#UAE #cybersecurity - Dubai Financial Services Authority (DFSA) has published a new research paper on how frontier and agentic AI could weaken banks’ cyber defences. Developed in collaboration with the Cambridge Digital Innovation and Regulation Initiative (C:>DIR), the study tests resilience on four measures: speed, reach, authority and trust. The research examines how AI agents that can use connected tools and act under delegated authority make attacks faster, harder to trace and harder to recover from, especially through shared cloud, identity and model providers.
SO WHAT? - Banks routinely check whether AI models are accurate and approved. The DFSA’s study finds that this is the wrong question. The research asks what an AI system can access, what it is allowed to do and what happens when it goes wrong. Financial firms can use the four tests of speed, reach, authority and trust identified by DFSA to map their AI workflows against owners, permissions, dependencies and recovery plans, and to spot weak points before an incident exposes them.
KEY POINTS:
Dubai Financial Services Authority (DFSA) and Cambridge Digital Innovation and Regulation Initiative (C:>DIR) have published a new research paper: “Frontier and agentic AI: cyber resilience in the financial sector”. The stud examines how AI that can use connected tools and act under delegated authority changes the conditions for cybersecurity, operational resilience and third-party risk.
According to the study, frontier AI can speed up vulnerability analysis and multi-step cyber activity. Meanwhile, agentic systems can add the ability to choose steps, use tools and carry out actions inside a financial institution’s own systems.
The research paper lists the key areas of exposure as deception and impersonation, credential misuse, manipulation of authorised agents and compromise through trusted third-party connections. It also warns that attackers and defenders don’t improve on the same timetable.
The research’s first measure, ‘speed’, asks whether a firm can safely cut serious exposure before damage occurs. The paper finds that faster detection doesn’t necessarily mean faster, safe fixes, because firms will still need to find affected systems, test changes and keep critical services running.
The ‘Reach’ measure evaluates whether firms understand shared dependencies beyond their direct suppliers, such as common AI models, cloud services, identity services and recovery routes. For example, one failure could hit several operations at once, and backup options may not be independent.
The paper’s third measure, ‘Authority’, asks whether AI actions stay within their intended mandate. The paper notes a system can act within its technical permissions and still produce an outcome its owners never intended, so access controls alone aren’t enough.
Finally, the fourth measure, ‘Trust’, asks whether a firm can establish what happened, stop unfinished activity and resume safely. Stopping an agent doesn’t cancel pending instructions or reverse completed actions, and restored services can still hide altered settings or inconsistent records.
The DFSA paper says controlled tests and reported incidents show advancing capability, but don’t give a reliable estimate of how often incidents occur, what they cost or how widely they spread. According to the the report, more demanding testing and continued preparedness are required to meet the new threats.
The new research confirms that existing governance and risk frameworks remain the foundation for cyber defence against new AI threats, but stronger evidence is needed. For example, a patching deadline doesn’t prove exposure fell, and a varied supplier list doesn’t prove fallback plans work.
[Written and edited with the assistance of AI]
Source: DFSA
DOWNLOAD
Read more about AI and DIFC:
Scale AI opens in Dubai, its third Gulf hub (Middle East AI News)
Dubai AI Campus targets 1,000 firms and 5,000 jobs (Middle East AI News)
DIFC gets first AI-native asset manager (Middle East AI News)
Dubai-based Algebra AI nets $7M funding (Middle East AI News)
DIFC set to become first AI-native financial centre (Middle East AI News)