CFA Society Netherlands: Risk managers are too slow to embrace AI

CFA Society Netherlands: Risk managers are too slow to embrace AI

October 22, 2026

Artificial Intelligence

This column was originally written in Dutch. This is an English translation.

The conventional approach to cyber risk management is under pressure. Time pressure, that is. After all, how do you protect yourself against the latest generation of AI models, which are able to identify and exploit vulnerabilities at an ever-increasing rate?

By Can Yilmaz, Regulatory & Compliance Consultant and member of the Advocacy Committee of the CFA Society Netherlands

This year, financial authorities around the world have been issuing strikingly unanimous warnings about the cyber risks posed by the latest generation of AI models. And with good reason. These cutting-edge AI models now have the capability to autonomously identify and exploit vulnerabilities in widely used ICT systems and shared infrastructure in a matter of moments. This poses a threat to the stability of the financial sector, according to the European Systemic Risk Board.

This technological acceleration stands in contrast to the traditional risk management practices of financial institutions. These are specifically designed to involve careful assessment: vulnerabilities are assessed individually in terms of severity, likelihood of exploitation and potential impact. Based on the level of risk, security updates are then tested and rolled out in a controlled manner. This takes time and resources, and often requires the involvement of external suppliers.

The current way of working comes under pressure when attackers, armed with advanced AI, expose a significantly greater number of vulnerabilities. This quickly leads to capacity issues on the defensive side, meaning that high-risk vulnerabilities may be addressed (too) late, whilst lower-risk ones might be left unaddressed altogether. The current system is at risk of no longer being able to keep up with the pace.

So what do you do as a risk manager? The traditional options are not becoming any more appealing. Updating more frequently increases the risk of incidents, continuing extensive testing leaves systems vulnerable for longer, and strict prioritisation means other weak spots remain unaddressed. But what is the solution, then?

Part of the answer lies further up the supply chain. The DORA Regulation already requires financial entities to embed security into ICT systems during development and to test them thoroughly before they go live – in other words, ‘secure by design’. According to the European Commission, AI can be widely deployed within that development cycle, for example by automatically analysing code for security vulnerabilities.

The European Union Agency for Cybersecurity (ENISA) is also calling for defences to be scaled up to ‘machine speed’. This means far-reaching automation and the use of AI in security processes, for example in the analysis and prioritisation of vulnerabilities and the (almost) immediate detection of anomalous activity. The aim is for security teams to be able to respond almost immediately.

That is easier said than done. Scaling up to that level is a major challenge for many (particularly smaller) organisations. That is why cooperation amongst themselves and with government organisations remains crucial. Regulators also play an important role by continuing to rigorously monitor compliance with the DORA Regulation and the European Cybersecurity Regulation. Without ‘machine-speed defence’, the risk manager may be too slow for AI, but at least they are not on their own.
 

Read the full column in Financial Investigator magazine

Related posts