How Artificial Intelligence Can Build Advisers’ Cybersecurity Strategy

While cyberattacks are unfortunately not foreign to company technology support teams, many provide a lesson for other teams to learn from.

Earlier this month, hackers used artificial intelligence agents to target more than 2,250 organizations subscribing to the cloud-based Microsoft 365 service through the ConnectWise platform, bringing into question the role AI is now playing in cyberattacks.

As financial firms continue to build and evolve their technology stacks and security strategies, industry professionals say it will be essential to consider how to both use—and be protected from—AI.

“When we look at AI, we see it as a very powerful tool. We want our staff using AI. It’s going to make them more efficient,” says Matthew Vandre, director of digital services and a fiduciary financial planner at Francis LLC. “However, as is the case with any powerful tool, it can do a lot of good, or it can do a lot of harm. You can hurt yourself.”

Vandre says there is a balancing act firms have to perfect, as they weigh cybersecurity concerns alongside their need to remain technologically innovative. He argues the

most effective defense will be a cultural shift in attitudes towards AI and cybersecurity.

“The most important security control is not a piece of software. It’s a culture where people understand that protecting data is part of their professional responsibility,” says Vandre.

‘Data Is the New Oil’

As client and firm data become increasingly valuable, Vandre says it will be essential for firms to realize “data is the new oil.”

The significant value of data was also emphasized in an announcement last week by the National Security Agency, which said there was a critical PHP patch released for public websites to use to avoid cyberattacks.

Additionally, the NSA, alongside the National Institute of Standards and Technology’s Center for Advancing Innovation and Standard for Super Intelligence and the Cybersecurity and Infrastructure Security Agency, released guidance in the same week for organizations to prepare or manage AI related control incidents.

The NSA’s newest patch recommendation and guidance are examples of how external tools are evolving to become more diligent against sophisticated cyber-attacks.

Internally, it will be increasingly important for firms to implement the cultural shift Vandre references. Experts say

firms can strategize against sophisticated attacks and develop firm policies around AI and cybersecurity, but the plans they develop need to be taught to employees and integrated into firm workflows.

According to Tom Quinn, chief information security officer at T. Rowe Price, “You can’t protect technology without technology.”

Overly cautious firms that may avoid innovative technologies like agentic and generative AI as a form of protection may end up having a harder time remaining protected, if their technology remains outdated.

“You have to keep pace with change,” says Quinn. “Everyone has a role in cybersecurity, and in how [generative] AI and agentic [AI are] going to be deployed. For companies that don’t embrace that [and related] compliance, legal, privacy and [human resources] and tech, … those companies may struggle.”

Routine training will also increasingly become important.

“You need to train people how to use AI safely and in a way that prioritizes protecting data,” says Vandre. “If you want to use something else, we want you to get approval first. We need to confirm that there is a contractual guarantee that there’s no ability for that technology, that LLM, that AI agent, to take our data and expose it.”

Protection from the ‘-ishings’

One of the most common cyber threats registered investment advisory firms increasingly face is what the Financial Industry Regulatory Authority calls “-ishing scams.”

A recent article published by FINRA identified the three common forms of cyber-enabled frauds: “phishing” scams sent via email; “smishing” scams sent via text or encrypted message; and “vishing” scams sent via phone call or voicemail. They often involve scammers claiming to be financial institutions, electronic payment services, mail delivery companies, electronic signature platforms or other similar services.

These scams are also increasingly becoming sophisticated through developments in AI, including deepfake videos and voice cloning.

Vandre says his firm also has training implemented with staff and clients to identify important security needs.

“[Staff are] getting those kinds of things sent to them just out of the blue, so we can see how they’ll react to them and where our education gaps are,” he says.

Additionally, he says he offers such training to clients to help prepare them for the unexpected.

In FINRA’s article, the group recommends firms and clients remain vigilant online and skeptical of any unexpected messages. Misspelled company names and jumbled website URLs were highlighted as clear definers of phishing, but scammers have also evolved their tactics with new technology.

“These scams now also sometimes incorporate generative AI elements, making them difficult to distinguish from authentic communications,” stated FINRA.

Quinn also highlighted the importance of ramping up technology tools to help identify fraudulent behaviors, as AI makes them harder for humans to spot.

“There are AI tools that will look for audio and video anomalies. Those are some of the things that should be considered when you’re thinking about business process protection,” he says. “This process [of] anomaly detection, I think you will see in the future agentic lawyers, agentic compliance capabilities, agentic HR capabilities, agentic cyber capabilities [and] agentic risk capabilities that are assembled around business processes.”