Storm-0940 should be a name that makes every bank board uncomfortable. The China state-aligned threat actor has used ARTEX, an agentic AI penetration-testing framework, to automate attacks against hundreds of organisations globally. Microsoft says its investigation found that AI accelerated reconnaissance, credential changes and attempts to modify privileges, allowing the actor to move through compromised applications with remarkable speed.

The more unsettling detail is the scale and nature of the activity. In the ConnectWise supply-chain compromise, Storm-0940 exploited trusted application access to reach downstream environments. Once an application has legitimate credentials, the attacker does not have to behave like an intruder. It can behave like the application itself, operating without an interactive user sign-in and probing environments that have already granted it access.

Meanwhile, corporate boardrooms are chasing another kind of access. AI has become the new FOMO, the new corporate hashtag and increasingly part of the valuation conversation. Every company wants an AI strategy, an AI agent, an AI partnership or an AI story for investors. The uncomfortable question is whether the race to demonstrate technological ambition is running ahead of our ability to understand what we are making vulnerable.

The bank perimeter vanished before boards noticed
Trust can become the attacker’s easiest doorway. The modern bank is no longer a building surrounded by a firewall. It is a dense network of cloud platforms, APIs, fintechs, payment processors, identity providers, fraud engines, KYC systems, software vendors, outsourced operations and data processors. Customers see an app and a transaction confirmation. Behind them sits a chain of permissions and machine identities stretching far beyond the bank’s own walls.

That changes the meaning of cyber risk. A bank can have strong internal controls and still be exposed because an external application has privileged access. A payment intermediary can become the route into several institutions. A trusted technology vendor can become the weakest point in an otherwise sophisticated architecture. The more seamless the digital ecosystem becomes, the harder it becomes to see where the institution actually ends.

Consider what the next vulnerability could look like. An AI coding assistant has access to an internal repository and exposes a credential. An AI customer-service agent connected to CRM and customer data is manipulated into retrieving information it should never reveal. An AI fraud system connected to transaction feeds learns from poisoned signals. An underwriting model relies on several external data providers, one of which is compromised. An AI compliance tool receives sensitive regulatory and customer information. An outsourced KYC provider holds privileged API access. A cloud provider hosts several critical banking workloads. A fintech or payment intermediary connects multiple banks. A routine software update from a trusted vendor becomes the route into several institutions. An agent authorised to execute, rather than merely recommend, takes an action it was never intended to take.

A compromised service account may be even harder to spot because it can behave exactly like a legitimate machine. There may be no dramatic intrusion, no suspicious employee and no obvious malware. There may simply be an authorised identity doing something it should not be doing.

That is why “third-party risk” increasingly sounds inadequate. These companies are part of the financial institution’s operating nervous system. When the same provider serves hundreds of institutions, a compromise can become a systemic vulnerability rather than an isolated corporate incident.

Complacency can defeat sophisticated security architectures
The deeper problem may be human. We have become comfortable equating a clean dashboard, a completed audit and the absence of a reported breach with resilience. Cybersecurity does not offer that comfort. The defender has to be right repeatedly. The attacker may need only one forgotten credential, one excessive permission or one compromised supplier.

A good cyber team should occasionally make senior management uncomfortable. It should keep looking for the permission nobody remembers granting, the vendor nobody has challenged for years and the machine identity nobody has examined closely. If the people responsible for cyber security are never losing sleep, the board should ask whether they are looking hard enough.

Cyber risk also exposes the limits of hierarchy. Inside a bank, authority travels through reporting lines, committees and titles. A threat actor recognises none of them. It could be a state-backed group, a criminal syndicate, a compromised contractor or an anonymous individual operating from another jurisdiction. It does not need an appointment with the CEO or the board.

There is also an uncomfortable business ecosystem growing around this anxiety. Cybersecurity, threat intelligence, resilience testing, assurance and compliance have become substantial annuity businesses. Some of the business development is undertaken by highly paid consulting organisations whose commercial proposition is, naturally, to solve client problems. Yet there is something almost parasitic about an ecosystem that can keep feeding on institutional fear, selling another assessment, framework, certification or remediation programme every time the threat landscape changes. Boards need to distinguish between buying more assurance and becoming harder to attack.

AI FOMO is outrunning institutional cyber maturity
The enthusiasm for AI is understandable. No management team wants to be told of missing the next productivity revolution. No investor presentation wants to suggest that the company is technologically behind its peers. AI has therefore become a powerful signalling mechanism, telling markets that management is ambitious and future-ready.

That signalling creates its own risk. Financial institutions are embedding AI into fraud detection, underwriting, customer service, coding, compliance, surveillance, document processing and trading. The productivity gains could be significant. But when an AI system moves from recommending to acting, its permissions matter as much as its intelligence.

Imagine a bank with several AI agents. One can read internal code. Another can access customer information. A third can initiate operational changes. Each deployment may appear sensible in isolation. Together they can create a concentration of machine authority that nobody sees because responsibility is distributed across projects.

Now introduce a compromised credential or manipulated agent. The attacker may no longer need to understand every system manually. Machines can help map the environment, identify useful targets and execute repetitive actions at a scale no human team can match. The productivity multiplier can become an attack multiplier.

This is the paradox of the current AI race. Companies are rushing to make machines more autonomous while still struggling to govern the permissions of the machines they already operate. AI capability is visible and marketable. Cyber resilience is largely invisible when it works.

Geopolitical ambition is outrunning weak global governance
Every major technology power wants global supremacy. This becomes far more serious when technology becomes an instrument of national power. Every major technology nation wants supremacy in AI, chips, compute, data, models and the standards that govern them. Commercial competition is increasingly fused with strategic competition. Countries want to be technology makers and rule-setters, not dependent users of another power’s infrastructure.

That ambition creates a new class of risk. The same capabilities being built for productivity and economic advantage can be used for surveillance, cyber operations, military applications and attacks on critical infrastructure. A state actor does not necessarily have to attack a bank directly. It can target a technology dependency shared by hundreds of banks.

Global governance is still light years away from matching this reality. There are principles, declarations, national frameworks and international conversations about responsible AI. There is nothing resembling a mature global governance architecture capable of dealing with AI-enabled attacks that cross jurisdictions, commercial platforms and national-security boundaries in seconds.

The financial system sits directly inside this geopolitical contest. A bank may be regulated in one country, use software developed in another, run workloads on infrastructure controlled from a third and depend on a payment or identity provider operating across several jurisdictions. A geopolitical rupture can therefore arrive through a commercial dependency without ever announcing itself as a cyberattack.

Quantum computing adds another clock to this race. The concern is not that quantum computers will suddenly empty bank accounts tomorrow. The concern is that state actors and other well-resourced players are building expertise today in a field that could eventually challenge some cryptographic systems underpinning digital trust. Financial transactions, identities, communications and stored data depend on cryptography whose long-term resilience cannot simply be assumed.

The uncomfortable possibility is that information stolen today could remain valuable tomorrow. An adversary does not necessarily need to decrypt everything immediately if it can collect encrypted data and wait for computational capabilities to mature. Financial institutions therefore face a security problem whose horizon extends well beyond the next audit cycle.

India has built extraordinary digital financial infrastructure at extraordinary speed. That achievement should make us more demanding about resilience. Supervisors and boards need to examine concentration in cloud providers, critical software, machine identities, privileged application access, fourth-party dependencies and cryptographic resilience as connected risks.

The next serious cyber event may involve an AI agent rather than a human employee, a trusted supplier rather than an obvious intruder, a legitimate machine identity rather than malware, or a geopolitical actor exploiting a commercial dependency. The event may move faster than a security team can investigate and faster than regulators can convene.

That is why the AI conversation needs to leave the comfort of the corporate presentation. The question is no longer simply who will capture the productivity gains. It is who will control the infrastructure, who will set the rules, who can weaponise the dependencies and whether our institutions are prepared for capabilities that may be developing several moves ahead of them.

Financial institutions should invest in AI. They have little choice. But boards should be at least as interested in the vulnerabilities created by that investment as in the efficiencies it promises. Regulators need to examine ecosystems rather than just institutions. Cyber teams need to remain paranoid enough to keep searching when everything looks fine. The real danger may be the quiet confidence from an armchair that someone, somewhere, has already taken care of it.