Cybersecurity & AI Governance insights for Financial Services by Gerard Louishttps://gerardlouis.org/https://gerardlouis.org/blog/frontier-ai-dora-and-the-case-for-faster-security-validation/https://gerardlouis.org/blog/frontier-ai-dora-and-the-case-for-faster-security-validation/Recent statements from the ESAs, the FSB, and OpenAI point to the same concern: cyber risk may develop faster than traditional security and resilience processes can absorb. Here is what that means for DORA-regulated financial entities.Sat, 05 Sep 2026 00:00:00 GMTRegulationsDORAFrontier AICybersecurityOperational ResilienceESAFSBFinancial ServicesAI Governancehttps://gerardlouis.org/blog/building-a-gen-ai-security-framework-part-1-the-foundation/https://gerardlouis.org/blog/building-a-gen-ai-security-framework-part-1-the-foundation/Part 1 of 4: How to use NIST AI RMF, NIST AI 600-1, SP 800-30, OWASP, and MITRE ATLAS together to build a practical, regulator-ready risk framework for generative AI.Sun, 30 Aug 2026 00:00:00 GMTFrameworksNIST AI RMFNIST AI 600-1SP 800-30OWASPMITRE ATLASAI GovernanceGen AIRisk Managementhttps://gerardlouis.org/blog/building-a-gen-ai-security-framework-part-2-scaling-the-assessment/https://gerardlouis.org/blog/building-a-gen-ai-security-framework-part-2-scaling-the-assessment/Part 2 of 4: How to scale a NIST-aligned gen AI risk assessment across dozens of use cases without rebuilding the process every time.Sun, 30 Aug 2026 00:00:00 GMTFrameworksNIST AI RMFNIST AI 600-1SP 800-30OWASPMITRE ATLASAI GovernanceGen AIRisk Managementhttps://gerardlouis.org/blog/building-a-gen-ai-security-framework-part-3-from-risk-to-controls/https://gerardlouis.org/blog/building-a-gen-ai-security-framework-part-3-from-risk-to-controls/Part 3 of 4: How to map rated gen AI risks to specific controls across NIST SP 800-53, CSF 2.0, and ISO 27001, and define the evidence that proves those controls are actually working.Sun, 30 Aug 2026 00:00:00 GMTFrameworksNIST AI RMFNIST AI 600-1SP 800-53CSF 2.0ISO 27001OWASPMITRE ATLASAI GovernanceGen AIRisk Managementhttps://gerardlouis.org/blog/building-a-gen-ai-security-framework-part-4-a-complete-worked-example/https://gerardlouis.org/blog/building-a-gen-ai-security-framework-part-4-a-complete-worked-example/Part 4 of 4: A retrieval-based financial services chatbot carried through the full framework — pattern classification, threat model, SP 800-30 ratings three ways, control mapping, and a completed evidence record.Sun, 30 Aug 2026 00:00:00 GMTFrameworksNIST AI RMFNIST AI 600-1SP 800-30SP 800-53CSF 2.0OWASPMITRE ATLASAI GovernanceGen AIRisk ManagementFinancial Serviceshttps://gerardlouis.org/blog/when-frontier-models-reach-beyond-intended-boundaries-financial-services-ai-agents/https://gerardlouis.org/blog/when-frontier-models-reach-beyond-intended-boundaries-financial-services-ai-agents/Recent OpenAI, Anthropic, and UK AI Security Institute disclosures show how capable models can act beyond an evaluation's intended scope when network access, task design, identity controls, and monitoring fail.Sun, 23 Aug 2026 00:00:00 GMTIndustry AnalysisFrontier AIAgentic AICybersecurityAI GovernanceFinancial ServicesNon-Human IdentityThird-Party Riskhttps://gerardlouis.org/blog/responsible-ai-in-financial-services-from-principles-to-operational-governance/https://gerardlouis.org/blog/responsible-ai-in-financial-services-from-principles-to-operational-governance/How financial institutions must evolve Responsible AI from ethical principles into an operational discipline of controls, risk tiering, and continuous governance, particularly as agentic systems introduce risks that existing frameworks were not designed to manage.Sun, 14 Jun 2026 00:00:00 GMTFrameworksResponsible AIAI GovernanceFS AI RMFNIST AI RMFISO 42001EU AI ActAgentic AIFinancial Serviceshttps://gerardlouis.org/blog/claude-fable-5-vs-mythos-why-frontier-ai-is-too-powerful-to-fully-release/https://gerardlouis.org/blog/claude-fable-5-vs-mythos-why-frontier-ai-is-too-powerful-to-fully-release/What Anthropic's decision to gate Mythos-class capabilities behind safety guardrails means for AI governance, cybersecurity threat models, and agentic AI deployment in financial services.Fri, 12 Jun 2026 00:00:00 GMTIndustry AnalysisFrontier AIMythosFS AI RMFCybersecurityFinancial ServicesAI SafetyAISIAgentic AIhttps://gerardlouis.org/blog/preparing-the-enterprise-for-ai-enabled-vulnerability-discovery/https://gerardlouis.org/blog/preparing-the-enterprise-for-ai-enabled-vulnerability-discovery/FS-ISAC's Sector Risk Advisory outlines nine priority actions for financial institutions facing a fundamental shift in cybersecurity risk driven by AI-enabled vulnerability discovery, chaining, and exploitation.Sat, 06 Jun 2026 00:00:00 GMTIndustry AnalysisFS-ISACVulnerability ManagementCybersecurityAIFinancial ServicesFS AI RMFExploit Preventionhttps://gerardlouis.org/blog/the-control-gap-why-ai-governance-must-pivot-from-policy-to-operations-in-2026/https://gerardlouis.org/blog/the-control-gap-why-ai-governance-must-pivot-from-policy-to-operations-in-2026/The Stanford AI Index 2026 reveals a widening gap between AI capability and governance readiness. For financial institutions, closing this Control Gap before the EU AI Act and OSFI E-23 deadlines is no longer optional.Sun, 03 May 2026 00:00:00 GMTIndustry AnalysisStanford AI IndexAI GovernanceFS AI RMFEU AI ActOSFIFinancial ServicesAgentic AINIST AI RMFhttps://gerardlouis.org/blog/the-rise-of-agentic-ai-in-financial-services/https://gerardlouis.org/blog/the-rise-of-agentic-ai-in-financial-services/Beyond the Chatbot: Navigating the risks of autonomous AI agents in banking — from prompt injection 2.0 to memory poisoning, with mitigation controls mapped to NIST AI RMF and FS AI RMF 230.Sat, 02 May 2026 00:00:00 GMTIndustry AnalysisAgentic AIFS AI RMFNIST AI RMFPrompt InjectionFinancial ServicesSECOSFIAutonomous AIhttps://gerardlouis.org/blog/agentic-ai-all-green-fraud-problem/https://gerardlouis.org/blog/agentic-ai-all-green-fraud-problem/Why financial crime is shifting from bad events to clean sequences — and how agentic AI is enabling multi-step, coordinated deception that passes every control.Sun, 26 Apr 2026 00:00:00 GMTIndustry AnalysisAgentic AIFraudFinancial ServicesNISTOWASPMITRE ATLASSynthetic IdentityRisk Managementhttps://gerardlouis.org/blog/from-ai-risk-principles-to-production-reality/https://gerardlouis.org/blog/from-ai-risk-principles-to-production-reality/How to operationalize NIST AI RMF, FS AI RMF, threat models, and MAESTRO across GenAI and agentic AI systems.Sat, 25 Apr 2026 00:00:00 GMTFrameworksNISTAI RMFFS AI RMFMITRE ATLASOWASPCSA MAESTROAgentic AIGenAIRisk ManagementFinancial Serviceshttps://gerardlouis.org/blog/fs-ai-rmf-230-control-objectives-mapping-to-nist-ai-rmf-and-implementation-guide/https://gerardlouis.org/blog/fs-ai-rmf-230-control-objectives-mapping-to-nist-ai-rmf-and-implementation-guide/A deep dive into the Treasury's Financial Services AI Risk Management Framework, its 230 control objectives, how they map to the NIST AI RMF, and a practical implementation guide for financial institutions.Mon, 13 Apr 2026 00:00:00 GMTFrameworksFS AI RMFNIST AI RMFControl ObjectivesRisk AssessmentFinancial ServicesAI Governancehttps://gerardlouis.org/blog/the-mythos-ai-crisis-and-banking-resilience/https://gerardlouis.org/blog/the-mythos-ai-crisis-and-banking-resilience/How Anthropic's Mythos model triggered an emergency government response, what it means for financial services cybersecurity, and how the FS AI RMF provides a path to resilience.Sun, 12 Apr 2026 00:00:00 GMTIndustry AnalysisMythosAnthropicFS AI RMFCybersecurityBankingNIST AI RMFZero-Dayhttps://gerardlouis.org/blog/ny-dfs-23-nycrr-500-what-you-need-to-know/https://gerardlouis.org/blog/ny-dfs-23-nycrr-500-what-you-need-to-know/A comprehensive breakdown of New York's landmark cybersecurity regulation for financial services — covering key requirements, the 2023 amendments, and practical steps for compliance.Sun, 05 Apr 2026 00:00:00 GMTRegulationsNY DFS23 NYCRR 500ComplianceFinancial ServicesCybersecurityhttps://gerardlouis.org/blog/convergence-cyber-ai-governance/https://gerardlouis.org/blog/convergence-cyber-ai-governance/Why financial institutions can no longer treat cybersecurity and AI governance as separate disciplines, and how to build an integrated governance model.Wed, 05 Mar 2025 00:00:00 GMTIndustry AnalysisGovernanceAICybersecurityStrategyhttps://gerardlouis.org/blog/eu-ai-act-financial-institutions/https://gerardlouis.org/blog/eu-ai-act-financial-institutions/A breakdown of the EU AI Act's risk-based classification system and its direct implications for banks, insurers, and investment firms operating in or serving EU markets.Mon, 10 Feb 2025 00:00:00 GMTRegulationsEU AI ActComplianceFinancial ServicesEuropehttps://gerardlouis.org/blog/nist-ai-rmf-practical-guide/https://gerardlouis.org/blog/nist-ai-rmf-practical-guide/Breaking down the NIST AI Risk Management Framework and how financial institutions can operationalize its core functions: Govern, Map, Measure, and Manage.Wed, 15 Jan 2025 00:00:00 GMTFrameworksNISTAI RMFRisk ManagementFinancial Services