Preparing for Mythos and Enhanced AI-Enabled Cyber Threats: UK Financial Services Regulator Expectations

This piece for Debevoise & Plimpton by authors Robert Maddox, Andrew Lee & Martha Hirst takes a look at a recent joint statement from the UK’s financial regulators on the cybersecurity risks posed by frontier AI models. The authors explain that while the statement introduces no new regulatory requirements, it reinforces the expectation that firms address AI-enabled cyber threats through existing governance, operational resilience, and risk-management frameworks.

The article notes that regulators expect firms to strengthen oversight of emerging cyber risks by ensuring boards and senior management understand how frontier AI can accelerate vulnerability discovery, improve social engineering attacks, and shorten response times. Firms should evaluate whether their current systems, controls, and governance arrangements remain adequate in light of a rapidly evolving threat landscape and demonstrate compliance with existing FCA and Bank of England requirements.

The authors also emphasize the importance of revisiting foundational cybersecurity and operational resilience practices. Recommended measures include improving asset inventories, strengthening access controls and network segmentation, enhancing data minimization efforts, accelerating patch management, and updating incident-response procedures. Firms should also reassess operational resilience mapping and scenario testing to account for AI-enabled attacks that may exploit multiple vulnerabilities simultaneously across interconnected systems and suppliers.

Finally, the piece highlights heightened concerns surrounding third-party, supply-chain, and open-source software risks. The authors encourage firms to review vendor contracts, strengthen vulnerability notification and incident-reporting obligations, and engage with service providers regarding their own AI risk-management practices. As frontier AI increases both the speed and scale of cyber threats, firms are urged to adopt a coordinated, organization-wide approach that integrates governance, resilience, cybersecurity, and vendor oversight.