While cyberattacks are unfortunately not foreign to company technology support teams, many provide a lesson for other teams to learn from.
Earlierthis month, hackers used artificial intelligence agents to target more than 2,250 organizationssubscribingto thecloud-basedMicrosoft 365 service through theConnectWiseplatform, bringing into question the role AI is now playing incyberattacks.
Want the latest retirement plan adviser news and insights? Sign up for PLANADVISER newsletters.
As financialfirms continue to build and evolve their technology stacks and security strategies, industry professionals say it will be essential to consider how to both use—and beprotected from
“When we look at AI, we see it as a very powerful tool. We want our staff using AI. It’s going to make them more efficient,” says Matthew Vandre, director of digital services and afiduciary financial planner at Francis LLC. “However, as is the case with any powerful tool, it can do a lot of good, or it can do a lot of harm. You can hurt yourself.”
Vandre saysthereis a balancing act firms have to perfect, as they weigh cybersecurity concerns alongside their need to remain technologically innovative. He argues the
most effective defense will bea cultural shift in attitudes towardsAI and cybersecurity.
“The most important security control is not a piece of software. It’s a culture where people understand that protecting data is part of their professional responsibility,” says Vandre.
‘Data Is the New Oil’
As client and firm data become increasingly valuable, Vandre says it will be essential for firms to realize “data is the new oil.”
Thesignificant value of datawas also emphasized inan announcement last week by the National Security Agency, which said there was a critical PHP patch released for public websites to use to avoid cyberattacks.
Additionally, theNSA, alongside the National Institute of Standards and Technology’s Center for Advancing Innovation and Standard for Super Intelligence and the Cybersecurity and Infrastructure Security Agency,released guidance in the same week for organizations to prepare or manage AI related control incidents.
The NSA’s newest patch recommendation and guidance are examples of how external tools are evolving to become more diligent against sophisticated cyber-attacks.
Internally, it will be increasingly important for firms to implement the cultural shift Vandre references. Experts say
firms can strategize against sophisticated attacksand develop firm policies around AI and cybersecurity,but the plansthey developneed to betaught to employeesand integrated into firmworkflows.
According to Tom Quinn,chief information security officer at T. Rowe Price, “You can’t protect technology without technology.”
Overly cautiousfirms that may avoid innovative technologies like agentic and generative AIas a form of protection may end uphaving a harder time remaining protected, if theirtechnology remains outdated.
“You have to keep pace with change,” says Quinn. “Everyone has a role in cybersecurity, and in how [generative]AI and agentic [AI are] going to be deployed. For companies that don’t embrace that [and related]compliance, legal, privacy and [human resources] and tech,…those companies may struggle.”
Routine training will also increasingly become important.
“You need to train people how to use AI safely and in a way that prioritizes protecting data,” says Vandre. “If you want to use something else, we want you to get approval first. We need to confirm that there is a contractual guarantee that there’s no ability for that technology, that LLM, that AI agent,to take our data and expose it.”
Protection from the ‘-ishings’
One of the most common cyber threats registered investment advisory firms increasingly face is what the Financial Industry Regulatory Authority calls “-ishing scams.”
A recent article published by FINRA identified the three common forms of cyber-enabled frauds:“phishing”scams sent “vishing” scams sent viaphone call or voicemail.They often involvescammers claiming to be financial institutions, electronic payment services, mail delivery companies, electronic signature platforms or other similar services
These scams are also increasingly becoming sophisticated through developments in AI, includingdeepfakevideosandvoice cloning.
Vandre says his firm also has training implemented with staff and clients to identify important security needs.
“[Staff are] getting those kinds of things sent to them just out of the blue, so we can see how they’ll react to them and where our education gaps are,” he says.
Additionally, he says he offers such training to clients to help prepare them for the unexpected.
In FINRA’s article, the group recommends firms and clients remain vigilant online and skeptical of any unexpected messages. Misspelled company names and jumbled website URLs were highlighted as clear definers of phishing, but scammers have also evolved their tactics with new technology.
“These scams now also sometimes incorporate generative AI elements, making them difficult to distinguish from authentic communications,” stated FINRA.
Quinn also highlighted the importance of ramping up technology tools to help identify fraudulent behaviors, as AI makes them harder for humans to spot.
“There are AI tools that will look for audio and video anomalies. Those are some of the things that should be considered when you’re thinking about business process protection,” he says. “This process [of] anomaly detection, I think you will see in the future agentic lawyers, agentic compliance capabilities, agentic HR capabilities, agentic cyber capabilities [and] agentic risk capabilities that are assembled around business processes.”
« Aon Sued Under ERISA Over Alleged Profits From Employee Benefits Program
