Enterprises are spending heavily to make software capable of acting autonomously across increasingly valuable company systems. But the return on that investment depends on giving those systems authority.
And authority creates exposure.
Companies are connecting artificial intelligence tools to code repositories, cloud infrastructure, corporate databases and increasingly financial workflows. Every connection creates another software identity with credentials, permissions and access to something valuable.
Meanwhile, AI is collapsing the amount of labor required to hunt for mistakes in those systems.
The economics of hacking, after all, are getting better. And the cyber geniuses are getting even younger. A 16-year-old security researcher known as Faav, for example, recently used his own proprietary AI-assisted security tool while investigating Microsoft’s internal Titan analytics platform. The research uncovered a vulnerability that allowed administrator-level access to an API connected to databases the researcher estimated contained 17.3 trillion rows.
Separately, 19-year-old researcher Nisarga Adhikary was recognized by the U.S. Department of Justice after responsibly reporting a critical vulnerability affecting one of the agency’s law-enforcement systems.
Neither teenager was acting maliciously. Both cases instead demonstrate how sophisticated cyber discovery is becoming accessible to much smaller teams and younger researchers.
Read more: Revolut and Fed Incidents Expose New Risks Inside Banking’s Trust System
Financial Risk is Moving Into Enterprise Software Platforms
AI is not creating an entirely new cybersecurity problem. It is industrializing an old one. Finding vulnerabilities traditionally required expensive human labor. Researchers had to map applications, inspect documentation, understand authentication flows, test configurations, analyze code and repeatedly probe systems for unusual behavior.
Artificial intelligence can increasingly perform or accelerate portions of that work. In both the DOJ and the Microsoft example, the cyber vulnerability itself was not something out of science fiction. The leverage was. A single researcher was able to use automation to perform work that historically would have required substantially more time, specialized expertise or manpower.
Enterprises may spend millions building and protecting increasingly complex technology estates while a teenager with the right AI tools can search them for weaknesses at a fraction of the historical cost. That asymmetry should concern CISOs and CFOs alike.
We’d love to be your preferred source for news.
Please add us to your preferred sources list so our news, data and interviews show up in your feed. Thanks!
Enterprises have long benefited from a kind of defensive scale advantage. Large organizations could hire specialized security teams, buy expensive tooling and create processes difficult for individual attackers to match. Generative AI chips away at that advantage by making expertise more reproducible. Models can explain unfamiliar code, generate scripts, analyze documentation, interpret error messages and suggest potential attack paths. Specialized AI agents can automate reconnaissance and testing.
The PYMNTS Intelligence report “2025 State of Fraud and Financial Crime in the United States” found in December that 68% of financial institutions increased their fraud detection budgets year over year. That spending came as 46% of institutions reported sophisticated fraud schemes, up from 35% a year earlier.
See also: The New Cyber Math for CFOs: One Attack, Hundreds of Disclosures
The Enterprise AI Boom Is Giving Hackers a New Advantage
Companies deploying artificial intelligence frequently justify the investment by arguing that one employee equipped with AI can accomplish work that previously required several people.
Attackers get the same productivity gain. A technically capable bad actor, no matter their age, can today operate something resembling a small security research organization with automated reconnaissance, code analysis, scripting, documentation review and vulnerability testing running alongside human judgment.
The problem is that automation traditionally scaled attacks against vulnerabilities that somebody had already found. AI, however, helps scale the search for vulnerabilities that nobody has found yet.
This is where enterprises may be accumulating risk faster than their governance systems can absorb it. An AI agent with excessive privileges does not need to become malicious to create risk. Its credentials can be stolen. Its underlying software can be compromised. A prompt-injection attack could manipulate its behavior, or a dependency it relies on could be corrupted.
Enterprises are not merely adopting AI models. They are assembling sprawling AI stacks composed of models, agents, gateways, APIs, plug-ins, open-source packages and cloud services. Every component inherits permissions from somewhere. Every dependency creates another potential point of failure.
Banks have already been investing in defending their connective capabilities. The PYMNTS Intelligence report “State of Fraud and Financial Crime in the United States” found in December that that 70% of financial institutions surveyed use behavioral analytics for fraud detection, while 61% use machine learning or artificial intelligence. Such systems can identify departures from established customer behavior even when the customer has authenticated and personally authorized a transaction.
For all PYMNTS B2B coverage, subscribe to the daily B2B newsletter.
Click Here For The Original Source.
