Webinar Recap: Exposing Vulnerabilities – AI and Cloud Risks in Financial Services

Missed the Webinar? Watch it On-Demand.

The increasing prevalence of AI and cloud technologies in financial services has introduced many vulnerabilities and risks. Abacus Group hosted a webinar titled Exposing Vulnerabilities: AI and Cloud Risks in Financial Services to shed light on these challenges. The expert panel featured Jonathan Bohrer, President at Abacus Group; Travis DeForge, Director of Cybersecurity Engineering at Abacus Group; Brad Carpenter, Managing Director of Cybersecurity at FTI Consulting; and Russell Okoth, Principal Consultant & Fractional CISO at Cyberdilligent. 

Here, we summarize the key takeaways and insights from this engaging and thought-provoking discussion. 

Understanding the Threat Landscape

The session kicked off with a compelling personal anecdote illustrating the increasing sophistication of social engineering attacks. Hackers had used eerily accurate social engineering tactics to impersonate a senior figure in his community, showcasing how even the most personal details can be weaponized. The incident emphasized the importance of constant vigilance in combating cybersecurity threats.

AI-Powered Attacks: A New Frontier for Cybersecurity

Deepfake and Voice Cloning Risks: We showcased how advanced generative AI models are being used to create convincing voice and video deepfakes in real-time by cloning the voice of a real celebrity, asking to complete a wire transfer. Such tools are enabling hackers to execute realistic social engineering attacks, leveraging urgency and confusion to deceive victims. 

Key Insights:

• It’s crucial for employees to recognize urgency-based manipulation tactics. Hackers often employ high-pressure scenarios to compel immediate action without verification. 
• Firms must adopt robust processes, including multi-factor authentication and strict verification protocols for transactions. 

Cloud Vulnerabilities: Challenges and Mitigation

The panel explored common cloud vulnerabilities and offered practical advice for organizations of all sizes: 

Common Pitfalls:

• Misconfigured storage systems (e.g., exposed S3 buckets) and permissions
• Inadequate data governance and monitoring. 
• The complexity of shared responsibility models with cloud providers. 

Best Practices:

• Implementing principle of least privilege, MFA, data encryption, and continuous monitoring to mitigate cloud risks.
• Thorough data lifecycle management, including retention policies and secure destruction of outdated data. 
• Cloud assessments should be revisited regularly to account for evolving business needs and configurations. 

In-House Large Language Models (LLMs): Cybersecurity Considerations 

As organizations increasingly develop in-house large language models, unique vulnerabilities have emerged. Firms should not treat these like traditional web applications. Instead, specialized LLM penetration testing is needed to address: 

• Prompt Injection Attacks: Manipulating LLMs to bypass restrictions or provide unauthorized information.
• Model Theft: Protecting proprietary models and training data from unauthorized access. 
• Capability Constraints: Ensuring LLMs are limited to their intended functionalities to avoid exploitation. 

 Practical Advice:

• Adopt strong acceptable use policies for LLMs.
• Regularly monitor and test LLM environments to identify emerging risks. 

Data Loss Prevention (DLP): Managing Data Risks and Regulatory Requirements 

The webinar concluded with a discussion on the critical role of DLP tools in securing sensitive data. As highlighted by all panelists: 

• DLP tools enable organizations to classify and monitor data, preventing accidental or malicious exfiltration. 
• With regulators like the SEC and NYDFS emphasizing DLP in their 2025 priorities, organizations must adopt robust DLP policies as part of a layered security approach. 

Final Thoughts and Recommendations 

This expert panel emphasized the importance of proactive measures, from employee education to advanced technical defenses. As AI and cloud technologies evolve, organizations must adapt their strategies to address emerging risks effectively.  

In summary, this webinar provided valuable insights into the evolving cybersecurity landscape, particularly the risks posed by AI and cloud technologies in financial services. The discussion underscored the importance of robust defenses, employee education, and proactive strategies to mitigate risks effectively. With a strong focus on practical advice and real-world examples, the session reinforced Abacus Group’s commitment to helping organizations navigate and secure their digital environments in an era of rapid technological change.