The ‘C’ in CFO Now Stands for Cybersecurity, Thanks to AI

On Thursday (Oct. 15), for example, Sarah Breeden, deputy governor of the Bank of England (BoE), said that advances in AI meant the technology now presents a “systemic risk” to the world financial system. And a day earlier, Bank of America CEO Brian Moynihan said Wednesday (Oct. 14) that the bank he leads had deployed 1,000 contractors and 3,000 employees to fix software flaws discovered by Anthropic’s Mythos and other frontier AI models.

The emerging imbalance is straightforward. An attacker can deploy inexpensive AI agents to probe software, identify weaknesses and test potential exploits around the clock. A company defending that software must determine which findings are credible, investigate whether systems are exposed, prioritize remediation, deploy patches and verify that nothing breaks in the process.

Both sides can automate parts of the work. But their economics are fundamentally different.

See also: AI Gives Cybersecurity a Backlog CFOs and CISOs Can’t Patch Away

AI Has Irrevocably Shifted the Economics of Finding a Cyber Flaw 

Attackers need only find one exploitable weakness to achieve a particular objective. Defenders must manage a much larger network of vulnerabilities, configurations, identities and interconnected systems while preserving the availability of the business itself.

The PYMNTS Intelligence report “Scale Amplification: How Revenue Amplifies Agent-Driven Identity,” showed that large enterprises, with their larger digital footprints, can be more susceptible to the AI-powered spoofing of identity documents due to the industrialization of deepfakes and automated data scraping capabilities by adversarial fraudsters.

And while AI is reducing the cost of generating potential attacks, the cost of responding to them remains tied to human expertise, infrastructure complexity and operational risk.

As the cost of model inference declines and automated workflows improve, both legitimate researchers and malicious fraudsters can afford to investigate more potential weaknesses. An activity that once required hours of expert attention may now begin with automated analysis. For CFOs, this creates a new financial problem. Cybersecurity spending is no longer simply a question of how much protection a company can purchase, but a question of how efficiently that protection can be sustained against an adversary whose marginal cost of searching for weaknesses keeps falling.

The PYMNTS Intelligence report “2025 State of Fraud and Financial Crime in the United States” found in December that 68% of financial institutions increased their fraud detection budgets year over year. That spending came as 46% of institutions reported increasingly sophisticated fraud schemes, up from 35% a year earlier.

After all, finding a vulnerability and fixing one are not equivalent activities.

Read more: Cyber Risks Turn Physical When Hackers Control the Retail Thermostat 

CFOs Move From Security Budgets to Security Unit Economics

Historically, security investment has often been justified through compliance requirements, risk assessments, incident histories and the perceived need for additional tools or personnel.

AI complicates that framework because activity is becoming a less useful measure of effectiveness. A security platform that generates 100,000 findings may appear more productive than one that generates 10,000. But if the larger volume overwhelms analysts and delays remediation, the company may be paying more to become less secure.

For CFOs, the objective is not necessarily to minimize cybersecurity expenditure. It is to reduce the cost of eliminating a unit of material risk.

The urgency is becoming measurable. Google Threat Intelligence Group reported in September that monthly vulnerability disclosures more than doubled between January and August, while the monthly average of exploited vulnerabilities rose from 10.5 in 2025 to 18 during the first eight months of 2026. The figures do not establish that AI caused every increase, but they illustrate the growing workload confronting defenders.

In response, CFOs are now treating cybersecurity as a recurring economic contest rather than a collection of discrete technology investments.

AI models consume computing resources. So do automated scans, code reviews, exploit simulations and defensive investigations. But not every task requires the most sophisticated or expensive model.

An attacker might use inexpensive models to screen thousands of potential targets, reserving more capable systems for promising opportunities. Defenders can adopt a similar approach, using cheaper automation for routine classification and escalating complex findings to specialized models and human experts.

For CFOs, the emerging objective is straightforward: make each dollar spent on defense retire more risk than the previous one.

In an AI-driven cybersecurity cost war, finding the next vulnerability may become cheap. Staying ahead of it will remain the expensive part.