What do banks get wrong about AI in banking programmes?

Why This Matters for Security Teams

Banks often underestimate how quickly AI changes the control problem from information handling to authority management. A banking programme can look compliant on paper while an AI system quietly gains the ability to query customer data, draft payment instructions, or shape credit decisions. That matters because the risk is not just bad output, but unauthorised action at machine speed. Current guidance suggests treating AI as a governed workload, not a decorative feature.

That is where many programmes drift from security reality. The bank may have model approvals, privacy reviews, and vendor checks, yet still fail to define what the system can do, when it can do it, and under whose authority. The NIST Cybersecurity Framework 2.0 is useful here because it forces organisations to connect governance, asset visibility, and access control, but it does not solve the banking-specific question of AI execution scope by itself. NHIMG’s analysis of the DeepSeek breach shows how exposed data and over-broad system reach can become an operational liability once AI is connected to real workflows.

In practice, many security teams encounter AI privilege abuse only after a workflow has already connected sensitive data to an automated decision path, rather than through intentional design.

How It Works in Practice

The practical failure is usually architectural, not philosophical. Banks frequently place AI behind a business request without translating that request into explicit runtime policy. If an agent can read a customer record, call a tool, and trigger a downstream action, then each step needs separate authorization, logging, and revocation logic. The model itself does not need standing trust; the workload needs identity, scope, and time-bound authority.

For autonomous or semi-autonomous banking use cases, best practice is evolving toward workload identity, just-in-time credential issuance, and policy evaluation at request time. That means the AI service proves what it is with cryptographic identity, such as OIDC-based workload tokens or SPIFFE/SPIRE-style identities, then receives only the minimum secret or token needed for one task. When the task ends, the credential should expire automatically. This is materially different from giving an AI platform a long-lived service account that can keep calling systems indefinitely.

Operationally, security teams should expect controls such as:

• Per-action authorization for read, write, approve, and recommend steps.
• Ephemeral access tokens with short TTLs and automatic revocation.
• Policy-as-code checks at runtime, using context such as customer segment, transaction amount, and data sensitivity.
• Separate controls for model output, tool use, and downstream execution.

The NIST Cybersecurity Framework 2.0 helps structure governance and response, while NHIMG’s DeepSeek breach research is a reminder that exposed secrets and loose system boundaries turn AI into an access multiplier, not just a productivity layer. These controls tend to break down when legacy banking platforms require persistent service credentials because the AI cannot safely inherit broad standing access without creating hidden privilege paths.

Common Variations and Edge Cases

Tighter AI controls often increase integration overhead, requiring banks to balance release speed against authorization precision. That tradeoff becomes visible in environments where teams want an AI assistant for analysts, a decision-support layer for underwriting, and an agent that can initiate back-office tasks all at once. The governance answer is not the same for each use case, and current guidance suggests separating advisory systems from systems that can influence or execute.

There is no universal standard for this yet, but the direction is clear: banks should treat high-impact AI as a controlled workload with bounded authority, not as a general-purpose enterprise assistant. The hardest edge cases appear when AI is embedded in existing workflows that already mix human and machine approvals, especially in fraud operations, lending, and treasury. In those settings, a model may only “recommend” an action on paper while still shaping the human approver’s decision path, which creates a soft-control problem that audit trails often miss.

For that reason, banking programmes should classify AI by action type, data sensitivity, and potential customer impact, then assign different guardrails to each category. In lower-risk use cases, review and monitoring may be enough. In higher-risk cases, the bank should require explicit JIT authority, human confirmation, and immediate revocation after each transaction or case. NHIMG’s research on the DeepSeek breach reinforces the point that once AI is allowed to touch exposed data or secrets, the blast radius can expand far beyond the original use case.

Related resources from NHI Mgmt Group

• What do teams get wrong about machine identity in AI programmes?
• What do teams get wrong about machine identity security in AI programmes?
• What do banks get wrong about personalization in ecosystem banking?
• What do security teams get wrong about AI in mobility programmes?