Cyber Risk Challenges for AI: An Explorative Study into Cyber Risk Management for AI-powered Systems in the Dutch Financial Sector

Artificial intelligence (AI) and cyber security failure are two of the highest impact risk areas of this decade, with developments surrounding these two topics going hand in hand. For instance, AI can act as force multiplier for existing cyber threats and can be an enabler for new cyber threats. Moreover, AI can bolster cyber defences, and AI-powered systems can provide a new attack surface for cyber threats. Due to increased investment into and utilisation of AI, rising cyber threats, a growing cyber risk awareness in society and resultant regulatory, governance and technical risk treatment efforts, the last area of concern is especially relevant. In this regard, the financial sector is of specific interest due to its high investments into AI and cyber risk management, as well as high exposure to cyber risks. Financial institutions active in the EU also must consider upcoming legislation like the Digital Operational Resilience Act (DORA) and AI Act, which require them to adequately...Show moreArtificial intelligence (AI) and cyber security failure are two of the highest impact risk areas of this decade, with developments surrounding these two topics going hand in hand. For instance, AI can act as force multiplier for existing cyber threats and can be an enabler for new cyber threats. Moreover, AI can bolster cyber defences, and AI-powered systems can provide a new attack surface for cyber threats. Due to increased investment into and utilisation of AI, rising cyber threats, a growing cyber risk awareness in society and resultant regulatory, governance and technical risk treatment efforts, the last area of concern is especially relevant. In this regard, the financial sector is of specific interest due to its high investments into AI and cyber risk management, as well as high exposure to cyber risks. Financial institutions active in the EU also must consider upcoming legislation like the Digital Operational Resilience Act (DORA) and AI Act, which require them to adequately manage cyber risks for their AI systems. In contrast to more established technologies, there is no universal cyber risk management or security control framework designed for AI-powered systems, and such systems pose unfamiliar risks and provide new challenges. This is problematic since appropriate guidance is important for the implementation of effective cyber risk management practices. Furthermore, without insight in current cyber risk management practices for AI-powered systems, it is difficult to determine whether legislation or guidelines are fit for purpose, which is of importance from a regulatory perspective. As such, this thesis sets out to study which cyber risks AI-powered systems face, how cyber risks for AI-powered systems are managed in the financial sector, and which internal governance and control practices are used in relevant cyber risk management processes. The research is primarily based on a literature review, with the supportive method being semi-structured interviews. For scoping purposes, the interviews were conducted with experts and practitioners active in the Dutch financial sector. Still, due to the cross-border nature of the sector, results are likely to be applicable to the broader European financial sector. The five main findings are that: 1) While regulatory developments like DORA and the AI Act have resulted in increased financial sector attention for cyber risk management for AI-powered systems, the current state of play is that AI use is not widespread, with AI complexity being low and it often being used in a low-risk environment, resulting in relevant cyber risk management practices not being top of mind; 2) important focus areas in cyber risk management for AI systems are data and model risk; 3) next to AI data and model dependencies, AI system interconnectivity is another important source of risk, resulting in AI supply chain risks being an important focus area for cyber risk management; 4) concerning cyber risk identification and analysis practices, interview findings show that any cyber risk management for AI system framework should use an ecosystem perspective that considers the environment in which the system and organisation operate in, and 5) while increased regulatory attention to cyber risk management for AI is generally seen as a good thing, the multifaceted characteristics of AI systems and the risks they face require due consideration of potential contradictory regulatory requirements.Show less

Leiden University Student Repository

Documents

In Collections

Cyber Risk Challenges for AI: An Explorative Study into Cyber Risk Management for AI-powered Systems in the Dutch Financial Sector