Fintech Strategy & Board Advisory

10 June 2026 – Daniela Sozzi, Founder of DNYC, joined Andrei Kucharavy, cyber-defence expert at Surelio.ai, Caroline Perriard, board advisor and co-founder of Stratedge and Bruno Guinchard, AI and Digital Transformation expert and former UBS IT Director, for a timely discussion on how artificial intelligence is reshaping the cybersecurity landscape for financial institutions.

The conversation centred on three critical pillars: trust in the financial system, operational continuity in the face of AI-enabled attacks, and the evolving role of accountability under increasing regulatory scrutiny.

A key theme highlighted by Daniela Sozzi was the growing asymmetry in cyber risk. While recent developments such as Anthropic’s Mythos pre-release have focused attention on Tier 1 banks, smaller financial institutions are often the more frequent targets. These organisations are perceived as easier to penetrate, yet their disruption can have disproportionately severe consequences on local economies, making them attractive targets for financially and geopolitically-motivated attackers.

From a defensive standpoint, the panel reinforced that AI does not fundamentally change the principles of cybersecurity, but it does accelerate the speed, scale, and frequency of attacks. As Andrei Kucharavy noted, attackers need less skills and means now and no longer discriminate by size: if an institution is profitable or strategically relevant, it is a target. This makes the consistent application of established cybersecurity best practices more critical than ever.

Daniela Sozzi emphasised that resilience in this environment requires building on technical controls. It demands organisational readiness. Financial institutions should:

• Invest in continuous, organisation-wide training to reduce human vulnerabilities, particularly around phishing and social engineering.
• Drastically improve response times across patching, escalation, backup activation, and business continuity processes.
• Build agile operating models, where closer alignment between IT, operations, and leadership enables faster and more coordinated responses.
• Regular tests and simulations to validate assumptions and ensure readiness.

She also underscored an important regulatory shift: supervisors are no longer focused on how much firms spend on cybersecurity, but on whether that investment delivers measurable resilience outcomes. Institutions must demonstrate that their approach effectively protects customers, ensures continuity, and mitigates systemic risk.

The regulatory dimension was further reinforced through the discussion on DORA. As Daniela Sozzi pointed out, while DORA does not explicitly address AI-driven threats, its outcome-based framework makes it inherently future-proof. Regardless of how technology evolves, financial institutions are expected to maintain operational resilience, safeguard consumers, and preserve trust in the system.

A critical takeaway from her contribution is that absolute security is unattainable. No organisation can claim to be fully protected against all threats, particularly in a landscape defined by “unknown unknowns”. Instead, leading institutions distinguish themselves through preparedness: continuously testing their defences, learning from industry incidents, and demonstrating the ability to respond rapidly and contain disruption when attacks occur.

For example, a mid-sized payment institution that regularly stress-tests its incident response plan and trains staff to identify phishing attempts is far more likely to contain an AI-assisted attack quickly than a larger but less coordinated organisation.

Ultimately, the discussion made clear that in an AI-enabled threat environment, resilience, not perfection, is the benchmark. And achieving it requires a combination of strong fundamentals, organisational agility, and a proactive regulatory mindset.

“I would borrow a concept from military strategy here. What do you do if your opponent no longer follows the code of war or the usual rules of engagement? You have to adapt your strategy.

If it becomes a guerrilla-style environment, you cannot simply deploy your battalion and rely on numbers anymore. You need to be more agile and more responsive, and operations need to be designed accordingly.

It is not something you can wait to learn after an incident happens. It has to be prepared in advance.

People need a skill set that is different from the past — one that fits the present and the future. Empowerment follows from that.

Processes, operations, and headcount need to be adapted. It is not about reducing headcount. It is about having the right skill set available at the right time.”

— Daniela Sozzi, Strategy Advisor and Founder of DNYC Ltd

More info and FAQ here.