For banks weighing AI security investments, the real question is what stops them from fixing their most consequential weaknesses. In a hypothetical bank where engineers already hold a queue of verified fixes awaiting testing, extra testing capacity could get those fixes deployed sooner. A new discovery tool, by contrast, would need to prove enough added value to justify the extra work it creates. Where significant weaknesses remain unseen, better discovery may still come first.

The ECB's July 2026 letter to significant banks under its supervision asks management to assess whether budgets and staffing, including capacity to implement technology changes, can support faster patching. AI can also aid repair: CERT-EU describes a defensive system that generates proposed patches for confirmed findings. Such tools may help engineers, but their financial value still hinges on the cost of reviewing and safely deploying fixes.

A stronger investment case ties the full cost of a security capability to evidence that material exposures are addressed sooner. Useful measures include time to address material exposures, tracking how long exploitable weaknesses stay unresolved alongside temporary controls; full delivery cost, including engineering and testing alongside tool fees; and rework and disruption, tracking fixes that fail or need further changes.

Comparisons should use consistent scope and risk classification, since closing many minor findings can improve headline numbers while serious exposures persist. For the next budget review, each proposal should identify the delay it would reduce and how the bank would verify the improvement. A proposal for more discovery capacity should explain how additional findings will be addressed within shrinking time.

Source: Intuition