The Bank of England is working with banks on ways to restore critical financial services after severe cyberattacks, as advances in artificial intelligence raise concerns that existing security measures may no longer be enough to prevent major disruptions.
Sarah Breeden, the central bank's deputy governor for financial stability, said financial institutions need to prepare for attacks that penetrate their defenses rather than relying solely on measures designed to keep intruders out. Speaking at the Institute of International Finance annual meeting in Bangkok, Breeden outlined the need for stronger recovery capabilities across the banking system, according to a report by Reuters.
The warning comes as increasingly capable AI systems make it possible to identify software weaknesses, automate complex tasks and potentially conduct cyberattacks at greater speed. Financial regulators are examining how banks could maintain essential operations if a sophisticated attack disables their main technology infrastructure.
A successful cyberattack against a major financial institution could have consequences extending well beyond the affected bank. Payment processing, customer account access and other essential services depend on interconnected technology systems, meaning a prolonged outage could disrupt businesses and households.
Breeden's concerns center on the possibility that an attack could incapacitate an institution considered important to the wider financial system. She warned that AI-enabled threats have become a potential source of systemic risk, particularly if attackers target infrastructure supporting critical financial services.
The Bank of England has previously raised similar concerns. In a June 2026 speech, Breeden described how autonomous AI agents could combine different capabilities to identify and exploit vulnerabilities. She also emphasized that AI could strengthen defensive systems, making its implications for cybersecurity more complex than a straightforward increase in threats.
The immediate challenge for banks is therefore twofold: reduce the likelihood of successful attacks while ensuring that essential services can be restored if preventive controls fail. Faster identification and correction of vulnerabilities remain important, but regulators are increasingly considering what happens after an intrusion has already caused serious damage.
One approach under discussion is known as bare metal recovery, which involves rebuilding compromised computer systems from a clean foundation rather than depending entirely on existing infrastructure or potentially affected backups.
In practical terms, a bank facing a destructive attack may need to reconstruct operating systems, reinstall applications and restore verified data before bringing essential services back online. Such preparations are particularly important when an attacker has compromised the systems normally used to manage recovery.
The Bank of England described this approach in its October 2025 guidance on cyber response and recovery. The publication identifies testing recovery in clean environments, maintaining protected backups and prioritizing critical services as practices observed among financial institutions.
Separate recovery environments can also help reduce dependence on the technology affected by an incident. However, restoring banking operations involves more than restarting servers. Institutions must establish that recovered records are accurate, reconcile transactions and ensure connected systems can operate reliably.
Breeden's latest comments suggest regulators are looking at these challenges across the financial system, not just within individual banks. A recovery plan that works for one institution may be insufficient if a cyberattack simultaneously affects payment networks, technology suppliers or several major lenders.
Alongside AI-related cyber threats, the Bank of England is examining how financial institutions are preparing for future developments in quantum computing.
Breeden said the central bank is surveying firms about their readiness for quantum-related risks to encryption. The findings are expected to inform further engagement with the financial sector and work alongside guidance from the United Kingdom's National Cyber Security Centre.
Much of today's financial infrastructure depends on cryptographic methods that protect communications, authenticate users and secure transactions. sufficiently powerful quantum computers could eventually undermine some widely used forms of public-key encryption, although the timing of such capabilities remains uncertain.
The Bank of England's July 2026 Financial Stability Report encouraged financial institutions to begin planning for quantum-resistant cryptography. It highlighted the importance of identifying where encryption is used, understanding dependencies on technology suppliers and preparing for a potentially lengthy transition.
Unlike a conventional software update, changes to cryptographic infrastructure can affect numerous interconnected services. Banks may need to coordinate upgrades with payment providers, external technology companies and other financial institutions to avoid introducing new operational problems during the transition.
The broader concern for policymakers is whether a technological disruption could become a financial crisis. A bank may remain financially sound while being temporarily unable to process transactions or provide customers with access to important services.
Operational resilience has consequently become a central part of financial supervision. Regulators are examining not only whether institutions can withstand attacks, but also how quickly they can restore services and whether recovery plans account for dependencies across the financial system.
Bank of England Governor Andrew Bailey has also warned that artificial intelligence could increase risks to global financial stability. His concerns include increasingly sophisticated AI-powered cyberattacks, elevated technology valuations and vulnerabilities in interconnected financial markets, which could amplify economic disruptions and potentially contribute to a global downturn.
The Bank's September 2026 Financial Policy Committee record also identified risks associated with increasingly autonomous AI models. The committee stressed the importance of continued preparation for cyber and operational threats, including coordination with cybersecurity authorities.
Breeden's latest remarks place recovery planning at the center of that work. Banks are being encouraged to consider how they would restore the services customers and businesses depend on if an attack overwhelmed their defenses.
