Panel: Cyber Resilience in Financial Services: Staying Ahead in the Age of AI

Panel: Cyber Resilience in Financial Services: Staying Ahead in the Age of AI

Speakers: Cristian Manescu (CEO, Data Core Systems, Romania); Alessandro Miracca (Cyber Security Director, Mastercard); Larisa Gabudeanu (Cybersecurity professional); Gheorghita Cristinel Calita (Cybersecurity professional, CISO, Salt Bank); Brennan Lodge (Director of Information Security, Manhattan Institute)

Conference: DefCamp

YouTube: https://www.youtube.com/watch?v=ALhiPHKNq14

Overview

The DefCamp panel, "Cyber Resilience in Financial Services: Staying Ahead in the Age of AI," brought together a distinguished group of cybersecurity leaders from the financial sector to dissect one of today's most pressing challenges. Moderated by Cristian Manescu, CEO of Data Core Systems, the discussion featured insights from Brennan Lodge (Manhattan Institute), Gheorghita Cristinel Calita (Salt Bank), Larisa Gabudeanu (Cybersecurity professional), and Alessandro Miracca (Mastercard). The core of the conversation revolved around defining and achieving cyber resilience in an era where artificial intelligence (AI) is rapidly transforming both the threat landscape and defensive capabilities.

The panel underscored the critical importance of moving beyond traditional cybersecurity paradigms to embrace a holistic approach that ensures continuous operation and rapid recovery in the face of inevitable disruptions. Financial services, a sector constantly under siege from sophisticated attackers and burdened by stringent regulations, faces unique pressures. The advent of AI introduces both unprecedented opportunities for enhanced defense and novel attack vectors, compelling organizations to rethink their strategies for maintaining operational integrity and customer trust.

This article delves into the panel's multi-faceted discussion, exploring the definitions of cyber resilience, the shared responsibilities across an organization, the tactical and strategic implications of AI, and the complexities introduced by cloud adoption. It distills the experts' advice on how financial institutions can effectively prepare, respond, and adapt to an evolving threat landscape, ensuring their ability to "lose as less as possible" during an incident and emerge stronger.

Background

▶ Watch: Introduction to cyber resilience in financial services (0:00)

The panel initiated its discussion by tackling the fundamental question: "What does cyber resilience mean?" The responses highlighted its multi-dimensional nature, extending far beyond merely preventing cyberattacks. Brennan Lodge defined it as the ability to "recover and recover quickly" from outages, differentiating it from a direct hack, and emphasizing the need for robust backup plans and good cybersecurity practices, especially when considering scenarios where AI might "go rogue." Gheorghita Cristinel Calita, from a financial sector perspective, described resilience as a "superpower" that allows organizations to "lose as less as possible" during an incident, involving complex processes from threat intelligence and counter-attack to rapid response and containment with minimal financial loss.

Larisa Gabudeanu added that cyber resilience involves understanding the entire "journey" from threat intelligence to security controls and testing (business continuity, penetration testing). Crucially, she stressed that resilience is not solely the domain of security or business continuity teams; it requires the active participation of "all of the other departments," including business units, IT, and even communications. Alessandro Miracca offered a philosophical perspective, defining resilience as the ability to "adapt to the circumstances," prevent, and diminish the impact of "unprecedented attacks" or "crisis scenarios." The moderator, Cristian Manescu, reinforced that in this context, resilience is tied not just to cyberattacks but also to broader operational resilience.

The discussion then shifted to accountability, with a consensus that "everyone is responsible" and "everyone's a cyber warrior." However, the panel acknowledged that ultimate accountability often rests with executive leadership. Brennan Lodge highlighted the effectiveness of annual tabletop exercises (e.g., ransomware, disaster recovery) in raising awareness and preparing the boardroom for tough decisions, citing real-world examples like dealing with annoying AI bots in meetings. Calita noted that in financial organizations, responsibilities are typically covered by internal governance frameworks and distributed among departments like technology and risk management. Larisa Gabudeanu emphasized the need to transpose these obligations into effective organizational processes, such as the Software Development Life Cycle (SDLC), vulnerability management, and incident response, also stressing the critical role of managing third-party vendors and their resilience capabilities. Alessandro Miracca summarized the pillars of cyber resilience as "people, process, and technology," advocating for shared responsibility, mature processes, and enabled technology, warning against vulnerabilities like "weak passwords in a backup tool" even with air-gapped systems.

A significant challenge identified was engaging non-technical top management, particularly those less experienced with technology. The panel offered strategies: speaking their language, using analogies, providing clear numbers and metrics (especially financial impact), building a reputation of honesty and trust, and involving them in role-playing during tabletop exercises to help them understand the consequences of their decisions. This context sets the stage for how AI and cloud services further complicate these already intricate dynamics.

Key Findings

▶ Watch: Engaging non-technical stakeholders on cyber risks (19:00)

The panel discussion yielded several crucial findings regarding cyber resilience in financial services, particularly in the age of AI:

1. Cyber Resilience is Holistic and Organizational-Wide: The panelists unanimously agreed that cyber resilience transcends traditional cybersecurity, encompassing broader operational resilience. It's a continuous "journey" that demands shared responsibility and active participation from all departments—business units, IT, communications, and executive leadership—not just dedicated security or business continuity teams. This holistic view is crucial for minimizing financial losses and ensuring rapid recovery from diverse incidents.

1. AI: A Double-Edged Sword: AI emerged as both a significant threat vector and an indispensable defensive tool. Attackers are rapidly leveraging AI for more sophisticated social engineering, prompt injection attacks, and automated malware generation (e.g., FraudGPT). Simultaneously, defenders must adopt AI to manage the "deluge of data," automate Security Operations Center (SOC) tasks, enhance threat intelligence, and streamline governance, effectively using AI to fight AI.

1. Strategic Communication to Leadership is Paramount: A recurring theme was the difficulty of engaging non-technical top management. The key finding here is the necessity for cybersecurity professionals to "speak their language"—translating technical risks into quantifiable financial impacts (e.g., "lose X million in case of ransomware"), using analogies, and building a reputation of honest, data-driven communication. Tabletop exercises and crisis simulations were highlighted as invaluable tools for educating and preparing executives for real-world decision-making.

1. Human Oversight Remains Indispensable for AI: Despite the promise of AI, panelists expressed caution, noting issues like "hallucinations" and the "black box" nature of neural networks, which make pinpointing decision-making difficult. The consensus was that human oversight, knowledge, and critical thinking are still essential to ensure AI's reliability and to safeguard against its potential failures, especially in high-stakes financial environments. The idea of a "panic button" for AI was even mentioned, underscoring the need for human control.

1. Cloud Adoption Introduces New Resilience Complexities: The increasing migration of financial services to public cloud environments, particularly in Europe, presents a complex trade-off. While cloud providers offer advanced resilience mechanisms and mitigate internal skill shortages, they introduce challenges related to data residency, model residency, shared responsibility models, and geopolitical risks. Developing robust multi-cloud or hybrid strategies and strong contractual agreements with providers is critical for mitigating these evolving risks.

Technical Deep Dive

▶ Watch: AI failures and the necessity of human oversight (38:30)

The panel's discussion, while conversational, offered significant technical insights into both leveraging AI for cybersecurity and securing AI systems themselves, alongside the technical considerations for cloud resilience.

AI for Defensive Capabilities:

Brennan Lodge highlighted AI's potential to address the "deluge of data" faced by SOC analysts, helping to synthesize information, interpret complex threat reports (often 100+ pages), and reduce the overwhelming queue of alerts to zero. He envisioned AI as a tool that "raises all boats of knowledge" for junior analysts, helping them understand network layers, application security, host security, and complex regulations. Larisa Gabudeanu expanded on this, citing valid use cases for embedding AI in SOC departments, threat intelligence analysis, threat modeling, and threat hunting. She also noted its potential for governance automation, particularly in continuous monitoring initiatives like those from ENISA. Alessandro Miracca mentioned AI's utility for internal purposes such as examining "huge amount of data" for simulations and supporting document creation, always with human supervision. The overarching theme is AI acting as a "supercharged security analyst" (Calita), capable of processing vast amounts of information quickly and precisely, freeing human analysts from false positives and allowing them to focus on deeper investigations.

Cybersecurity for AI Systems:

The panel stressed the critical need for "cybersecurity for AI." Larisa Gabudeanu proposed treating AI as any other new technology, like cloud or blockchain, requiring a deep understanding of its maturity and specific risks. She identified challenges such as "shadow AI" (unauthorized AI use within an organization) and the need for new security controls like input validation for AI (analogous to web application security) and prompt inspection to detect and prevent attacks like prompt injection. She also emphasized detecting model poisoning and correlating these new attack types and security solutions with existing SIEM and SOAR platforms for centralized alert management. Alessandro Miracca reinforced the need to "safeguard" AI by instructing Large Language Models (LLMs) to limit certain behaviors and prevent the production of harmful content.

Brennan Lodge offered a pragmatic technical approach for securing AI implementations, advocating for a "peace meal approach" starting with smaller, manageable projects. He specifically mentioned Retrieval Augmented Generation (RAG) as a viable strategy, allowing organizations to manage their own vector database (on-prem or within their network) and use a localized LLM, rather than relying solely on external APIs like OpenAI. This approach addresses the "trust but verify" principle in security, especially given the "black box" nature of neural networks where "researchers who are building and training and fine-tuning these models... have no freaking clue" how certain decisions are made. To counter this, Lodge emphasized applying "age-old implementations of good cyber security practices" to AI: robust auditing, comprehensive logging of questions asked to the LLM and its results, and continuous monitoring.

Attacker's Use of AI:

The darker side of AI was also thoroughly explored. Gheorghita Cristinel Calita warned that AI is rapidly becoming a "norm for threat actors," leading to AI-assisted social engineering and sophisticated prompt injection attacks. Alessandro Miracca provided concrete examples, noting the existence of tools like FraudGPT, which can "produce social engineering campaigns, QR codes that connect you with real domains," and phishing pages designed to steal credentials. He also mentioned AI's potential for automated malware generation, underscoring the need for defenders to keep pace with these augmented threats.

Cloud Resilience in Financial Services:

A significant technical segment was dedicated to the complexities of cloud adoption. An audience question highlighted the difficulty for European financial institutions to achieve resilience using mostly US public cloud providers, especially given geopolitical contexts and widespread outages (e.g., Microsoft DNS issues, AWS outages). Calita acknowledged that public cloud extends the attack surface but stressed that risks are assessed, controls identified, and responsibilities are "shifted a little bit" but not ignored, requiring strong partnerships and contracts with service providers.

Brennan Lodge introduced the crucial concepts of data residency and model residency in cloud environments. He posed questions about fallback mechanisms if a model goes down in a specific region (e.g., AWS East) and the regulatory implications of data residing in Europe while models are in the US. Larisa Gabudeanu suggested multi-cloud or hybrid cloud strategies and robust plans for identification and authentication across these diverse environments to ensure rapid recovery. Alessandro Miracca noted the trend of full cloud migrations in financial services (e.g., a small Italian retail bank) but cautioned against viewing it as a "golden rule." He argued that while cloud providers like Amazon, Google, and Microsoft offer superior mechanisms and support, especially given internal skill shortages and legacy on-prem systems, organizations must carefully evaluate costs, support, and the providers' brand reputation as a security assurance. The geopolitical aspect of relying on non-European cloud providers for critical financial infrastructure remains a significant, unresolved technical and strategic challenge.

Demo / Proof of Concept

▶ Watch: Practical approach to AI implementation in security (43:00)

As a panel discussion, this session did not include any live demonstrations, technical walkthroughs, or specific proof-of-concept presentations. The format focused on expert discussion, shared experiences, and strategic insights rather than hands-on technical showcases.

Defensive Implications

▶ Watch: Pragmatic view on cloud adoption for financial sector (63:30)

The panel provided a wealth of actionable advice for financial institutions aiming to bolster their cyber resilience in the age of AI. These defensive implications span strategic planning, operational execution, technological adoption, and organizational culture.

1. Embrace a Holistic Resilience Strategy: Defenders must recognize that cyber resilience is not just about preventing attacks but ensuring operational continuity and rapid recovery. This means integrating security into every aspect of the business, from software development (SDLC) to business continuity and disaster recovery planning. Organizations should actively map out their "resilience journey" and involve all departments, not just IT and security, fostering a culture where "everyone's a cyber warrior."

1. Proactive Risk Management and Executive Engagement: Regular and realistic tabletop exercises are crucial for preparing both technical teams and executive leadership for various incident scenarios, including ransomware and AI-related disruptions. Cybersecurity professionals must learn to communicate risks in the "language of the boardroom," translating technical vulnerabilities into quantifiable financial impacts and potential losses. Building a reputation of honesty and providing clear, data-driven insights (e.g., "lose X million in case of ransomware") is essential for securing budget and executive buy-in for resilience initiatives.

1. Strategic Adoption of AI for Defense: Financial institutions should proactively explore and implement AI solutions to enhance their defensive capabilities. This includes leveraging AI for automating SOC operations, improving threat intelligence analysis, streamlining threat modeling, and accelerating threat hunting. AI can act as a force multiplier, helping analysts process vast volumes of data, identify anomalies, and respond more efficiently, effectively using AI to counter AI-powered attacks.

1. Secure AI Implementations with Human Oversight: While adopting AI, organizations must implement robust security practices for the AI systems themselves. This involves treating AI as a new technology requiring specific security controls, such as input validation for AI, prompt inspection to detect injection attacks, and mechanisms to prevent model poisoning. Crucially, human oversight must be maintained; AI should augment, not replace, human intelligence and decision-making, especially given the "black box" nature of some AI models and the risk of "hallucinations." Starting with smaller, manageable projects (e.g., Retrieval Augmented Generation (RAG) with localized LLMs and vector databases) can help build confidence and secure AI effectively. Comprehensive auditing, logging, and monitoring of AI interactions are non-negotiable.

1. Develop Robust Cloud Resilience Strategies: For institutions migrating to or heavily relying on public cloud services, a sophisticated cloud resilience strategy is paramount. This includes implementing multi-cloud or hybrid cloud architectures to avoid single points of failure and mitigate geopolitical risks associated with data and model residency. Strong contractual agreements with cloud providers are essential, clearly defining responsibilities, service level agreements (SLAs) for recovery, and assurances regarding data and model residency. While leveraging the advanced security and resilience mechanisms offered by major cloud providers can be beneficial, organizations must still maintain their own oversight and recovery plans.

1. Continuous Learning and Process Maturity: The rapidly evolving threat landscape, exacerbated by AI, necessitates continuous learning and adaptation. Organizations should embed "lessons learned" processes from every incident or even minor alert to refine their security controls, incident response plans, and overall resilience posture. Mature processes, coupled with ongoing training and awareness programs for all employees, are foundational to maintaining a robust and adaptive cyber resilience framework.

Key Takeaways

• Holistic Resilience is Paramount: Cyber resilience extends beyond technical security, requiring a comprehensive, organization-wide approach that integrates operational continuity, shared responsibility, and rapid recovery capabilities across all departments.
• AI: A Dual-Edged Sword Requiring Strategic Management: AI presents both advanced offensive capabilities for attackers and powerful defensive tools for organizations. Defenders must strategically adopt AI for tasks like SOC automation and threat intelligence, while simultaneously implementing robust security measures (e.g., prompt inspection, model poisoning detection, human oversight) for AI systems themselves.
• Effective Communication Drives Buy-in: Engaging non-technical leadership is critical. Cybersecurity professionals must translate technical risks into quantifiable financial impacts and business language, using tabletop exercises and honest reporting to build trust and secure necessary resources.
• Cloud Resilience Demands Sophisticated Strategies: While public clouds offer benefits, they introduce complexities like data/model residency and geopolitical risks. Organizations must implement multi-cloud or hybrid strategies, with strong contractual agreements and clear accountability, to ensure resilience.
• Human Oversight and Mature Processes Remain Foundational: Despite technological advancements, human knowledge, oversight, and well-defined, mature processes are indispensable. They provide the critical "panic button" and contextual understanding needed to guide AI, respond to incidents, and continuously adapt to evolving threats.

About the Speaker(s)

• Cristian Manescu: CEO of Data Core Systems in Romania, Cristian Manescu served as the panel's moderator, bringing over 20 years of experience in the IT and cybersecurity sector to guide the discussion.
• Alessandro Miracca: As Cyber Security Director at Mastercard, Alessandro Miracca is responsible for the delivery of cybersecurity services across Europe, offering insights from a major global financial institution.
• Larisa Gabudeanu: A seasoned cybersecurity professional, Larisa Gabudeanu contributed expertise on integrating resilience into organizational processes and managing AI security.
• Gheorghita Cristinel Calita: A cybersecurity professional and CISO at Salt Bank, Gheorghita Cristinel Calita provided perspectives from the banking sector on defining and achieving resilience.
• Brennan Lodge: Director of Information Security at the Manhattan Institute, Brennan Lodge shared practical experiences from his role, including his background as a SOC analyst, and discussed strategies for engaging executive leadership.