AI shrinks banks’ patch time from weeks to minutes, BIS

A recent report from the Bank for International Settlements finds advances in artificial intelligence are compressing the time banks have to respond to cyber vulnerabilities from weeks to minutes. The report describes attackers using AI to automate reconnaissance, generate exploit code and scale attacks rapidly.

The BIS report identifies several AI-driven techniques changing the threat landscape. Automated scanning and fuzzing tools can probe large codebases and cloud environments continuously. Generative models can produce convincing phishing messages and synthetic audio or video for fraud. AI can also help create malware variants that evade signature-based defenses or adapt payloads to target specific systems. In some cases the time between discovery and exploitation has shrunk to hours or minutes.

The report outlines the operational effects on banks. Faster attack tempos require quicker patching, automated deployment systems, extensive testing to prevent outages, and coordinated action across IT, security and business units. Many banks still run legacy systems and change controls that were designed for slower update cycles, which can delay fixes or lead to incomplete mitigations.

Regulatory and industry responses in the report include expanding continuous monitoring, adopting automated incident-response tools, and strengthening identity and access controls to limit intrusion impact. The BIS recommends improving threat-sharing among financial institutions and with central banks, and increasing the frequency of red-team exercises that simulate rapid, automated attacks. The report also urges investment in defensive AI to support analysts and reduce false positives.

The report warns defensive AI is not sufficient on its own. Defensive models can be bypassed or manipulated, and heavy reliance on automation may create blind spots if human oversight is reduced. It recommends combining automated tools with skilled personnel who understand both technical details and business implications when making rapid containment and patching decisions.

The BIS links the faster attack tempo to broader shifts in software and cloud deployment, the rise of machine-readable code and wider access to powerful pre-trained models. Before these changes, exploit development typically required manual reverse engineering and custom coding; today toolchains can automate many of those tasks. The report calls for updated resilience standards, clearer incident-reporting expectations, international cooperation on cybercrime enforcement and supervisor-led testing of banks’ ability to respond to rapid attacks. It advises banks to invest in technical defenses and operational processes that can operate under compressed timelines.