ASIC, APRA urge finance sector to demonstrate AI threat response

ASIC and APRA have called on financial services firms to move beyond awareness of frontier artificial intelligence (AI) risks and demonstrate they can respond to threats unfolding at unprecedented speed.

The regulators' warning follows nine industry roundtables held across June and July, involving more than 600 attendees from more than 380 entities across the financial system.

The discussions, supported by the Australian Signals Directorate and involving the Reserve Bank of Australia, Treasury and the ACCC, found frontier AI is accelerating existing cyber, technology and operational risks while creating new risks from increasingly autonomous systems.

ASIC commissioner Simone Constant said the urgency of the threats required firms to ensure their resilience measures had been tested before and incident occurrs.

"Threat actors are exploiting frontier AI models to identify and exploit vulnerabilities that previously may have taken a team of professional's months to find," Constant said.

"Boards and executives must move beyond awareness and ensure their organisations have well-tested response plans and understand where they are vulnerable, so they can respond effectively under pressure."

The regulators highlighted cyber fundamentals including timely patching, strong identity and access controls, attack surface reduction, backup integrity and tested recovery arrangements as key areas of focus.

Boards and executives were also urged to establish risk appetite, escalation authority, recovery priorities and communication strategies before a crisis, given frontiers AI could compress incident response timeframes.

Defensive AI is emerging as a potential tool for threat intelligence, vulnerability detection, code review and incident response, although participants noted governed and scalable capability remains limited and should not relace fundamental cyber controls.

APRA deputy chair Therese McCarthy Hockey said the roundtables demonstrated the value of information sharing across an interconnected financial system.

"A particularly encouraging theme that stood out was the willingness of more advanced entities to share practical insights, lessons and approaches with peers and less mature entities." McCarthy Hockey said.

"This is precisely the type of 'Team Australia' mindset that is needed to shore up resilience across our highly interconnected financial system."

The regulators also warned shared reliance on cloud, software, telecommunications, payments infrastructure and AI providers could amplify disruptions across the sector, making dependency mapping, supplier assurance and industry wide threat intelligence increasingly important.

ASIC and APRA said preparedness would remain a heightened regulatory focus as entities move from understanding frontier AI risks to demonstrating practical resilience.