Tool dependence leaves institutions with cyber gaps

Cyber awareness must reach receptionists and CEOs as AI attacks target humans not just systems.

AI-driven attacks are pushing financial institutions beyond perimeter security as threats move from firewalls and web applications to identity, data and employees.

According to Shivkrishna Anilkumar, Head of Cybersecurity Solutions at Concentrix, the shift comes as 87% of leaders report increased exposure from AI-driven threats. Shiv said attackers are using automated phishing, deepfakes and impersonation to target people directly.

“Today, what we see with AI is that AI is targeting humans,” he said. The risk is rising as financial institutions add more cloud systems, APIs, third-party links and digital access points.

Shiv said digital transformation has widened the number of places attackers can exploit. “The attack surface grows even larger with all these cloud integrations and rapid adoption,” he said.

Attacks that once happened less often are now increasing much faster, making continuous monitoring and quicker response essential for financial institutions.

Despite higher cybersecurity spending, gaps remain because many organisations rely too heavily on technology. Shiv said tools cannot work without trained people and clear processes. He added that awareness should extend beyond security teams to all employees, from receptionists to chief executives.

Financial institutions also need to stop managing cyber tools as separate solutions. Shiv said firms need a single view of risks across their systems so teams can detect, monitor and fine-tune defences faster. Without that visibility, more spending may not translate into stronger protection.

Over the next three to five years, Shiv said cyber-mature institutions will be defined by zero trust architecture, stronger visibility and board-level ownership of cybersecurity.

“In cybersecurity, we always say there is no 100%, ever. There is no guarantee,” he said. Boards and decision-makers should embed cybersecurity into product launches, service design and access controls rather than treat it as a cost centre.

For Shiv, cyber maturity will depend less on spending more and more on whether banks can align people, processes and tools before attacks outpace their response.