Fintech Strategy & Board Advisory

15 June 2026 – Daniela Sozzi, Founder of DNYC, joined Andrei Kucharavy, cyber-defence expert at Surelio.ai, Caroline Perriard, board advisor and co-founder of Stratedge and Bruno Guinchard, AI and Digital Transformation expert and former UBS IT Director, for a timely discussion on how artificial intelligence is reshaping the cybersecurity landscape for financial institutions.

Under DORA, financial institutions cannot claim ignorance if a proprietary, third-party AI system experiences a logic failure or a security breach. Boards must maintain absolute fiduciary oversight. This means mapping your entire technical ecosystem, establishing clear mitigation protocols for systemic concentration risks, and implementing rigorous testing pipelines to safeguard operational continuity.

We also discussed how traditional cyber resilience was built around deterministic software, where a specific input consistently yielded a predictable output. Generative systems introduce inherent unpredictability. This shift makes validating system behaviors under stress significantly harder, forcing compliance teams to transition from static perimeter checks to continuous, dynamic behavioral monitoring. However, DORA is outcome-oriented, the objective does not change despite technological progress. Fintechs will have to do more to prove the ability to be resilient under new levels of threats powered by AI.

A key theme highlighted by Daniela Sozzi was the growing asymmetry in cyber risk. While recent developments such as Anthropic’s Mythos pre-release have focused attention on Tier 1 banks, smaller financial institutions are often the more frequent targets. These organisations are perceived as easier to penetrate, yet their disruption can have disproportionately severe consequences on local economies, making them attractive targets for financially and geopolitically-motivated attackers.

From a defensive standpoint, this makes the consistent application of established cybersecurity best practices more critical than ever. The panel reinforced that AI does not fundamentally change the principles of cybersecurity, but it does accelerate the speed, scale, and frequency of attacks. As Andrei Kucharavy noted, attackers need less skills and means now and no longer discriminate by size: if an institution is profitable or strategically relevant, it is a target.

While primary security protocols often prioritize Tier 1 banks due to their massive capital scale, the thousands of small and medium-sized enterprises (SMEs) driving modern economies rely entirely on Tier 2 providers.

Malicious, state-sponsored actors recognize this imbalance. They view these smaller institutions as soft targets, not merely for capital theft, but as strategic leverage points to disrupt entire economic systems.

— Daniela Sozzi, Strategy Advisor and Founder of DNYC Ltd

More info and FAQ here.