Financial institutions are adopting artificial intelligence to analyze data, manage projects and improve operations. At the same time, AI can help cybercriminals create more convincing phishing messages, automate reconnaissance and exploit everyday gaps in data protection. The central challenge for banks and insurers is to capture AI’s benefits while controlling risks to customer information, critical systems and financial services.
How are financial institutions adopting AI?
Kaspersky research found that banking, financial services and insurance (BFSI) organizations use AI for data analysis more often than the overall market: 59% compared with 54%. AI-assisted project management follows a similar pattern, at 54% in BFSI versus 49% overall.
These applications typically support decisions rather than carry out financial transactions directly. That distinction can limit the immediate impact of an inaccurate result: a poor analysis may waste time, while an error in a live transaction system can cause direct financial harm. Financial institutions appear more comfortable using AI where employees can review outputs before acting on them.
The sector also expects its AI use to grow. In the research, 19% of BFSI respondents said their organization planned to increase its use of external AI tools, compared with 15% across the market. For internally developed AI tools, the figures were 8% and 7%, respectively.
How does AI increase cybersecurity risks in finance?
AI can make familiar cyber threats more convincing and easier to scale. Attackers can use it to draft persuasive phishing messages, imitate voices, produce fraudulent documents and tailor scams to specific targets. These capabilities can make it harder for employees and customers to distinguish legitimate communications from fraud.
AI can also help attackers research targets and adapt their methods more quickly. In financial services, this can strengthen social engineering, targeted fraud and attempts to manipulate markets. AI does not replace established threats such as phishing and ransomware; it can make those threats faster, more personalized and more difficult to detect.
Technical controls remain essential, but people also need to identify suspicious messages and verify unusual requests. Financial organizations should treat AI-enabled deception as an extension of existing fraud risks and reinforce verification procedures for sensitive transactions, account changes and urgent requests.
What is shadow AI, and why is it a concern for banks?
Shadow AI is the use of AI tools without an organization’s approval or oversight. An employee might paste customer information, financial records or internal documents into a public chatbot to summarize or analyze them. If the tool is not authorized for sensitive data, that information may leave the organization’s controlled environment without triggering conventional security alerts.
Kaspersky’s research found that 37% of BFSI respondents viewed unauthorized employee use of AI tools as a common risky behavior, compared with 30% across the broader market. Although 85% of BFSI respondents said they were aware of AI-related risks, 9% believed those risks could not be eliminated. Awareness alone does not prevent data exposure: employees also need approved tools, clear rules and practical safeguards.
Financial institutions can reduce shadow AI by making secure use straightforward:
- Define approved tools: Publish a clear list of AI services employees may use for work.
- Set data-handling rules: Specify which information employees may share with each tool, including restrictions on customer and financial data.
- Control access: Apply permissions appropriate to each user, service and business task.
- Monitor usage: Give security teams visibility into AI tools and data flows, while respecting applicable privacy requirements.
- Train employees: Use practical examples to show how to recognize unsafe prompts, suspicious outputs and sensitive information.
- Review tools regularly: Assess approved services, locally hosted models and internally developed systems as their capabilities and risks change.
Why are financial organizations cautious about AI-generated code?
Only 23% of BFSI organizations in the research reported using AI for programming, compared with 34% across the overall market—a gap of 11 percentage points. The figures do not establish why the sector uses AI coding tools less often, but the potential consequences of software errors offer one possible explanation.
An inaccurate analysis can be checked and corrected. A defect in code used by a critical financial system may persist, spread to other applications or disrupt essential services. Organizations should therefore apply stronger review and testing requirements when AI contributes to software that supports payments, customer accounts or other critical operations.
AI coding tools need not be treated as all-or-nothing. Financial institutions can define permitted use cases, restrict access to sensitive code and data, require human review, and test generated code before deployment. The level of control should reflect the system’s importance and the potential impact of failure.
How can financial institutions use AI safely?
Effective AI security combines governance with established cybersecurity controls. Organizations should decide which tools employees can use, what data those tools may process, and what permissions AI systems or agents receive. They should also specify where human approval is required, especially for actions that could affect customers, money or critical services.
AI can strengthen security operations as well as create new risks. Security teams can use AI-supported tools to identify suspicious activity, connect signals across systems, prioritize alerts and speed up incident investigations. For example, an analyst may use these capabilities to examine an obfuscated command line or link separate stages of an attack into a clearer sequence of events.
These tools support security professionals; They do not replace sound infrastructure or human judgment. Organizations should retain analyst oversight for consequential decisions and combine AI-enabled detection with established protections against external attacks.
What should banks and insurers prioritize?
Financial organizations can take a practical, risk-based approach: establish AI-use policies, provide approved alternatives to unsanctioned tools, protect sensitive data, limit system permissions and require review of high-impact outputs. In parallel, they should maintain core cybersecurity defenses and assess how AI can help security teams respond to increasingly sophisticated threats.
The research points to a sector that is adopting AI while remaining cautious about areas where errors could have serious consequences. The strongest approach brings AI governance and cybersecurity together: it supports useful applications while protecting customer data, financial systems and critical decisions.
Be the first to comment