Frontier AI and cyber resilience: what the FCA found

What happened

On 2 September 2026, the Financial Conduct Authority (FCA) published a multi-firm review, Frontier AI and cyber resilience.¹ It summarises what firms reported about using frontier AI, which the FCA describes as “the most advanced AI models available at any given time”, to find and fix cyber security weaknesses.

The review follows a joint statement in May 2026 from the Bank of England, the FCA and HM Treasury, which said that “frontier AI models represent a step-change in capability,” with cyber capabilities that “are already exceeding what a skilled practitioner could achieve.”²

The FCA is explicit that the review “does not introduce new rules, guidance or regulatory expectations.”¹

What the FCA found

The review’s central finding is that “organisational readiness is the primary challenge.”¹ Its main observations were:

• Discovery is outpacing remediation. AI can find vulnerabilities faster than firms can validate, prioritise and fix them, and can generate many findings that are “technically possible but difficult to validate, prioritise or act upon.”
• Basic practice is exposed. Using frontier AI reveals weaknesses in vulnerability management, access management and mapping of dependencies.
• The value lies in the “harness”. Results depend on the environment around the model: specialist tools, validation, guardrails and human expertise.
• Human judgement remains essential, with outputs assessed by people with cyber, technology and business experience.¹

Firms reporting good practice started with targeted deployments before scaling, limited the model’s permissions, required human approval for higher-risk actions, prioritised fixes by real business impact rather than severity ratings alone, and engaged their suppliers early.¹

Why it matters

This review is about cyber security, but its findings apply to AI at scale generally. A capable model exposes the weaknesses of the organisation around it. If processes, ownership and capacity cannot keep up with what the AI produces, the result is not more resilience but a longer backlog.

It also sharpens the third-party question. The FCA highlights limited visibility of the assets, dependencies and suppliers supporting important business services.¹ The joint statement asks firms to manage frontier AI cyber risk from third parties and supply chains, including open-source software.²

What to do now

1. Test your capacity to fix, not just to find. Before scaling AI-enabled vulnerability discovery, check whether triage, patch testing and change management can absorb the volume.
2. Agree ownership and escalation. Decide who owns decisions about frontier AI in cyber resilience, and make sure senior leaders can see its effect on the vulnerability register.
3. Talk to critical suppliers. Ask how they are using frontier AI, and how quickly they could fix vulnerabilities it reveals in services you depend on.

Questions for your leadership team

1. If AI found ten times as many vulnerabilities in our systems next month, could we fix them? Who would decide what to fix first?
2. Do we have a current map of the suppliers and dependencies behind our most important services?
3. Where are we relying on a model’s output without a qualified person checking it?

This briefing summarises the sources listed above, with analysis by the editor. Read the original sources before acting on it.