FCA firm review: the vulnerability-discovery wave can outrun repair capacity

UK Financial Conduct Authority, “Frontier AI and cyber resilience,” 2 September 2026. Primary qualitative regulator account of what financial firms told it in a multi-firm review; no sample size, case-level incidents, audited comparative finding rate, patch count, cost series or time-to-deploy. It explicitly introduces no new rules or regulatory expectations.

Firms testing frontier models described rapid vulnerability discovery, including chains of individually low-rated flaws, and warned that triage, specialist validation, patch testing, emergency change control and closure evidence may not keep pace. Findings also depend on asset and service context, tools and safeguards—the surrounding harness—not model quality alone. Many plausible outputs are dismissed on review, but the credible remainder can burden engineering and release owners. The review urges prioritizing exploitability, chainability, existing controls and business-service impact rather than raw vulnerability severity alone. Related dependencies can make a patch wave a service-risk issue in its own right; the review does not claim such an outage has already occurred.

Contrast the UK government’s pilot follow-up: official token cost and all-critical remediation demonstrate useful access and authority but leave the workload of closing the rest invisible. FCA firms are a distinct population; their reported bottleneck cannot supply the government pilots’ missing cost or case-level fixes. Compare also correlated service dependence and paired attack–repair study. Missing test: disposition and deployed-version timestamps per validated flaw, staffing and rollback/disruption, and subsequent attacks on the corrected code under matched human/scanner-only controls.