How to Proactively Address AI-Enabled Cyber Threats Before the ECB Demands It

On July 7, 2026, Claudia Buch, Chair of the ECB Supervisory Board, directly addressed CEOs of significant institutions, emphasizing that AI models compress the timeline between vulnerability discovery and exploitation. This isn't about new risks, but about an unprecedented acceleration of existing ones.

The responsibility for responding to these accelerated threats falls squarely on banks' management bodies and requires them to reassess ICT investments, resource allocation, and risk-tolerance frameworks immediately. Unresolved supervisory findings in ICT and security will become "increasingly material." For Enterprise IT Decision-Makers, reassessments will require bridging the mainframe-cloud gap with unified visibility and control, as it is now a regulatory requirement.

The ECB mandates immediate focus on several short-term measures.

1. First, prioritize protecting all potential attack surfaces, including third-party software, open-source components, cloud environments, and VPN connections. Continuous monitoring and minimization of internet-facing assets are crucial.

2. Second, accelerate vulnerability and patch management at scale by preparing for higher patch volumes and frequencies. This requires adequately staffed ICT functions and agile change management processes.

3. Finally, it’s crucial to enhance monitoring, detection, and AI-enabled defensive capabilities across applications, access logs, and network traffic.

It is the responsibility of management bodies to ensure that current ICT budgeting, staffing, and tooling are sufficient to meet these accelerated demands.

Beyond immediate fixes, the ECB is demanding structural measures to reinforce operational and cyber resilience. These measures include reinforcing defense-in-depth and cyber hygiene through segmentation (including micro-segmentation) and Zero Trust principles.

Continuous verification of users, devices, and applications is paramount. In addition, modernizing infrastructure by replacing or updating legacy, unsupported, or end-of-life technologies is critical to reduce risk. Where replacement isn't feasible, comprehensive protection through additional controls is required.

These structural changes are vital for future-proofing your mainframe operations and achieving auditable compliance.

The ECB explicitly links these new demands to the Digital Operational Resilience Act (DORA), requiring institutions to assess the evolving threat landscape and develop comprehensive action plans by October 31, 2026.

• This plan must outline concrete measures,

• allocate resources,

• assign clear roles,

• and define implementation timelines.

Strengthening governance, funding, and awareness training is essential.

Crucially, institutions remain fully accountable for risks from outsourced ICT services, necessitating robust supply chain assurance. This means understanding and evaluating third-party providers' preparedness for accelerated vulnerability disclosure and patching, thereby ensuring Zero Trust across your entire enterprise.