The emergence of frontier AI models with advanced capabilities, such as Claude Mythos, has prompted deep concern across financial services. JPMorganChase emphasises that getting the fundamentals of cyber security right go a long way in making sure organisations are prepared as AI language models reshape the cyber threat landscape.
Anthropic’s Claude Mythos Preview has attracted global attention for its ability to identify software vulnerabilities at new speed and scale. Anthropic has said it does not plan to make Mythos Preview generally available and is instead providing controlled access through ‘Project Glasswing’, an initiative designed to help organisations find and fix vulnerabilities in critical software before they can be exploited.
The early access has been provided to a group of major technology, security and financial organisations, including ASFA member, J.P. Morgan. In a long blog post, JPMorganChase’s Global Technology Leadership team stress that getting the fundamentals of cyber security right are the most powerful steps companies can take to prepare for this new environment.
In this condensed version of its longer blog post, JPMorganChase lists the ten most valuable actions that organisations should take right now:
- Run the latest software versions: Legacy systems that run outdated software pose a significant risk, with unpatched flaws in end-of-life software being a primary attack vector. It’s often difficult to upgrade software when companies are multiple versions behind, slowing down processes to react to newly discovered vulnerabilities.
- Manage assets and software components with reference data: You cannot fix what you don’t know about. Incomplete or inaccurate asset inventories leave blind spots that attackers will find before you do.
- Build and operate a robust vulnerability management program: Discovering and remediating known vulnerabilities quickly is foundational, particularly for perimeter-facing software and hardware assets where exploitation is often automated and immediate.
- Stress test incident response and resiliency plans: Plans that have not been exercised under realistic conditions will fail under real pressure. Resilience is proven in practice, not in documentation.
- Know your major SaaS and outsourced dependencies: Critical business processes increasingly rely on third-party platforms and services, a compromise or outage at a key provider is your incident to manage, regardless of where the fault lies.
- Optimise change management for speed: The patching and deployment processes that were designed for quarterly release cycles are now a liability. Every day of delay between a fix being available and a fix being deployed is a day of unnecessary exposure.
- Aggressively filter outbound traffic from production systems: Most production systems have no legitimate need to reach the open internet, restricting outbound traffic creates strong immunity from software supply chain attacks, command-and-control callbacks, and data exfiltration.
- Remove standing privileges from employee entitlements: A compromised employee workstation should not automatically provide an attacker with credentials to production systems. Standing privileged access is one of the most reliably exploited paths from initial compromise to critical impact.
- Manage remote access and segment where possible: Flat networks and broadly shared environments allow attackers to move laterally with ease. Architecting for containment ensures that a single point of compromise does not become an enterprise-wide event.
- Embed security into the AI development and deployment lifecycle: AI is simultaneously a threat accelerant and transformative capability to help you do more work faster. However, organisations must secure their own use of AI with the same rigor (or more!) than any critical system.
Strengthening super’s cyber shield
For financial services, the message is clear: AI is changing the speed and scale of cyber risk, but is also reinforcing the need for stronger defences, faster detection and a more coordinated and comprehensive response.
The superannuation sector holds retirement savings for 19 million Australians, making strong cyber and financial crime protections essential to member trust and system resilience.
To support super funds, ASFA is bringing together the sector to join in the fight against cyber and financial crime through the Superannuation Cyber and Financial Crime Coordination (SC3) Framework. The SC3 Framework is designed to help funds prepare and respond to cyber threats, scams, fraud and financial crime, by sharing insights, improving preparedness and supporting a consistent sector wide response when risk emerge.
The Framework includes the development of a sector-wide threat intelligence capability (subject to authorisation), coordinated incident response planning, exercises and specialist forums to ensure lessons are shared and translated into action.
As frontier AI accelerates both the risk and tools available to bad actors, collaboration across the industry has never been more important.
For more information on the SC3 Framework and how your fund can get more involved, please contact m_collins@superannuation.asn.au.
Read the full blog post on JPMorganChase’s website: ‘Fortifying the enterprise: 10 actions to take now for AI-ready cyber resilience’.
