Get Started
New Research · September 2026

Defending Against AI-Enabled Cyber Attacks

What financial services leaders told us keeps them up at night

AI is here to stay. With the right cybersecurity vigilance and guardrails, it can be part of a successful firm's growth story. At the same time, IT and business leaders are working every day to balance speed and innovation against a rising tide of AI-enabled threats.

Download the Full Report See the Findings
25
executives interviewed
$1B+
in annual revenue at each firm
C-Suite
mostly CTOs, CISOs and COOs
Sept. 2026
qualitative research by Bolt Insight

Your Security & Compliance Trusted Partner

Why we did this research

A practical path forward

In September 2026, we commissioned Bolt Insight to explore the challenges executives face as AI adoption grows. FinTechs serving advisors are often part of a firm's technology ecosystem, so they face the same exposure and risks.

The findings point to a practical path forward: firms can address these concerns with a strategic approach to cybersecurity that is aligned with regulatory and compliance guidance. Below are the study's four key themes, what we heard directly from industry leaders, and the steps we recommend firms take now.

01
Insight 01

State of IT Tools and Process Readiness

What we heard

  • Most executives we spoke with have adopted MFA, implemented AI use policies and built robust incident response plans.
  • But published lists of approved AI tools, role-based training and AI asset inventories lag behind.
“We have solid fundamentals in place — like strict zero-trust access, hardware keys, and out-of-band approvals for financial movements — but we treat preparedness as a continuous moving target.”
What you can do now

Publish an approved AI tools list and build a simple AI asset inventory this quarter.

Many firms have policies but lack the tools to implement them. Without an approved tools list and an inventory, a policy is unenforceable.

02
Insight 02

People: The Last Line of Defense and a Key Vulnerability

What we heard

  • Speed-focused cultures create opportunities for fraudsters.
  • Under deadline pressure, employees may bypass verification steps.
“Combining authority bias with a fast-paced work culture means employees are tempted to cut procedural corners and skip slow out-of-band verifications just to deliver quickly.”
“Human nature often defaults to solving the immediate crisis over strict compliance.”
What you can do now

Give everyone clear permission to slow down — even for the CEO.

Attackers aren't beating your controls; they're beating your urgency culture. Make out-of-band verification mandatory and non-negotiable for every money movement and data request.

03
Insight 03

IT Helpdesks and HR: Emerging Threats

What we heard

  • Helpdesk teams are trained to be responsive, so the drive for service and satisfaction can overshadow caution and vigilance.
  • HR employee records and payroll data are prime targets.
“An attacker impersonating an executive or lead engineer to trick our IT helpdesk into resetting administrative credentials or granting production environment access could open the door to massive data exfiltration or system tampering, which is ultimately much more destructive than a single fraudulent financial transaction.”
What you can do now

Make identity verification part of service quality.

Your helpdesk is a gateway to privileged access. Build identity verification — a callback to the number on file, manager approval — into service delivery before any credential reset, MFA re-enrollment, or payroll or direct-deposit change.

04
Insight 04

Regulatory Compliance and Ongoing Vigilance: Uneasy Companions at Many Firms

What we heard

  • Exhaustive documentation demands are diverting resources from active defense.
  • Boards need to understand AI-driven risks as ongoing threats, not static IT issues.
“Maintaining compliance data, running mandatory third-party supplier risk assessments, and delivering regular reports definitely slows down how fast we can roll out necessary guardrails.”
What you can do now

Turn regulatory compliance into a competitive advantage.

Build the verification procedures, AI inventory and role-based training required by Reg S-P, NYDFS Part 500 and FINRA once, and they do double duty: protecting you today and serving as evidence for your regulatory exams.

Make Cybersecurity a Strategic Imperative

Five things to do in the next 90 days

1
Publishyour approved AI tools list.
2
Inventorywhere AI is in use across the firm, including your vendors' AI.
3
Lock downhelpdesk credential resets and payroll changes with callback verification.
4
Runat least one deepfake voice or video drill targeting finance, HR or the helpdesk.
5
Brief the boardon AI threats as an ongoing risk, with a recurring agenda item.
Take the next step

Toward cybersecurity readiness

Test your firm's cybersecurity readiness, or contact us to schedule a cybersecurity risk assessment and learn how we can help.

Book a Risk Assessment Call (949) 330-0899

About this study

A qualitative study of 25 executives — primarily CTOs, CISOs and COOs — at financial services firms with more than $1 billion in annual revenue. Participants came from private funds, fintech software providers serving the industry, broker-dealers, insurers and registered investment advisors. Conducted by Bolt Insight for Security Basecamp in September 2026.

About Security Basecamp

Security Basecamp safeguards trust in a cyber-threatened world. Our vCISO and cybersecurity experts secure client-advisor relationships through holistic cybersecurity, risk assessments, continuous monitoring, secure AI adoption and deepfake detection, helping financial firms achieve resilience, compliance and growth.

About Bolt Insight

Bolt Insight is an AI-native research consultancy and a global leader in AI-moderated qualitative research. Founded in 2019, it has worked with more than 100 clients across 120 countries.

Disclosure. This qualitative research is for informational purposes only and does not constitute cybersecurity, legal, compliance or other professional advice. Each firm should work with its internal legal, compliance and IT security professionals, as well as qualified external advisors, to develop cybersecurity measures appropriate to its circumstances and risk profile. The research sponsor and research firm have made reasonable efforts to assess respondents' relevant experience and credibility. However, respondents' views are their own and do not necessarily represent the views of the sponsor or the research firm. Neither is responsible for respondents' opinions or for actions taken or not taken in reliance on this research.