Picture a familiar Monday. The vulnerability report shows a few hundred open items, a handful rated critical, and a patch window three weeks away. Now imagine the number of validated findings doubles because AI tools, yours or someone else’s, are reading code and configurations faster than any team could. The scanner did not get worse. Your fix cycle just did not get faster.
That is the scenario behind a warning reported by Compliance Week: the UK Financial Conduct Authority says rapid advances in AI could expose cyber vulnerabilities faster than financial firms can remediate them. This article draws on that report and on the FCA’s own publications, linked below. The Crest.Digital perspective on what to change is ours, not the FCA’s.
No video accompanies this piece, so we have kept it to the primary sources and a practical plan for CISOs, CROs, internal audit and technology-risk teams in banks, NBFCs and global capability centres.
Crest.Digital’s platform gives risk, audit and technology teams continuous visibility of third-party and control exposure, with remediation tracked to retest.
Explore the PlatformWhat the FCA Actually Said
Two FCA publications matter here. In May 2026 the FCA, Bank of England and HM Treasury issued a joint statement on frontier AI models and cyber resilience. It described the cyber capabilities of current frontier models as already exceeding what a skilled practitioner can do, at greater speed, scale and lower cost, and said authorities expect firms to strengthen governance, vulnerability management, third-party oversight, protective controls and incident response. It also called for vulnerabilities to be triaged, prioritised, assessed and remediated rapidly and at scale, using automation where feasible.
In September 2026 the FCA followed with a multi-firm review, Frontier AI and cyber resilience. It reports that firms see vulnerability discovery accelerating faster than their ability to respond, and that validation, engineering resource, patch testing and change management struggle to keep pace even after experts discard many AI outputs. One observation is worth quoting: firms suggested the issue is “not just whether they can identify vulnerabilities, but whether they can effectively assess and respond to a continuous flow of findings.”
The review also notes that frontier models can combine several lower-rated flaws into routes to compromise, so severity ratings alone are a weak guide. It stresses that human oversight remains critical. And it is explicit that it summarises what firms reported and does not introduce new rules or expectations. We treat it as a signal of supervisory direction, not as a new requirement.
The Real Concern: A Speed Differential
Read together, the message is about a gap between two clocks. One clock is how fast flaws can be found, validated and exploited. The other is how fast a firm can decide, test, change and verify. Vulnerability management has traditionally been periodic, and the second clock was tolerable when the first moved slowly.
We cannot say how much any one firm’s window will change, and nobody should claim a precise figure. The FCA’s own review reports observations, not measurements. The prudent response is to measure your own window and manage it down.
Why Periodic Audits and Patch Cycles Fall Short
Where the Periodic Model Strains
- Snapshots age quickly: A quarterly report describes a state that may no longer exist.
- Queues grow in the middle: Findings wait for validation, testing and change windows, which are the bottlenecks firms told the FCA about.
- Exceptions go quiet: Risk acceptances with no expiry become permanent by neglect.
- Severity can mislead: Several “medium” items may chain into one serious path.
- Suppliers sit outside the cycle: Your exposure includes software and services you do not patch yourself.
This is the same lesson we have drawn on evidence generally: a record of activity is not proof that a control works. See continuous evidence, not just continuous monitoring, and our 12-point AI cyber control checklist for internal audit. For the discovery side of the problem, read AI vulnerability discovery and the vendor remediation gap.
The Crest Approach: One Chain from Asset to Retest
Continuous control monitoring does not mean scanning more often. It means keeping a single, connected chain current: Asset, Vulnerability, Risk Rating, Control, Exception, SLA, Remediation, Retest. Each link has an owner and a timestamp, and each hand-off is visible. When a bottleneck forms, for example fixes waiting for change approval, it appears as ageing data that the CISO and audit committee can see, not as a surprise.
Agentic AI can help on the defender side by assembling evidence, matching findings to assets and controls, chasing owners and checking SLA ageing. Judgement stays with people: validating what is truly exploitable, accepting risk, and approving exceptions. That mirrors the FCA’s emphasis on qualified human review. For the platform view, see Agentic GRC.
Eight Steps from Periodic Audit to Continuous Control Monitoring
Asset
Maintain a current inventory of systems, applications, cloud services and third-party dependencies, tied to the business services they support.
Vulnerability
Capture findings from scanners, testing, AI-assisted discovery and supplier notices in one register, de-duplicated and linked to the affected asset.
Risk Rating
Rate each finding on exploitability, exposure, compensating controls and business service impact, and look at how lower-rated flaws could chain together.
Control
Map each finding to the control that should have prevented or detected it, and flag where that control is weak or untested.
Exception
Log any gap or delayed fix as a formal exception with an owner, a reason, an expiry date and an approval by an accountable person.
SLA
Set remediation deadlines by risk rating and track ageing automatically, escalating before the deadline passes rather than after.
Remediation
Track fixes through engineering, testing and change management so bottlenecks show up as data, not as surprises in the quarterly report.
Retest
Verify every fix independently, record the evidence, and reopen the item if the retest fails. Close only on proof.
Start small: pick the most critical business services, run the chain for those, and publish ageing against SLA every week. Extend only when the first set runs cleanly.
Crest.Digital’s Agentic GRC and Agentic AI workflows track exceptions, SLAs and retests continuously, with human approval and a full activity record. See the industries we cover.
What Internal Audit, CROs and Boards Should Ask
Five Questions for the Next Committee Meeting
- How long is our exposure window? From discoverable to verified fix, for critical services.
- Where is the bottleneck? Validation, engineering, testing or change approval.
- How old are our exceptions? How many have passed their expiry or SLA?
- Who owns frontier-AI cyber decisions? Is there a named owner and an escalation route?
- What about suppliers? Do we know which critical vendors can patch quickly?
The supplier question is often the hardest. Weak links tend to sit outside the core estate; see why in the mid-market supplier cyber weak link and supply chain cyber risk intelligence, not a questionnaire. For prevailing good practice on timely remediation, the UK National Cyber Security Centre and the US CISA Known Exploited Vulnerabilities catalog are useful references for prioritising what is already being exploited.
For banks and NBFCs in India and for GCCs serving global parents, the same logic applies whatever the local rulebook: supervisors increasingly ask not whether you have a vulnerability programme, but how fast it moves and how you can prove it.
Your Turn: How Fast Is Your Fix Cycle?
- Periodic: Quarterly scans, spreadsheet exceptions, annual audit.
- Improving: Monthly reporting, SLAs defined but tracked by hand.
- Continuous: Live chain from asset to retest, ageing visible weekly.
If AI doubled your validated findings tomorrow, which row are you in? Tell us in the comments when you share this on LinkedIn, and what your biggest bottleneck is.
Crest Perspective
AI governance programmes that treat AI risk as a technology problem will be underprepared for the regulatory environment taking shape in 2025–26. The EU AI Act, NIST AI RMF, and emerging FCA guidance all frame AI risk as a governance and accountability question first — the technology controls follow from having clear answers to who is responsible, what decisions the AI influences, and what the escalation path is when the system behaves unexpectedly.
Frequently Asked Questions
In its September 2026 multi-firm review, Frontier AI and cyber resilience, the UK Financial Conduct Authority reports that firms see vulnerability discovery accelerating faster than their ability to respond. Firms told the FCA that the constraint is increasingly validation, engineering capacity, patch testing and change management, not finding issues. The FCA states the publication summarises firm observations and does not introduce new rules, guidance or expectations. Read the review on the FCA website for exact wording.
Traditional vulnerability management runs in cycles: scan, prioritise, patch, retest. If AI tools raise the number of validated findings and shorten the time to exploit them, a fixed remediation cycle falls further behind each quarter. The exposure window is the time between a flaw being discoverable and it being fixed and verified. Reducing that window needs fewer manual hand-offs, clearer ownership and automated evidence at each step.
Yes, but as a check on design and governance, not as the main way of knowing control status. A point-in-time audit tells a committee how things looked on the sample date. It cannot show whether a critical exception is ageing past its SLA today. Periodic audit works best alongside continuous control monitoring that feeds exceptions, ageing and retest results into the audit file as they happen.
It links each asset to its vulnerabilities, risk rating, the controls that should protect it, any exceptions, the remediation SLA, the fix and the retest, and keeps that chain current. Instead of a spreadsheet snapshot, risk and audit teams see which exceptions are open, who owns them, how long they have been open and whether the retest passed. Human reviewers still decide on risk acceptance and priorities.
Start with your most critical business services. Map their assets and third-party dependencies, agree rating and SLA rules by severity and exposure, and track every exception to a retest result. Measure ageing against SLA weekly rather than quarterly. Then extend to more services and to key suppliers, whose weaknesses can become yours. Keep a named owner for each exception and a log of every decision.