AI-Driven Cyber Risk, Identity Attacks, Cloud Concentration & Operational Resilience

In this week’s Technology Risk Weekly Briefing, David Horn explores the rapidly evolving technology risk landscape, including IMF warnings about AI-enabled cyber attacks, the continued surge in identity-based breaches, growing concentration risks in cloud and AI infrastructure, and lessons organisations must learn about operational resilience and third-party dependency management.

The episode covers:

• AI-enabled cyber threats and systemic financial stability concerns
• The rise in password and identity attacks
• Cloud and infrastructure concentration risk
• Third-party ecosystem vulnerabilities
• Practical resilience and control measures organisations should implement now

Sponsored by CauTix — helping organisations strengthen secure and reliable digital operations.

Transcript

SPEAKER_00 0:03

Hello, and welcome to this second episode of the Technology Risk Weekly Briefing. I'm David Horn, and each week we break down the most important developments shaping technology risk, cyber resiliency, cloud governance, operational control, artificial intelligence, and third-party oversight. This podcast is proudly sponsored by Cortix, a specialist's advisory firm focused on technology risk and control, helping organizations design, assess and strengthen the frameworks that underpin secure and reliable digital operations. Today's episode covers some significant developments across AI-enabled cyber threats, identity attacks, cloud concentration risk, operational resilience, and the growing systemic implications of emerging technologies. We'll discuss what happened, why it matters from a technology risk perspective, and most importantly, what practical actions organisations should be taking right now. We begin with one of the most important strategic technology risk stories of the week. The International Monetary Fund has warned that advances in artificial intelligence are materially increasing systemic cyber risk across global financial systems. The IMF specifically highlighted concerns around AI models capable of rapidly identifying software vulnerabilities and accelerating exploit development at scale. The concern is not simply that attacks become more sophisticated, the real concern is speed, accessibility and scale. A similar theme to what we discussed last week. Historically, identifying exploitable vulnerabilities required highly specialized expertise. AI is changing that equation dramatically. What once took skilled researchers weeks or months may soon take hours, and critically, these capabilities become accessible to far less sophisticated threat actors. From a technology risk perspective, this creates several major challenges. First, vulnerability management windows are shrinking rapidly. Second, traditional reactive security models become less effective when exploitation cycles accelerate. Thirdly, systemic concentration risk becomes more dangerous. If many organizations rely on the same cloud platforms, operating systems or AI infrastructure providers, a single vulnerability can cascade rapidly across sectors. This is especially relevant for financial services, healthcare, utilities and critical infrastructure providers. The IMF also warned that emerging economies and less mature organizations may struggle to keep pace with the sophistication of AI-enabled attacks. So what should organizations be doing? There are several immediate actions technology and risk leaders should consider. First, strengthen vulnerability management governance. Patch management can no longer operate on traditional timelines. Critical exposure management needs near real-time prioritization capability. Second, invest heavily in identity security and privileged access controls. As AI accelerates exploit development, identity becomes the final defensive layer. Thirdly, review cloud and technology concentration risk. Board should understand where excessive dependency exists across infrastructure, platforms, vendors and AI tooling. And fourth, scenario test operational resiliency plans against simultaneous cyber and third-party disruption events. Because the next generation of cyber instance may not remain isolated events. They may become ecosystem-wide disruptions. Our second story focuses on identity risk, an area that continues to dominate the threat landscape. Security reporting this week highlighted Microsoft findings showing a significant increase in identity-based attacks, with password attacks still representing the overwhelming majority of malicious login attempts. This is important because many organizations still think of cybersecurity primarily in terms of malware or ransomware. But increasingly, attackers simply log in. They exploit weak passwords, compromise credentials, session tokens, poorly governed privileged accounts, and inadequate authentication controls. Identity has effectively become the new perimeter. And in cloud-first environments, traditional network boundaries matter far less than identity governance. What makes this especially concerning is the interaction between AI and identity attacks. AI can now assist attackers in generating highly targeted phishing campaigns, social engineering attempts, credential harvesting operations, and even deepfake-enabled impersonation. There are several practical actions organizations should prioritize. First, move aggressively towards phishing resistant multi-factor authentication. Second, reduce standing privileged access wherever possible. Third, implement stronger identity monitoring and anomaly detection. Fourth, regularly review third party and contractor access rights. And finally, ensure identity governance is regularly discussed at executive and board level. Because identity compromise increasingly acts as the gateway to broader operational disruption. Another major theme emerging this week is concentration risk across cloud and AI infrastructure ecosystems. As organizations race to adopt generative AI capabilities, dependencies on a relatively small number of cloud providers, AI platforms, semiconductor manufacturers and infrastructure vendors continues to intensify. This creates several interconnected technology risk concerns. Operational, resilience risk, vendor dependency risk, geopolitical exposure, supply chain fragility, and potentially systemic market concentration risk. Many organizations still underestimate how deeply embedded hyperscale cloud providers now are within critical operations. A disruption affecting one major provider can rapidly cascade through customers, suppliers, outsourced services and downstream business processes. Boards and executives should therefore be asking several key questions. Do we understand our critical technology dependencies? Have we mapped concentration risk across our third-party ecosystem? Could we continue operating if a critical cloud provider experienced prolonged disruption? And importantly, are our resilience assumptions realistic? Too many resilience exercises assume isolated incidents rather than correlated ecosystem failures. The practical steps organizations should therefore take include areas such as mapping critical service dependencies end-to-end, strengthening exit and portability planning, reviewing resilience testing assumptions, expanding third-party oversight beyond direct vendors, and assessing geopolitical and regional infrastructure exposure. Resilience is no longer simply about backup systems, it is increasingly about dependency awareness. Our next topic builds directly on the previous discussion. Third-party outsourcing risk continues to evolve from a procurement issue into a board-level operational resilience challenge. Modern organizations operate through deeply inconnected ecosystems involving SaaS providers, cloud vendors, managed service providers, offshore development teams, AI vendors, and specialist technology suppliers. This interconnectedness creates efficiency, but it also creates amplification risk. A weakness in one provider can rapidly affect hundreds or thousands of customers simultaneously, and as organizations adopt AI-powered tooling from emerging vendors, governance often struggles to keep pace with innovation. Technology risk teams should therefore strengthen several areas. Firstly, vendor due diligence must extend beyond security questionnaires. Secondly, organizations should assess operational dependency and substitutability. Thirdly, contracts should include clearer resilience, incident notification and recovery expectations. Fourth, organisations should maintain updated inventories of critical third-party technology services. And finally, boards should receive clearer reporting on ecosystem concentration and dependency exposure. Because resilience today depends not only on internal controls, but on the resilience of the wider technology ecosystem. As we close this week's briefing, several themes stand out clearly. Artificial intelligence is accelerating both opportunity and risk. Identity continues to dominate the attack landscape. Cloud concentration risk is increasing. And operational resilience now depends heavily on ecosystem-wide governance and dependency awareness. Technology risk management is no longer purely a technical discipline. The organisations that succeed will be those that combine innovation with disciplined governance, strong controls, resilience testing and executive accountability. Thank you for joining me for this week's Technology Risk Weekly Briefing. I'm David Horn, and this podcast is proudly sponsored by Cortix. Help an organization strengthen the controls and frameworks that underpin secure and reliable digital operations. Stay safe, stay resilient, and stay ahead of Technology Risk.