What the ECB’s AI Cybersecurity Letter Means for Mainframe Security

In its July 2026 letter on AI-enabled cybersecurity threats, the European Central Bank warns that emerging AI models can identify software vulnerabilities and generate working exploits at unprecedented speed. The result is a compressed window between the discovery of a vulnerability and its potential exploitation. The ECB is describing this as a long-term change in the threat landscape.

The ECB expects these companies to assess the impact of the evolving threat landscape and develop a comprehensive action plan with concrete measures, resources, responsibilities, and implementation timelines. The deadline for submission to the respective Joint Supervisory Team is 31 October 2026.

For CEOs in particular, it is crucial to update the cybersecurity strategy and be honest about where their weaknesses are and what they are doing to address them.

The ECB's recommendations cover a broad cybersecurity landscape, from vulnerability and patch management to third-party risk, infrastructure modernization, incident response, and overall visibility.

1. One standout recommendation is to strengthen monitoring of application and access logs, as well as other indicators, particularly for critical internal systems.

2. It highlights zero-trust principles and continuous verification of users, applications, and service accounts.

3. In addition, it calls for “strong baseline controls,” specifically secure configuration, robust access controls based on least privilege, and comprehensive logging.

For banks whose critical business processes depend on IBM Z, that should put the RACF environment at the forefront of the threat assessment. RACF determines who and what can access critical mainframe resources, but management should ask whether these access controls are as secure as we think they are.

• Who has access?

• Is access to critical resources still justified?

• Can we detect RACF security threats quickly enough?

A RACF security audit can establish the current state of the mainframe access-control environment, identify weaknesses, and provide a fact-based foundation for remediation priorities in line with the ECB initiative.

At Beta Systems, we offer RACF audit services designed to examine a client’s RACF environment and identify security weaknesses for remediation. This report creates a documented baseline from which the organization can prioritize where to take immediate action.

An audit is most valuable when it starts an improvement cycle rather than a one-off exercise, and this is where Beta Access can make a difference.

Beta Access provides a central point of control for RACF environments and combines RACF administration, analysis, auditing, reporting and monitoring capabilities. Organizations can analyze RACF databases, SMF data and z/OS environment settings, while auditors can generate reports without requiring direct access to the z/OS environment or specialist RACF knowledge.

For the requirements highlighted by the ECB, three capabilities are particularly relevant:

1. Turn access-control assumptions into evidence

The ECB emphasizes robust access controls, low-privilege rights, secure configuration, and comprehensive logging as baseline elements of your cybersecurity strategy.

Beta Access provides visibility into RACF information and enables organizations to analyze permissions and RACF configuration rather than relying solely on assumptions about how the environment was originally designed. Changes made through Beta Access are also captured and logged in a dedicated relational database, providing administrators and auditors with an accessible record of RACF data and changes.

For management, that means a straightforward way to gather evidence on control effectiveness and areas for improvement.

2. Benchmark RACF security against STIG recommendations

Beta Access supports security analysis using Security Technical Implementation Guide (STIG) recommendations. Beta Systems' current STIG capabilities can cover approximately 80% of relevant STIG requirements, providing banks with a structured way to assess RACF security controls and identify deviations for further investigation.

For executive stakeholders, a dashboard that provides a consistent view of the data is also considerably more actionable than hundreds of individual RACF settings.

3. Move from periodic review to real-time monitoring

The ECB specifically calls on banks to strengthen monitoring and detection as AI increases the speed at which attacks can develop.

Beta Access Monitor provides real-time alerts for critical RACF and security-relevant events, including unauthorized access to sensitive data or changes to critical user attributes. Events can be escalated to defined recipients or operations monitoring systems.

When attackers can operate faster, security teams need to reduce the time between event, visibility, and response. Mainframe access monitoring should be part of that process.