Every trick-or-treater follows the same route: knock on a door, take the candy, check the wrapper before eating. The financial sector is walking a similar route with AI. While it opens the door to AI more readily than the market average and defends itself better than most, yet still encounters weak spots. These insights are based on recent global studies conducted by Kaspersky’s Internal Research Center.
AI promises financial institutions faster analysis, smarter decisions and more efficient operations. But as banks and insurers embrace the technology, a new challenge is emerging: how to capture its benefits without becoming exposed to unfamiliar risks that they’re not yet equipped to manage.
The first door: finance embraces AI where the benefits are clear and the risks are manageable
A new global survey by Kaspersky found that banking, financial services and insurance (BFSI) organisations are more likely than the market average to use AI for data analysis (59% vs. 54%) and project management (54% vs 49%). In these areas AI supports decision-making rather than executing transactions, so a weak output wastes time rather than money.
The door is opening wider. Kaspersky’s study showed that BFSI organisations are more likely to plan to expand their use of AI: 19% for external AI tools and 8% for internal ones, compared with 15% and 7% across the market. The margins are small, but they point in one direction: finance sees AI as a lasting part of operations.
Same monsters, better costumes: AI makes familiar cyberthreats harder to spot
Phishing and ransomware remain among the main cyberthreats facing the financial sector. AI is making them harder to detect by enabling attackers to create convincing messages, imitate voices and produce fraudulent documents more quickly and at a lower cost.
It is also allowing them to tailor attacks with greater precision: Kaspersky’s Security Bulletin notes that AI is being used to model victim behaviour, craft more persuasive lures and probe infrastructure at a pace and scale that manual methods cannot match, contributing to a rise in targeted fraud, social engineering and market manipulation attempts.
For financial institutions, this raises the stakes: distinguishing legitimate communications from sophisticated attempts at fraud is becoming increasingly difficult. In practice, that means the attacks that already top the list can succeed more often. Technical defences help, but a believable fake still has to be recognised by a person, which leads to the next problem.
The monster within: how everyday AI habits expose financial data
Sometimes, the biggest AI risk does not come from an external attacker, but from shadow AI: employees using third-party AI tools, such as ChatGPT or DeepSeek, without their organisation’s approval. Kaspersky’s research found that 37% of BFSI respondents see this as a typical risky behaviour in their companies, compared with 30% across the market. For financial institutions handling sensitive client information and financial records, exposing data to unapproved tools can have particularly serious consequences.
Traditional security controls cannot always prevent this kind of exposure. When an employee pastes confidential information into a public AI chatbot, the data may leave the organisation’s controlled environment without triggering a conventional security alert. The concern is reflected in the findings: 85% of BFSI respondents recognise risks associated with AI, while 9% believe these risks cannot be eliminated at all.
The figures point to a gap between recognising the danger and managing it in practice. Awareness matters, but it cannot replace clear rules on AI use, access to approved tools and sufficient visibility into how employees use these technologies. For financial organisations, keeping the monster out means making secure AI use easier to follow than risky shortcuts.
One door stays shut: why finance is more cautious about AI-generated code
At the same time, only 23% of BFSI organisations use AI for programming, compared with 34% across the market, an 11-percentage-point gap in one of the most prominent areas of AI adoption. One possible explanation is the cost of getting it wrong. An inaccurate analysis can be revisited and corrected but a flaw in code used by a critical financial system can persist, spread across applications and potentially affect essential services.
The figures do not establish why financial organisations use AI for programming less often. However, they highlight a sector in which the consequences of errors can be particularly significant. AI may be welcomed as an assistant for analysis, planning and decision-making, but its use in developing critical systems calls for more stringent safeguards.
“Financial companies are drawing a deliberate line: AI is welcome where it speeds up analysis and planning, but kept away from the code that runs critical systems. Where LLM use is approved, policies governing how it is used, with what privileges and with what degree of isolation should be in place and enforced to prevent the spread of shadow AI – uncontrolled and unmonitored use of unauthorised AI tools. Unapproved tools need to be brought under security review or replaced with approved alternatives, while agents need clear rules, limited permissions and human oversight,” said Vladislav Tushkanov, Group Manager at Kaspersky AI Technology Research Center.
Keep the monsters outside: govern AI and strengthen cyber defences
As financial organisations expand their use of AI, they need to manage not only the threats posed by external attackers but also the risks created by how the technology is used internally. That starts with governance. Companies need clear policies defining which AI tools employees can use, what data they can share with them and what level of access AI systems and agents should have. Approved services, access controls and monitoring help security teams maintain visibility, while practical awareness training helps employees recognise risky behaviour and avoid exposing sensitive information. These safeguards should reflect how AI is deployed, whether through cloud services, locally run open-source models or in-house developments.
But keeping AI under control is only half the job. Traditional cybersecurity defences remain essential, especially as attackers use AI to make phishing more convincing, automate reconnaissance and adapt their techniques more quickly. Financial organisations therefore need to maintain effective protection against external attacks while considering how AI capabilities can strengthen their security operations. AI-enabled security tools can help identify suspicious activity, correlate signals across multiple systems, prioritise alerts and accelerate incident investigations. For example, they can help analysts interpret obfuscated command lines or piece together an attack chain, reducing the time needed to understand what has happened and where to respond.
AI does not replace the need for a strong security foundation or skilled analysts. Its value lies in helping security teams work more efficiently and respond to increasingly sophisticated threats, while human oversight remains essential for consequential decisions. For financial institutions, the priority is to combine established defences with AI-enhanced capabilities and clear rules for the safe use of AI across the organisation.
Trick or treat? Make security part of the AI strategy
Taken together, the findings reveal a sector moving ahead with AI while maintaining a strong focus on cybersecurity. Financial organisations are planning to expand AI adoption and continue investing in established defences, yet the risks associated with employee behaviour and AI systems themselves require additional controls. The challenge is not simply to strengthen the existing security stack but to adapt it to the ways AI is being used.
This means treating AI governance and cybersecurity as two sides of the same strategy: enabling innovation while keeping data, systems and critical decisions protected. Those that strike this balance will be better positioned to capture AI’s benefits without letting new capabilities become an unexpected liability.
In the AI era, the organisations best positioned to benefit will be those that advance innovation and security together. Discover our comprehensive, industry-specific protection for complex environments here.
Image Credit: Kaspersky
Source: Tahawul Tech