[Student IDEAS] by Hugo Jalet - Graduate of the Global BBA at ESSEC Business School
Artificial intelligence is fundamentally altering the statistical nature of cyber risk in finance, shifting it from an isolated, firm-specific operational threat into a correlated, fat-tailed financial variable. By moving attack vectors from network perimeters to training data and foundation models—and with high market concentration across a few cloud and AI providers—AI-driven threats introduce heavy-tailed loss severity, accelerated industry-wide propagation, and extended detection lags where malicious interventions hide as ordinary "model drift." Because existing financial pricing, capital buffers, and board governance remain calibrated to pre-AI historical data, institutions are running an unpriced tail risk that threatens equity financing, liquidity, and balance sheet stability; addressing this requires integrating cyber and AI governance, stress-testing for multi-day operational outages, and sizing capital against third-party concentration.
---
In early 2024, a finance employee at the British engineering firm Arup joined what looked like a routine video call with her chief financial officer (CFO) and several colleagues. By the end of it, she had authorised fifteen transfers totalling roughly $25 million to accounts in Hong Kong. Weeks later, the firm discovered that every participant on the call, CFO included, was a deepfake: a hyper-realistic fake video and voice, generated by artificial intelligence (AI), that impersonates a real person.1 The story made headlines for a few days, then faded. It should not have. By mid-2025, deepfake-enabled fraud alone had driven close to $900 million in reported losses globally, with more than $410 million concentrated in the first half of the year, already exceeding the total for all of 2024.2
The Arup incident is usually told as a story about weak verification protocols and the need for better employee training. That framing is not wrong, but it is far too narrow. Arup lost money on a single wire; the underlying phenomenon is something finance has not yet priced. Artificial intelligence is quietly reshaping what cyber risk looks like as a statistical object. Losses are becoming less idiosyncratic and more correlated, tails are fatter, detection is slower, and propagation across firms is faster, largely because banks, insurers, and asset managers increasingly share the same foundation models, training data, and cloud vendors.
This matters because finance has, for more than a decade, treated cyber as primarily an operational and compliance issue: a cost line, a maturity score, an audit-committee bullet. That mental model was already strained, and in an AI-driven system, it quietly breaks. Cyber resilience is no longer a sidebar; it is a financial variable whose distribution has shifted, and which neither markets nor most institutions have repriced. The practical question for boards, chief risk officers (CROs), and investors is therefore not "how much more should we spend on security?" but "how must we redesign governance, capital planning, and disclosure once the tail of cyber losses has moved?"
To see why the familiar playbook no longer fits, it is worth being precise about what is genuinely new.
The past decade of digital transformation in finance mostly expanded what cyber risk could affect: more systems online, more data in motion, more third parties in the chain. Artificial intelligence does something different. It shifts four properties of the loss distribution itself, and each of these shifts quietly erodes the "perimeter plus patch" mental model (the assumption that security means defending a network boundary with firewalls and access controls, then closing known software flaws with timely patches) that still governs most cyber budgets.
The attack surface moves from code and credentials to data and models. Classical cyber defence is organised around code, infrastructure, and identities: firewalls, segmentation, access controls, patch cycles. An AI system is a different object. It can be compromised by corrupting the training data itself, before a single credential is ever stolen. Yerlikaya and Bahtiyar (2022) show how quickly this matters. They study data poisoning, which means deliberately corrupting part of the training data, the data used to teach and build a model. Across four datasets (spam, botnet, malware, and medical diagnostics) and six standard algorithms, the researchers deliberately altered the correct classifications in a quarter of the training data (labelling spam as legitimate, for instance). This alone cut classification accuracy by 15 to 40 percentage points, and when half of the training data was corrupted, model performance collapsed in several configurations. Transposed to finance, this is a structurally new threat: a well-placed intervention in the training pipeline (the process that collects, prepares, and feeds data into a model while it is being built) of a credit-scoring model, a transaction-monitoring engine, or an algorithmic pricing system does not need to breach the firewall to cause losses.
These threats target two distinct stages in the life of an AI system. At training time, while the model is being built, data poisoning and training-set contamination corrupt what it learns. At inference time, when the trained model is being used to make real decisions, attackers exploit it through prompt injection (hiding malicious instructions in the text or data the model reads) and model manipulation (feeding it carefully crafted inputs, or tampering with the model itself, so that it produces the outputs the attacker wants). Both bypass the controls built for the old perimeter: neither needs to breach a firewall or steal a credential, because the vulnerability lives in the data and the model itself, not at the network boundary. They now sit beside ransomware and phishing on the threat list.
Detection lag lengthens because model failure looks like drift. Traditional cyber incidents are largely binary. A system is down, an account is drained, a file is encrypted. AI failures are probabilistic. A poisoned fraud model does not stop working; it simply scores certain transactions a little more leniently. A manipulated credit model does not crash; it tilts approvals in a subtle direction. These incidents are easily reinterpreted as "model drift", an accepted, almost decorative feature of machine-learning (ML) models in production. The result is that the time between occurrence, discovery, and recognition stretches. Even without AI, the problem is already acute: using cross-country operational-loss data from seventy banks over sixteen years, Aldasoro et al. (2023) document an average lag of more than a year between when an operational loss occurs and when it is finally booked (formally recorded as a loss in the accounts), with a long-tailed distribution in which a meaningful share of events remain unaccounted for after two years. Layer on the probabilistic opacity of AI systems and one should expect that distribution to stretch further, not tighten. For capital and liquidity planning, the implication is unpleasant: by the time a model-level compromise is formally recognised, much of its damage may already have been absorbed into the balance sheet.
Timeline of an operational loss event. Source: Aldasoro et al. (2023). Three dates structure every loss event: occurrence, discovery, and recognition. AI-driven incidents stretch t₁ (occurrence → discovery) because probabilistic failures resemble model drift.
Propagation accelerates through shared models, shared data, and concentrated cloud providers. The novelty is blunt: banks, insurers, and asset managers no longer need to do business with each other to share cyber exposure; they only need to rely on the same foundation model, the same training corpus, or the same hyperscale cloud provider, so a single compromise can reach firms with no direct contractual link. This is a different transmission channel from the one finance is used to.
In the pre-AI cyber world, contagion travelled mainly through explicit economic linkages: interbank exposures, counterparty relationships, payment networks. The pre-mortem analysis of Fedwire by Eisenbach, Kovner and Lee (2022) already showed how powerful that channel alone could be. The impairment of any one of the five largest U.S. banks spills over to an average of 38% of the network. A shock concentrated on a single third-party service provider common to several large institutions does even more damage: it pushes the weighted share of impaired institutions to roughly 60%, with potential forgone payment activity reaching more than 2.5 times daily gross domestic product (GDP) once banks start hoarding liquidity.
That shared layer is no longer hypothetical. In the 2024 survey by the Bank of England and the Financial Conduct Authority (FCA), 75% of UK financial firms reported already using AI, up from 58% two years earlier, though adoption remains uneven: many firms are still standing up data pipelines or running a general-purpose chat assistant for back-office work, while a smaller set already embeds foundation models directly into credit, fraud, and trading decisions. Foundation models account for 17% of all use cases, and a third of use cases now run on third-party implementations (Bank of England and FCA, 2024).
That third-party supply is strikingly concentrated: the three most-cited providers account for 73% of all named cloud providers, 44% of model providers, and 33% of data providers. Concentration on that scale means many institutions are exposed, without any direct link to one another, to the same handful of upstream failures, which is why the same survey ranks cybersecurity as the highest perceived systemic risk and critical third-party dependencies as the fastest-growing one. This is precisely the concern the EU's Digital Operational Resilience Act (DORA) attempts to address through its oversight regime for "critical" third-party information and communication technology (ICT) providers, which formally recognises for the first time that cloud and model concentration is a systemic variable, not a purely commercial one (Kun, 2024).
The figure shows the distribution of the network impact for the scenario with a disruption originating from a third-party service provider. “Share” represents the unweighted percent of institutions that become impaired. “Weighted share” represents the percent of institutions that become impaired, weighted by asset size. “Net weighted share” refers to the percent of institutions that become impaired, net of the shocked institutions.
Loss tails fatten because one compromise now hits many pipelines at once. The combination of the first three shifts has a direct statistical consequence: the severity distribution of cyber losses becomes heavier in the right tail. If a single poisoned dataset or compromised model feeds credit decisioning, fraud scoring, and trading signals across multiple institutions, a single event generates correlated losses across several profit-and-loss (P&L) lines and several firms simultaneously. Aldasoro et al. (2023) already find that although cyber events are still rare relative to other operational losses, cyber risk can account for up to a third of a bank's total operational value-at-risk, with most of that contribution concentrated in the tail. A 2025 panel of chief information security officers (CISOs) and board directors convened by McKinsey and the National Association of Corporate Directors (NACD) captures the shift in blunt terms, with one participant noting that under AI-fuelled threats, the "variability and severity are so drastic" that traditional maturity scores carry little signal (McKinsey & Company, 2025).
Taken together, these four shifts describe a cyber risk that is less idiosyncratic, less binary, more correlated across firms, and slower to surface than the one the industry has built tools for. The governance model inherited from the last decade (a CISO who patches systems, an audit committee that tracks maturity scores, and an insurer who prices firm-level history) was not designed for this object. The question is what happens once this new distribution is properly recognised, first in prices and capital, then in governance and disclosure.
A shift in the cyber loss distribution only matters financially to the extent that it travels into the numbers that boards, creditors, and markets actually look at. And on current evidence, much of that journey has not yet happened.
Inside the firm. The most visible channel is the earnings hit. Operational losses from remediation, incident response, customer notification, legal fees, and regulatory fines feed directly into quarterly results. Using a cross-country panel of roughly seventy large banks over sixteen years, Aldasoro et al. (2023) estimate that operational risk capital varies between 1% and 7.5% of gross income depending on the calibration method used, and that cyber-specific capital can account for up to a third of that total. Franco et al. (2024) argue that even those figures underestimate firm-level exposure for the median institution because they remain rooted in probability-based simulations rather than observed real-world loss data; their Real Cyber Value at Risk (RCVaR) framework is designed precisely to close that gap by estimating costs directly from industry incident reports.
A second channel is the balance sheet. Remediation spending, accelerated information-technology investments, and litigation reserves erode capital buffers over the quarters that follow an incident, which changes how firms finance themselves. Liu, Luo & Yawson (2025), using a U.S. sample running from 2005 to 2019, find that attacked firms become 56% to 61% less likely than matched non-attacked firms to undertake a seasoned equity offering (SEO), that is, a new share issue by an already-listed company, over the three years after the attack, with SEO proceeds dropping in parallel. The mechanism they document is not a shortage of capital need but an excess of capital cost: reputation loss raises the adverse-selection premium that equity investors demand, and firms rationally shrink their equity issuance. The effect also spills over to industry peers who were not themselves attacked, whose SEO probability falls by roughly 18% to 20% of its baseline and whose SEO proceeds decline by about 13.5%, suggesting that markets treat a single cyber event as information about a sector's underlying cyber risk, not just about the target firm.
The third and most underappreciated channel is liquidity. Eisenbach, Kovner & Lee (2022) show that a successful cyber attack on any one of the top-5 U.S. wholesale payment banks impairs on average 38% of the network, and that once uninfected banks begin hoarding liquidity defensively, forgone payment activity can reach more than 2.5 times daily GDP within a few days. This matters particularly in AI-driven finance because authentication, payments, trade settlement and fraud routing all increasingly depend on ML-based systems. A model-level compromise does not only hit the targeted firm's P&L; it can disable a counterparty's ability to send or receive, which is a classical liquidity event wearing an AI costume. What looks operational becomes financial the moment confidence in settlement is shaken.
The figure shows the distribution of aggregate liquidity shortfall resulting from an attack that lasts from 1 to 5 days, averaged across the top-5 scenarios.
In markets. Do equity and credit markets price any of this? Partially. The existence of a cyber risk premium is by now empirically documented: firms with higher cyber exposure trade at a discount and face measurably higher costs of external financing after incidents (Jiang et al., 2024; Liu, Luo & Yawson, 2025). But the size of that premium is calibrated to the pre-AI tail. It reflects the historical distribution of cyber events as rare, largely firm-specific, and usually reversed within a few quarters. It does not yet reflect the four shifts described above: correlated incidents across firms that share a foundation model or a cloud region, slow-maturing damage from poisoned training sets, and losses that simultaneously hit credit decisioning, fraud scoring, and trading signals. The useful question is therefore not "is cyber risk priced?", but "is the post-AI tail priced?". On current evidence the answer is largely no.
Why not? Four structural frictions keep the post-AI tail out of prices.
Opacity. Cyber events are systematically under-reported. Aldasoro et al. (2023) document an average lag of more than a year between the occurrence of an operational loss and its recognition on the balance sheet, with a meaningful share of events still unaccounted for after two years. Markets cannot price what they cannot see, and as long as AI-related incidents hide inside "model drift" or "performance degradation", the signal does not reach them.
Externalities. Vendor and model concentration is a public bad. An institution that chooses a hyperscale cloud provider or a dominant foundation model captures private benefits (cost, performance, speed) but imposes a systemic risk that its own funding spread does not internalize. Kun (2024) argues that this is exactly the gap DORA's oversight regime for critical ICT providers was introduced to fill: firm-level risk management cannot price a shared-infrastructure externality, which is why a public authority has to look at concentration directly.
Rare-event neglect. Fat-tailed distributions are hard to estimate from short histories, especially when the underlying generating process has recently changed. The pre-AI cyber loss series is neither long enough nor stationary enough to calibrate a post-AI tail, and market participants (like most people) tend to under-weight tail risks they have not personally lived through.
Correlation blindness. Markets price firms, not shared-infrastructure clusters. There is no traded instrument whose payoff depends on whether ten banks share the same credit-scoring model, the same transaction-monitoring vendor, or the same cloud region. Until such an instrument exists, or until supervisors require concentration disclosure, correlated tail risk remains diversified on paper but concentrated in reality, which is the worst of both worlds for holders of the equity and debt of such firms.
The cumulative effect of these four frictions is that funding spreads, valuation multiples, and cyber insurance pricing continue to reflect a distribution that has already moved. Institutions whose capital planning, liquidity stress tests, and board-level risk dashboards rest on those same prices are therefore running a hidden short position on the post-AI tail. The rest of the article asks what changes (in governance, in disclosure, and in the practical work of CROs, CFOs, boards, and investors) once that short position is properly acknowledged.
If the post-AI tail is not yet in prices, the governance question is where the adjustment should come from. No single actor can close the gap: CROs and CFOs need to rebuild the quantitative plumbing, boards need to govern AI and cyber as one integrated risk, and investors and supervisors need to replace narrative assurance with credible tests. Institutions that move first stand to gain more than safety: the evidence discussed above suggests they may also fund themselves more cheaply and earn greater counterparty trust.
For CROs and CFOs: rebuild the quantitative plumbing. Three moves matter. First, model cyber losses at the tail, not at the mean. Franco et al. (2024) argue explicitly that most existing cyber capital models remain rooted in probability-based simulations calibrated on thin historical samples, exactly the wrong posture when the generating process has changed; their RCVaR framework estimates costs from observed industry data and makes the gap between expected loss and the 95th percentile explicit. Aldasoro et al. (2023) provide an independent benchmark: operational risk capital varies between 1% and 7.5% of gross income depending on calibration, with cyber-specific capital reaching a third of that. A capital plan sitting near the lower bound of those ranges is making an implicit bet that the post-AI tail will look like the pre-AI one.
Second, add authentication and payment outages to liquidity stress tests. Eisenbach, Kovner and Lee (2022) show that a five-day payment impairment at one of the five largest U.S. banks produces aggregate system liquidity shortfalls rising from roughly $122 billion on day one to around $1 trillion by day five, and that at the individual-bank level the 95th-percentile shortfall can reach 5% of risk-weighted assets or 37% of tier-1 capital.
Distribution of liquidity shortfall across impaired banks, relative to risk-weighted assets (left) and tier-1 capital (right). Source: Eisenbach, Kovner & Lee (2022). The tail is long: at the 95th percentile, shortfalls reach roughly 5% of risk-weighted assets and 37% of tier-1 capital. Capital buffers calibrated to the mean of this distribution leave the firm materially exposed to the tail.
Most internal liquidity frameworks still do not include a scenario in which the firm's ability to authenticate customers or send payments is disabled for several business days. Adding such scenarios, and sizing contingent buffers accordingly, is the single most concrete change a CFO can make.
Third, calibrate capital buffers to vendor concentration, not only firm-level history. The Bank of England's 2020 survey, cited by Kun (2024), finds that over 70% of U.K. banks and 80% of insurers use only two cloud providers for infrastructure services. Eisenbach et al. (2022) quantify the systemic side: a shock to a third-party service provider common to several large institutions impairs roughly 60% of the network by assets. CROs therefore need a vendor-concentration metric that feeds directly into capital buffer sizing, alongside a single risk register integrating model, data, and infrastructure exposures.
What makes such a test different from current ones is the unit of analysis. A conventional stress test breaches one firm at a time; a vendor-concentration test shocks the shared provider, not the firm, and asks how much of the book fails with it. In practice, it maps each critical AI dependency (foundation model, cloud region, data vendor) to the lines of business that rely on it, and identifies where the same provider silently underpins supposedly independent functions such as credit scoring, fraud detection, and trading. It then measures the correlated loss when that one provider goes down, and sets it against how many direct competitors share the same dependency. Given that three providers already account for the bulk of cloud and model relationships, those overlaps are the rule, not the exception.
For boards: govern AI and cyber as one integrated risk. The McKinsey and NACD (2025) panel of CISOs and directors is blunt that "the era when cybersecurity was a separate, isolated function at organizations is over" and that AI-fuelled threats require what one panellist calls "air-to-ground coverage" across the institution. In practice, this means moving cyber out of the audit-committee sidebar into a standalone risk or technology committee with genuine technical fluency, and changing the metrics boards track. Generic maturity scores were designed for a world where cyber was firm-specific and procedural; they do not capture the post-AI tail. The metrics that do are operational: credible recovery time objectives for AI-dependent services under adversarial conditions, vendor and model-concentration exposure, and the credibility of the firm's scenario library. Concretely, a post-AI tail metric is not a maturity score but a small set of tail-sensitive quantities tracked over time: a concentration ratio (the share of AI-dependent critical services running on the firm's single largest external model, cloud, or data provider, and how that compares with peers); an independently tested recovery-time objective for each AI-dependent service under adversarial, not benign, failure; and a tail gap, the distance between the firm's modelled expected cyber loss and its 95th-percentile loss, with capital sized to the latter. Each of these moves with the actual loss distribution; a maturity score does not. As Marco Maiurano of First Citizens Bank puts it in the panel, the variability and severity are now so drastic that single-point maturity scores carry little signal.
For investors and supervisors: replace narrative assurance with concrete tests. Investors should make vendor and model concentration a standard due-diligence item: which foundation models, cloud regions, and third-party data vendors does the firm depend on, and how many of its direct competitors share those dependencies? This is more than a checklist item: it is one of the few mechanisms through which correlated tail risk can become visible in prices at all. No single firm's disclosure can reveal that ten competitors depend on the same model or cloud region; only a party comparing across firms can see it. Concentration is therefore a classic collective-action problem that markets cannot solve unaided, which is the substantive case for supervisory concentration testing rather than another maturity questionnaire. Kun (2024) argues this is precisely the gap DORA's oversight regime for critical ICT third-party providers was designed to fill at the supervisory level. Supervisors, for their part, should test recovery credibly rather than accept qualitative reporting: Aldasoro et al. (2023) find that better supervisory quality is empirically associated with roughly 11% faster recognition of operational losses. Applied to AI-driven finance, this argues for system-wide cyber stress exercises and independent audits of recovery time objectives rather than another layer of disclosure.
Once the tail has shifted, continuing to govern cyber risk with pre-AI tools is itself a strategic choice. It shows up first in the cost of capital: Liu, Luo and Yawson (2025) document that attacked firms and their peers face measurably higher equity financing costs after incidents, and Jiang et al. (2024) show that firms with higher cyber risk exposure pay a persistent premium. As markets learn to price the post-AI tail, those premia may widen for institutions that cannot credibly demonstrate tail-sensitive governance. It shows up next in counterparty trust: firms that cannot show credible recovery metrics are likely to be dealt with on less favourable terms long before they are breached.
The competitive frontier in AI-driven finance is not "best security" in the traditional sense. It is lowest uncertainty around service continuity under fat-tailed, correlated disruption. On a calm day, that looks like a cost line. On a bad day, it looks like the only institutions still open for business.
The Arup deepfake was told as a fraud story. It was really a preview. The same mechanism, scaled up, reaches training pipelines, credit models, authentication layers, and cloud regions shared across the industry. Cyber risk in AI-driven finance is no longer a compliance sidebar. It is a tail-sensitive, liquidity-relevant, correlation-heavy financial variable whose distribution has moved, and whose new shape is not yet in prices, capital, or boardroom dashboards.
None of this requires waiting for the next major incident. The data already exist. The shift is documented, the propagation channels are mapped, the pricing gap is measurable, and the regulatory direction of travel, from DORA onward, is set. What is missing is the governance layer that turns those inputs into capital plans, stress tests, and disclosures calibrated to the post-AI tail rather than the pre-AI one.
That gap is not neutral to wait on. Repricing the post-AI tail is likely to be a source of advantage, and one that compounds over time. The evidence does not yet prove this directly, but it points in that direction. If markets already charge a premium for observable cyber exposure (Jiang et al., 2024; Liu, Luo and Yawson, 2025), an institution that quantifies its cyber-and-AI tail, sizes capital and liquidity to it, and can disclose it credibly should be well placed to fund itself more cheaply and to be dealt with on better terms, with savings that would accrue quarter after quarter. An institution that does not is not standing still; it is quietly accumulating an invisible liability, a hidden short position on the post-AI tail whose premium it collects in good quarters and whose true size it discovers only when the distribution moves against it. The longer the two paths run, the wider the distance between them. The hidden variable is unlikely to stay hidden forever, and when it surfaces, the firms that priced it early may well find themselves years ahead.
[1] Aldasoro, I., Gambacorta, L., Giudici, P., & Leach, T. (2023). Operational and Cyber Risks in the Financial Sector. International Journal of Central Banking, 19(5), 341–402.
[2] Bank of England & Financial Conduct Authority. (2024, November). Artificial intelligence in UK financial services - 2024. Bank of England.
[3] Eisenbach, T. M., Kovner, A., & Lee, M. J. (2022). Cyber risk and the U.S. financial system: A pre-mortem analysis. Journal of Financial Economics, 145(3), 802–826.
[4] Franco, M. F., Künzler, F., von der Assen, J., Feng, C., & Stiller, B. (2024). RCVaR: An economic approach to estimate cyberattacks costs using data from industry reports. Computers & Security, 139, 103737.
[5] Jiang, H., Khanna, N., Yang, Q., & Zhou, J. (2024). The Cyber Risk Premium. Management Science, 70(12), 8791–8817.
[6] Kun, E. (2024). Challenges in regulating cloud service providers in EU financial regulation: From operational to systemic risks, and examining challenges of the new oversight regime for critical cloud service providers under the Digital Operational Resilience Act. Computer Law & Security Review, 52, 105931.
[7] Liu, X., Luo, J., & Yawson, A. (2025). Equity offering following cyberattacks. Journal of Corporate Finance, 91, 102710.
[8] Yerlikaya, F. A., & Bahtiyar, Ş. (2022). Data poisoning attacks against machine learning algorithms. Expert Systems with Applications, 208, 118101.
[9] McKinsey & Company, Risk & Resilience Practice. (2025, August). Competitive advantage through cybersecurity: A board-level perspective.
[10] Bailey, T., Del Miglio, A., & Richter, W. (2014, May). The rising strategic risks of cyberattacks. McKinsey & Company.
[11] CNN. (2024, February). Finance worker pays out $25 million after video call with deepfake ‘chief financial officer’. CNN.
[12] Surfshark Research. (2025, July). Deepfake fraud losses near $900 million by mid-2025. Surfshark, using data from the AI Incident Database and Resemble.AI.
