Advances in artificial intelligence are materially increasing the speed, scale and sophistication of cyberattacks. AI agents can independently identify vulnerabilities, generate exploits and support highly targeted social-engineering campaigns, significantly reducing the time available for detection and remediation. Financial institutions are particularly exposed due to their complex technology landscapes, concentration in critical third-party providers and systemic importance. The ECB has therefore made AI-enabled cyber risk an immediate supervisory priority, with DORA remaining the binding regulatory foundation.

Our analysis translates the ECB’s expectations into practical implications for operational risk management and cyber resilience. It assesses how AI-enabled vulnerability discovery, automated exploit generation, advanced phishing and attacks at scale affect governance, risk tolerance, vulnerability and patch management, monitoring and detection, crisis response, business continuity, third-party dependencies and software supply chains. It also considers the required alignment of short-term actions and long-term security architecture with DORA.

Established remediation cycles and predominantly manual control processes are no longer sufficient for machine-speed threats. Institutions should move towards near-real-time remediation, AI-supported monitoring, zero-trust controls, enhanced resilience testing and measurable risk thresholds, supported by clear board oversight. We can assist with an ECB/DORA gap assessment, preparation and PMO delivery of the board-approved action plan, redesign of patching workflows and service-level agreements, AI and third-party concentration risk mapping, vendor assessments, cyber-resilience simulations and ongoing steering through threat-intelligence briefings and vulnerability scorecards.

BDO Risk Excellence AI & Cyber Risks

This article was written by