Oakes: AI accelerates cyber threats to financial resilience
Bank of England's Liz Oakes highlighted the escalating risks to financial stability from AI-driven cyberattacks. Speaking at a London banking summit, she emphasized the need for continuous testing of operational resilience.
AI's double-edged sword
Liz Oakes, a member of the Bank of England's Financial Policy Committee (FPC), addressed the growing threat of operational incidents and cyberattacks to vital financial services.
She noted that the National Cyber Security Centre reported over 200 nationally significant cyber incidents in 2025, a substantial increase from 89 in 2024.
Oakes highlighted that AI could accelerate these trends, both positively by helping identify weaknesses and negatively by enhancing malicious actors' capabilities.
Recent advancements in frontier AI models, such as Mythos and GPT-5.5, illustrate this duality, potentially reducing the cost and increasing the speed of cyberattacks.
Oakes stated that "what was judged to be resilient today might not be resilient tomorrow," emphasizing the need for continuous improvement and testing of resilience.
The FPC is closely monitoring these profound technological transformations and their impact on the UK financial system.
From capital to operational resilience
Oakes outlined the FPC's evolving approach to financial stability, initially focusing on banking system capital resilience after the Global Financial Crisis.
The variety of shocks the system needs to withstand has broadened, particularly with the increased importance of non-bank financial institutions (NBFIs), leading to actions like the System-Wide Exploratory Scenario (SWES).
The focus has now significantly expanded to operational resilience, driven by the increasing frequency and systemic implications of operational incidents.
These can transmit risks through operational and financial contagion, and loss of confidence, potentially impacting systemically important institutions and causing liquidity stress.
Testing is the new normal
The speech underscores a critical shift in central bank priorities, moving beyond traditional capital buffers to confront the pervasive threat of operational disruption.
While the financial system has proven resilient to economic shocks, its vulnerability to cyber and AI-driven attacks demands a proactive, continuous testing regime.
This evolving threat landscape means regulatory frameworks must adapt swiftly, ensuring firms not only build but also consistently test their resilience.