How Artificial Intelligence Can Build Advisers’ Cybersecurity Strategy

Cyberattacks are unfortunately common for company technology support teams. But each attack can teach other teams how to better protect themselves.

Earlier this month, hackers used artificial intelligence (AI) agents to target more than 2,250 organizations that used the cloud-based Microsoft 365 service through the ConnectWise platform. The attack raised questions about the role AI now plays in cyberattacks.

As financial firms continue to build and update their technology systems and security plans, industry experts say they must consider both how to use AI and how to protect themselves from it.

“When we look at AI, we see it as a very powerful tool. We want our staff using AI. It’s going to make them more efficient,” says Matthew Vandre, director of digital services and a fiduciary financial planner at Francis LLC. “However, as is the case with any powerful tool, it can do a lot of good, or it can do a lot of harm. You can hurt yourself.”

Vandre says firms must find the right balance between cybersecurity concerns and the need to keep improving their technology. He argues that the best defense starts with changing how people think about AI and cybersecurity.

“The most important security control is not a piece of software. It’s a culture where people understand that protecting data is part of their professional responsibility,” says Vandre.

Tom Quinn, chief information security officer at T. Rowe Price, says cybersecurity is often difficult to control completely.

When asked how he defines cybersecurity, Quinn says, “Cybersecurity looks like magic and you can’t manage magic.”

‘Data Is the New Oil’

As information about clients and firms becomes more valuable, Vandre says firms must recognize that “data is the new oil.”

The importance of protecting data was also highlighted in an announcement last week by the National Security Agency (NSA). The agency said a critical PHP security update had been released for public websites to help prevent cyberattacks.

That same week, the NSA, the National Institute of Standards and Technology’s Center for Advancing Innovation and Standard for Super Intelligence, and the Cybersecurity and Infrastructure Security Agency released guidance to help organizations prepare for and manage incidents involving AI controls.

The NSA’s latest security update recommendation and guidance show how outside tools and advice are evolving to help defend against more advanced cyberattacks.

Within firms, it will become increasingly important to make the cultural change Vandre describes. Experts say

firms can plan ways to defend against advanced attacks and create rules for AI and cybersecurity. But they must teach these plans to employees and make them part of everyday work.

According to Quinn, “You can’t protect technology without technology.”

Firms that are too cautious and avoid new technologies, such as agentic AI and generative AI, in an effort to stay safe may actually find it harder to protect themselves if their technology becomes outdated.

“You have to keep pace with change,” says Quinn. “Everyone has a role in cybersecurity, and in how [generative] AI and agentic [AI are] going to be deployed. For companies that don’t embrace that [and related] compliance, legal, privacy and [human resources] and tech, … those companies may struggle.”

Regular training will also become more important.

“You need to train people how to use AI safely and in a way that prioritizes protecting data,” says Vandre. “If you want to use something else, we want you to get approval first. We need to confirm that there is a contractual guarantee that there’s no ability for that technology, that LLM, that AI agent, to take our data and expose it.”

Protection from the ‘-ishings’

One common cyber threat facing registered investment advisory firms is what the Financial Industry Regulatory Authority (FINRA) calls “-ishing scams.”

A recent article published by FINRA identified three common types of online fraud: “phishing” scams sent by email, “smishing” scams sent by text or encrypted messages, and “vishing” scams carried out through phone calls or voicemail. Scammers often pretend to represent financial institutions, electronic payment services, mail delivery companies, electronic signature platforms or similar services.

AI is also making these scams more advanced. New methods include deepfake videos and cloned voices.

Vandre says his firm trains both employees and clients to recognize important security risks.

“[Staff are] getting those kinds of things sent to them just out of the blue, so we can see how they’ll react to them and where our education gaps are,” he says.

He also provides similar training to clients to help them prepare for unexpected threats.

In its article, FINRA advises firms and clients to stay alert online and be suspicious of unexpected messages. Misspelled company names and strange website addresses were identified as clear warning signs of phishing. However, scammers have also changed their methods by using new technology.

“These scams now also sometimes incorporate generative AI elements, making them difficult to distinguish from authentic communications,” FINRA stated.

Quinn also stressed the importance of improving technology tools that help identify fraud, as AI makes scams harder for people to recognize.

“There are AI tools that will look for audio and video anomalies. Those are some of the things that should be considered when you’re thinking about business process protection,” he says. “This process [of] anomaly detection, I think you will see in the future agentic lawyers, agentic compliance capabilities, agentic HR capabilities, agentic cyber capabilities [and] agentic risk capabilities that are assembled around business processes.”