Artificial intelligence is accelerating change across financial services, tightening the gap between innovation in operations and exposure to cyber risk.
Earlier this year, Anthropic revealed that one of its frontier AI models could autonomously discover serious software vulnerabilities – including flaws that had gone undetected for decades. For banks and fintech providers, the announcement reinforced a growing concern across the industry: AI is about to accelerate the speed of cyber threats in ways most organizations have never experienced before.
At the same time, financial institutions are actively looking for practical ways to use AI to improve operations, payments, and customer experience.
Finzly recently previewed new AI capabilities to customers, with broader rollout plans ahead. We spoke with our Chief Information Security Officer, Supro Ghosh, about balancing innovation with security, what banks should really be worried about, and why the industry needs to stay grounded as AI adoption accelerates.
There’s a lot of anxiety right now around AI-driven cyberattacks. Are the concerns justified?
Finzly CISO: The concerns are real, but I’d separate the signal from the noise.
AI is absolutely going to accelerate vulnerability discovery and exploitation. The timeline between “a weakness exists” and “someone is actively trying to exploit it” is getting shorter.
That’s a meaningful shift for the industry.
But some of the public conversation makes it sound like traditional cybersecurity suddenly no longer matters. That’s not true. Strong fundamentals – secure development, layered controls, patch discipline, monitoring, identity management – still make an enormous difference.
The organizations that struggle will be the ones treating AI risk as a future problem instead of an operational one happening now.
Finzly is beginning to surface AI capabilities to customers. Are financial institutions structurally prepared for AI within core banking environments?
Finzly CISO: Banks are interested, but they’re appropriately cautious – and honestly, they should be.
What we’re hearing from customers is: “Show us the value, but also show us the governance.”
That’s why we’ve taken a measured approach. AI is part of our platform, and customers have already seen some of the capabilities we’re developing. In banking, trust and operational resilience matter more than hype cycles.
Any AI capability introduced into production goes through the same governance, security, privacy, and compliance processes as every other critical platform capability.
The first question many banks ask is probably: “What happens to my data?”
Finzly CISO: Exactly – and it should be the first question.
Customer payment data is not being sent to public AI platforms for training, and we maintain strict controls around how data is classified, accessed, and processed.
There’s a huge difference between controlled enterprise AI use and broadly exposing sensitive financial information to external AI ecosystems.
Banks want clarity around that distinction, and rightly so.
Has AI changed the way you think about software and infrastructure risk internally?
Finzly CISO: Definitely.
One of the biggest changes is around speed. Security teams now have to assume vulnerabilities will be discovered faster and potentially weaponized faster.
That’s increased our focus on reducing exposure windows – continuous vulnerability scanning, faster patch deployment, tighter software supply chain visibility, SBOM management, dependency tracking, all of it.
We’ve also continued strengthening the fundamentals: MFA enforcement, least-privilege access, network segmentation, secure SDLC practices, and continuous monitoring across environments.
AI raises the stakes operationally. It doesn’t eliminate the importance of discipline.
Are banks underestimating third-party AI risk?
Finzly CISO: In some cases, yes.
A lot of organizations are still focused primarily on their own AI usage while underestimating how quickly AI is spreading across vendor ecosystems, subprocessors, and service delivery chains.
That’s becoming a major governance question for the entire industry.
We’ve expanded our vendor risk focus around AI governance, third-party data handling, oversight controls, and downstream compliance exposure because those risks can cascade very quickly in financial services.
What do you think banks should realistically expect over the next couple of years?
Finzly CISO: AI will become embedded into banking operations much faster than most people think.
The differentiator won’t be who adopts AI first. It’ll be who operationalizes it responsibly.
Banks should be looking closely at governance maturity, security controls, data handling practices, transparency, and operational resilience – not just feature lists.
At Finzly, our approach is straightforward: move forward deliberately, communicate clearly with customers, and introduce AI capabilities in a way that strengthens trust instead of creating uncertainty.
Because in financial services, trust is still the product.
