LfA Förderbank Bayern

Dr. Frank Simon

Cybersecurity Resilience Leader

Dr. Frank Simon is leading the whole IT at LfA Förderbank Bayern, with expertise in IT operations, cybersecurity, vulnerability management and digital resilience.

The Overlooked Cybersecurity Cost of AI

Artificial Intelligence is widely regarded as one of the most transformative technologies of our time. Across industries, organizations are investing heavily in AI-driven capabilities to automate tasks, improve decision-making, reduce costs and increase operational efficiency. Surveys consistently indicate that executives expect substantial productivity gains from AI adoption.

However, there is another side to this development that receives less attention. AI is simultaneously changing the cybersecurity landscape at unprecedented speed. Vulnerabilities are discovered faster, exploits are developed more rapidly and cyber threats evolve in near real time. As a result, organizations must devote increasing effort to maintain an acceptable level of security and operational resilience.

The Hidden Side of AI

New vulnerabilities are identified every day, and AI-assisted tools increasingly accelerate the creation of proofs-of-concept and exploits. The time between vulnerability disclosure and practical exploitation has decreased dramatically and is still decreasing.

The growing number of reported vulnerabilities has already forced institutions to adjust their operating models. For example, the National Vulnerability Database (NVD) historically attempted to enrich virtually every published CVE with severity ratings, affected product information and additional context. Due to the overwhelming flood of new vulnerabilities, however, only selected CVEs now receive extensive enrichment and analysis. This illustrates the scale of the challenge facing the cybersecurity community.

The Impact on Banks and Highly Regulated Organizations

For banks, the situation is particularly challenging. Stakeholders expect higher efficiency, lower costs and better service quality through AI adoption, while cybersecurity teams face a growing volume of risks requiring additional attention, expertise and resources. The following list of 8 dimensions refines this hypothesis:  

1. From Patch Management to Vulnerability Management

Historically, most software vendors followed predictable, fix release cycles. Maintaining a secure environment largely consisted of planning, testing and deploying scheduled patches.

Today, this approach is no longer sufficient. Between two patch cycles, vulnerabilities may be disclosed, assessed, weaponized and actively exploited. Organizations, therefore, require continuous vulnerability management that goes beyond patch installation. Risks must be identified, analyzed, prioritized, monitored, mitigated and documented throughout their lifecycle.

2. Continuous Discovery Requires Dedicated Toolchains

Modern vulnerability management cannot be performed manually. Organizations require specialized toolchains that continuously update vulnerability intelligence repositories and scan a wide range of technologies.

A bank operating Windows platforms may require one set of tools, while Linux environments, network devices, cloud workloads, databases, containers and web applications may require additional capabilities. The acquisition, operation, maintenance and integration of these tools create entirely new workloads.

3. Vulnerability Management Must Become Part of IT Service Management

Identifying vulnerabilities is only the beginning. Organizations must establish processes to ensure every identified vulnerability is assessed and managed, requiring close integration between security operations and IT service management (ITSM).

A common approach is to automatically create tickets and assign them to system owners responsible for risk evaluation and remediation planning. This introduces new workflows, governance requirements, escalation mechanisms and reporting obligations.

4. Vulnerability management includes risk management

Not every vulnerability requires the same treatment. A detailed risk analysis might show, that some affected components are not installed or affected features are not used. In other contexts some risks might be compensated by restrictive firewall settings, network segmentations or additional endpoint protection.

A detailed risk analysis may determine that vulnerability is highly relevant even when no vendor patch is available. Organizations must then consider alternatives like disabling services, removing vulnerable components, changing configurations, introducing compensating controls or deploying virtual patching technologies. ISO 31000 provides guidance on typical risk treatment strategies.

Each option requires analysis, documentation, decision-making, testing and follow-up beyond traditional patch deployment.

5. Supplier Management Becomes a Security Capability

A considerable proportion of vulnerabilities originates in commercial products and third-party services. An organization's security posture, therefore, increasingly depends on the responsiveness and transparency of its suppliers.

Security teams need information about affected components, exploitability, remediation timelines and available mitigation options. Supplier discussions that once occurred occasionally may now take place continuously whenever critical vulnerabilities emerge. Cybersecurity is consequently becoming a key criterion for evaluating long-term supplier relationships.

6. Increased Change Frequency Requires Test Automation

When systems were updated only a few times per year, manual testing was manageable. Today, security-related changes occur far more frequently, with weekly deployment cycles becoming common.

This transforms testing into a highly repetitive activity. Test automation is therefore becoming a prerequisite for maintaining both security and operational stability across a large application landscape.

7. Testing Demands More Staging Environments

Frequent remediation also increases the importance of dedicated test and staging environments. While organizations may previously have relied on vendor-tested patches, custom mitigation measures require validation before deployment into production.

Configuration changes, feature deactivations, virtual patching techniques and compensating controls can all introduce side effects that must be tested in a dedicated environment. The more actively an organization manages vulnerabilities, the more important comprehensive testing environments become.

8. New Challenges Require New Skills

Vulnerability management as a core discipline need significant skill requirements. IT professionals must understand CVEs, CVSS scores, EPSS predictions, attack-path analysis, MITRE ATT&CK mappings, threat intelligence and vulnerability prioritization models.

They must also learn how information from multiple security organizations and databases can be combined into practical operational decisions. Organizations must invest in training, establish best practices and develop institutional knowledge that enables teams to operate effectively in an increasingly threat-driven environment.

For a bank, these activities are no longer optional. They are essential for maintaining digital resilience and keeping cyber risks within acceptable limits.

The irony is striking. While AI creates efficiency gains in many disciplines, it is simultaneously increasing the workload required to maintain cybersecurity. Vulnerability management, tooling, testing, supplier coordination, governance and specialized skills all consume additional time and resources.

Whether future AI-driven productivity gains will ultimately compensate for this burden remains an open question.

One thing, however, is already clear:

The era in which cybersecurity hygiene could be regarded as an expensive premium feature is over. Security has become a fundamental prerequisite for operating software in a world where vulnerabilities are discovered, weaponized and exploited at machine speed.

It is no longer a competitive advantage.

It is a necessity for survival.