When the treat becomes the trick: Where financial companies use AI and where they draw the line

Every trick-or-treater follows the same route: knock on a door, take the candy, check the wrapper before eating. The financial sector is walking a similar route with AI. While it opens the door to AI more readily than the market average and defends itself better than most, yet still encounters weak spots. These insights are based on recent global studies conducted by Kaspersky’s Internal Research Center.

AI promises financial institutions faster analysis, smarter decisions and more efficient operations. But as banks and insurers embrace the technology, a new challenge is emerging: how to capture its benefits without becoming exposed to unfamiliar risks that they’re not yet equipped to manage.

The first door: finance embraces AI where the benefits are clear and the risks are manageable

A new global survey by Kaspersky found that banking, financial services and insurance (BFSI) organizations are more likely than the market average to use AI for data analysis (59% vs. 54%) and project management (54% vs 49%). In these areas AI supports decision-making rather than executing transactions, so a weak output wastes time rather than money.

The door is opening wider. Kaspersky’s study showed that BFSI organizations are more likely to plan to expand their use of AI: 19% for external AI tools and 8% for internal ones, compared with 15% and 7% across the market. The margins are small, but they point in one direction: finance sees AI as a lasting part of operations.

Same monsters, better costumes: AI makes familiar cyberthreats harder to spot

Phishing and ransomware remain among the main cyberthreats facing the financial sector. AI is making them harder to detect by enabling attackers to create convincing messages, imitate voices and produce fraudulent documents more quickly and at a lower cost.

It is also allowing them to tailor attacks with greater precision: Kaspersky’s Security Bulletin notes that AI is being used to model victim behavior, craft more persuasive lures and probe infrastructure at a pace and scale that manual methods cannot match, contributing to a rise in targeted fraud, social engineering and market manipulation attempts.

For financial institutions, this raises the stakes: distinguishing legitimate communications from sophisticated attempts at fraud is becoming increasingly difficult. In practice, that means the attacks that already top the list can succeed more often. Technical defenses help, but a believable fake still has to be recognized by a person, which leads to the next problem.

The monster within: how everyday AI habits expose financial data

Sometimes, the biggest AI risk does not come from an external attacker, but from shadow AI: employees using third-party AI tools, such as ChatGPT or DeepSeek, without their organization’s approval. Kaspersky’s research found that 37% of BFSI respondents see this as a typical risky behavior in their companies, compared with 30% across the market. For financial institutions handling sensitive client information and financial records, exposing data to unapproved tools can have particularly serious consequences.

Traditional security controls cannot always prevent this kind of exposure. When an employee pastes confidential information into a public AI chatbot, the data may leave the organization’s controlled environment without triggering a conventional security alert. The concern is reflected in the findings: 85% of BFSI respondents recognize risks associated with AI, while 9% believe these risks cannot be eliminated at all.

The figures point to a gap between recognizing the danger and managing it in practice. Awareness matters, but it cannot replace clear rules on AI use, access to approved tools and sufficient visibility into how employees use these technologies. For financial organizations, keeping the monster out means making secure AI use easier to follow than risky shortcuts.

One door stays shut: why finance is more cautious about AI-generated code

At the same time, only 23% of BFSI organizations use AI for programming, compared with 34% across the market, an 11-percentage-point gap in one of the most prominent areas of AI adoption. One possible explanation is the cost of getting it wrong. An inaccurate analysis can be revisited and corrected but a flaw in code used by a critical financial system can persist, spread across applications and potentially affect essential services.

The figures do not establish why financial organizations use AI for programming less often. However, they highlight a sector in which the consequences of errors can be particularly significant. AI may be welcomed as an assistant for analysis, planning and decision-making, but its use in developing critical systems calls for more stringent safeguards.

“Financial companies are drawing a deliberate line: AI is welcome where it speeds up analysis and planning, but kept away from the code that runs critical systems. Where LLM use is approved, policies governing how it is used, with what privileges and with what degree of isolation should be in place and enforced to prevent the spread of shadow AI – uncontrolled and unmonitored use of unauthorized AI tools. Unapproved tools need to be brought under security review or replaced with approved alternatives, while agents need clear rules, limited permissions and human oversight,” said Vladislav Tushkanov, Group Manager at Kaspersky AI Technology Research Center.

Keep the monsters outside: govern AI and strengthen cyber defenses

As financial organizations expand their use of AI, they need to manage not only the threats posed by external attackers but also the risks created by how the technology is used internally. That starts with governance. Companies need clear policies defining which AI tools employees can use, what data they can share with them and what level of access AI systems and agents should have. Approved services, access controls and monitoring help security teams maintain visibility, while practical awareness training helps employees recognize risky behavior and avoid exposing sensitive information. These safeguards should reflect how AI is deployed, whether through cloud services, locally run open-source models or in-house developments.

But keeping AI under control is only half the job. Traditional cybersecurity defenses remain essential, especially as attackers use AI to make phishing more convincing, automate reconnaissance and adapt their techniques more quickly. Financial organizations therefore need to maintain effective protection against external attacks while considering how AI capabilities can strengthen their security operations. AI-enabled security tools can help identify suspicious activity, correlate signals across multiple systems, prioritize alerts and accelerate incident investigations. For example, they can help analysts interpret obfuscated command lines or piece together an attack chain, reducing the time needed to understand what has happened and where to respond.

AI does not replace the need for a strong security foundation or skilled analysts. Its value lies in helping security teams work more efficiently and respond to increasingly sophisticated threats, while human oversight remains essential for consequential decisions. For financial institutions, the priority is to combine established defenses with AI-enhanced capabilities and clear rules for the safe use of AI across the organization.

Trick or treat? Make security part of the AI strategy

Taken together, the findings reveal a sector moving ahead with AI while maintaining a strong focus on cybersecurity. Financial organizations are planning to expand AI adoption and continue investing in established defenses, yet the risks associated with employee behavior and AI systems themselves require additional controls. The challenge is not simply to strengthen the existing security stack but to adapt it to the ways AI is being used.

This means treating AI governance and cybersecurity as two sides of the same strategy: enabling innovation while keeping data, systems and critical decisions protected. Those that strike this balance will be better positioned to capture AI's benefits without letting new capabilities become an unexpected liability.

In the AI era, the organizations best positioned to benefit will be those that advance innovation and security together. Discover our comprehensive, industry-specific protection for complex environments here.

About Kaspersky

Kaspersky is a global cybersecurity and digital privacy company founded in 1997. Innovating the industry with a Cyber Immunity approach, Kaspersky safeguards consumers, businesses, critical infrastructure and governments from cyberthreats, with over a billion devices protected to date.

Kaspersky ensures Cybersecurity True to Business, focusing on providing clear outcomes, protecting revenue, easing workloads and preventing downtime. Kaspersky’s deep threat intelligence and security expertise is constantly transforming into innovative solutions and services for organizations of every size, from small businesses to large enterprises, combining proven AI-driven protection technologies with simple management and expert support.

Recognized in independent tests and trusted by millions of individuals worldwide and nearly 200,000 organizations, Kaspersky helps detect threats earlier, respond faster and operate with greater confidence and freedom, protecting what matters most to our clients. Learn more at www.kaspersky.com