The Cambridge Digital Innovation and Regulation Initiative (C:\>DIR), an initiative of Financial Innovation for Impact (Fii), has worked with the Dubai Financial Services Authority (DFSA) to examine how AI could reshape cyber resilience in financial services.
The paper, released on 2 November 2026 for discussion at the Dubai FinTech Summit, looks at how frontier and agentic artificial intelligence (AI) could change the conditions under which financial institutions achieve cyber resilience.
Frontier and agentic AI: cyber resilience in the financial sector looks at how frontier AI may speed up some cyber activities. It also reviews how agentic systems pair AI capability with the ability to use connected tools and act under delegated authority. When AI-enabled activity becomes faster, more adaptive and harder to trace, established approaches to cybersecurity, operational resilience and third-party risk come under pressure. This includes the ability to work out what happened after an incident.
The paper puts the deployed system, rather than the underlying model, at the centre of its analysis. It assesses AI-related cyber resilience across four connected dimensions:
Speed: whether institutions can safely reduce significant cyber exposure before it has serious consequences.
Reach: whether institutions understand the shared technology and services they depend on, including those beyond their direct suppliers.
Authority: whether consequential actions by AI-enabled systems stay within their intended mandates.
Trust: whether institutions can establish what happened, bring unfinished activity under control, and continue or restore critical operations reliably.
The paper also considers how reliance on shared models, cloud infrastructure, identity services, software components and recovery arrangements can create operational dependencies. These dependencies are not always visible through direct supplier relationships.
“For the Dubai Financial Services Authority (DFSA), the practical question is how these capabilities interact with access, authority, critical financial operations, and increasingly complex technology and service provider networks. This paper brings together emerging thinking and will prompt wider discussion on how regulators and firms can prepare for these developments.”
- Mark Steward, Chief Executive of the DFSA
“Cybersecurity is where the promise and the hazard of AI meet most directly. This paper puts the deployed system, not the model, at the centre of the analysis – what it can access, the authority it holds and the critical operations it can affect – and tests resilience on speed, reach, authority and trust. These questions will not be settled by any single firm, regulator or jurisdiction, and we hope the paper offers a common vocabulary for public sectors and private sectors working on them together.”
Bryan Zhang, Co-Creator of C:\>DIR and Executive Chair of Fii
The paper was announced at the Dubai FinTech Summit during a fireside chat between Mark Steward, Chief Executive of the DFSA, and Bryan Zhang, Executive Chair of Financial Innovation for Impact and C:\>DIR Co-Creator. The discussion was moderated by Assetou Traore, Senior Manager, Chief Executive’s Office of the DFSA, and considered changes when innovation becomes part of financial market infrastructure.
Please note: this paper is intended to support research and international discussion. It is not legal advice, regulatory guidance, a statement of DFSA policy, or an interpretation of applicable law. Its analytical tools and illustrative safeguards do not create or signal supervisory requirements.
