Could Generative AI be the silver bullet to financial services companies’ cybersecurity woes?

By Dr Liam Mayron, Staff Product Manager, Fastly

UK financial services companies experienced an average of 50 cyber-attacks last year, according to our recent annual cybersecurity report – the most of any industry surveyed. With London & Zurich, Sabre Insurance, and the UK Pension Protection Fund all hit, cybercriminals have been mounting an aggressive assault on financial services companies with potentially devastating consequences.

The research identifies how these firms are now prime targets for sophisticated attacks, ranging from DDoS to ransomware to exploiting open software source vulnerabilities.

UK financial services lost over 10% of their revenues because of cyber-attacks. Financial services firms suffered more than any other sector – with our respondents reporting 50 attacks within the past year.  Nearly one-third (29%) saw customer accounts compromised – striking at the heart of their brand promise.

So how exactly might Generative AI help financial services security teams combat cyberattacks? While mindful of its potential for misuse, our research suggests that financial services cybersecurity professionals are optimistic about Gen AI’s game-changing potential, with 85% appreciating its possible benefits. Will this positive sentiment towards Gen AI be backed by boardrooms? Here are four factors to consider:

1. Reduced toil/greater support for security teams: Cybersecurity teams are under pressure to do more with less. Nearly half (48%) of cybersecurity professionals in finance are worried about the ability of their existing talent pool to deal with threats from emerging technologies. Gen AI can help alleviate the pressure on teams, starting with small tasks that can be automated. Gen AI pioneers including Google, Microsoft, and OpenAI have made enterprise AI applications simple for companies to adopt – OpenAI’s enterprise GPTs are a good example. Meanwhile, Microsoft’s Github co-pilot offers contextually relevant suggestions to coders as they code. Cybersecurity teams could benefit from equivalent Gen AI-powered security co-pilots embedded into existing tools to help them perform tasks with greater ease and efficiency.
   Leaning into Gen AI can free cybersecurity teams to think more strategically about bigger issues including security resilience and analysing potential attack traffic.
2. Turbo-charged training capabilities: Gen AI can adapt content, including technical content, quickly, rewriting it for different non-technical audiences. These capabilities make it ideal for creating or updating company-wide training programmes. It can also help translate and localise rapidly – key benefits when building a globally-relevant training platform. Embedding Gen AI in training means financial services firms can go beyond the minimum required by law, offering richer, more frequent training. That has positive implications for talent retention and companies’ overall cybersecurity strategies.
3. Rapid action reports around security incidents: Businesses typically report 50 data security alerts a day around possible cybersecurity breaches. From here, security analysts gather evidence to confirm the nature of the breach. This involves collating contextual information and providing detailed reports on the timing, location, scale and type of breach. Because Gen AI has the capability to manage large amounts of data rapidly, it can write the initial incident reports, saving cybersecurity professionals valuable time and bandwidth. Microsoft has already introduced a security co-pilot into its data governance solution, Microsoft Purview, that can generate incident summaries to help accelerate investigations.
4. Staying ahead of the emerging threat: In the short term, Gen AI and LLMs can add an additional layer of protection to the “defence in depth” strategy favoured by many firms simply by easing the toil of hard-pressed cybersecurity teams. This includes using Gen AI to help financial services firms write their security policies around the use of LLMs within their organisations.

Looking further ahead, Gen AI and the large language models that underpin it, could eventually help security teams to predict future threats and help shape cybersecurity strategies based on those threats. For example, the tech giant Google wants to help businesses find and validate potential security issues “before they become an incident”.

Final thought

With the volume and sophistication of cybersecurity attacks set to increase, the time to explore Gen AI is now. Initially it makes sense to start small-scale and focus on achieving incremental productivity wins. Learnings from these small experiments will inform the bigger picture around Gen AI’s role in financial services companies’ cyberdefence strategies.