By Ralfi Vaso, Underwriter, Alta Signa
For years, cyber risk in financial institutions was framed around a familiar set of concerns: ransomware, business interruption, data theft and the ever-present question of who might be next. Those concerns have not gone away. But in 2026, the character of the threat is changing.
It is becoming faster, more convincing and more difficult to spot early.
Artificial intelligence is a big reason why. What was once a numbers game built around mass phishing emails and blunt social engineering has become far more personalised. Fraudsters can now mimic tone of voice, generate convincing identity documents, build believable fake investment content and automate attacks across multiple languages at scale. European regulators are already warning that AI is being used to power online financial fraud and scams, while industry data points to a sharp rise in deepfake-led fraud attempts across the financial sector.
That matters enormously for banks, lenders, asset managers and other financial institutions because trust is the product as much as the balance sheet is. A successful cyber event does not need to take core systems offline to cause real damage. In many cases, the greater harm comes from manipulated payments, compromised onboarding, impersonated executives, poisoned communications and shaken customer confidence.
At the same time, the risk is expanding beyond the organisation itself. Increasing reliance on third-party technology providers - particularly cloud services - means vulnerabilities often sit within the wider ecosystem. Regulators, including the ECB, continue to highlight concentration risk as a key concern.
Encouragingly, frameworks like DORA are helping firms move beyond prevention toward true operational resilience, focusing on recovery, testing and dependency management. But the reality is clear: controls alone are not enough.
Financial institutions need to strengthen identity verification, introduce deliberate friction into high-risk processes and take a broader view of resilience that includes suppliers and partners. Just as importantly, the response to cyber risk must become more collaborative: spanning insurers, banks, brokers and technology providers.
That is where the conversation should be now. Not whether AI-driven cyber crime is coming for financial institutions. It already is. The real question is which firms are adapting quickly enough to stay credible, resilient and trusted when the next incident lands.
Read the full article in European Financial Review