the gap between their technological power and their ability to monitor and control it.
APRA member Therese McCarthy Hockey said businesses “cannot be blind to the risks of such powerful technology” despite the “tremendous opportunities” it offers. Hockey emphasized the need for businesses to enhance their understanding and control over AI technologies.
APRA Cautions About Frontier AI Models
APRA has raised concerns about frontier AI models, such as Anthropic’s Claude Mythos, which could increase the probability, speed, and scale of cyber attacks. These models have the capability to identify and exploit vulnerabilities across major operating systems and web browsers. To manage this risk, access to such models is currently restricted to a select group of large technology and financial firms under an initiative called “Project Glasswing”.
Anthropic has stated that this restriction is designed to help safeguard critical systems against such capabilities before similar AI tools are released more widely.
Improving Cybersecurity Practices and Capabilities
APRA has noted the recognition among regulated entities of the need for a step change in cyber practices and a continuous uplift in capabilities to protect IT assets in an evolving threat environment. These changes are essential to protect against the advanced threats posed by AI.
Last week, a spokesperson for Home Affairs Minister Tony Burke stated that Australia is collaborating with software companies, including Anthropic, to address potential cybersecurity weaknesses.
Excessive Dependence on Vendor Presentations
Feedback from APRA’s industry consultation revealed that banks are excessively relying on vendor presentations and AI model summaries, without fully considering the potential risks. APRA observed that many boards are still developing the technical literacy required to provide effective oversight on AI-related risks.
The regulator has stressed the necessity for financial institutions to develop a deep understanding of AI technologies to effectively manage their potential risks and leverage their opportunities.
This article is based on a report published by Retail Banker International. You can access the full report here.
