CyberAId: AI-Driven Cybersecurity for Financial Service Providers
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , , , , , , , , , , , , , , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2026
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866913084611756032 |
|---|---|
| author | Fatouros, George Makridis, Georgios Soldatos, John Kyriazis, Dimosthenis Malo, Pedro Kousiouris, George Ledakis, Giannis Kachrimani, Louiza Rizomiliotis, Panagiotis Almeida, Bruno Tomkou, Despina Metaxas, Kostas Ilias, Konstantinos Gkizelis, Christos de Gooyert, Ernstjan Babazadeh, Amin Mavrogiorgos, Kostis Paraskevoulakou, Pepi Xenakis, Christos Chouchoulis, Giannis Tripodi, Konstantina |
| author_facet | Fatouros, George Makridis, Georgios Soldatos, John Kyriazis, Dimosthenis Malo, Pedro Kousiouris, George Ledakis, Giannis Kachrimani, Louiza Rizomiliotis, Panagiotis Almeida, Bruno Tomkou, Despina Metaxas, Kostas Ilias, Konstantinos Gkizelis, Christos de Gooyert, Ernstjan Babazadeh, Amin Mavrogiorgos, Kostis Paraskevoulakou, Pepi Xenakis, Christos Chouchoulis, Giannis Tripodi, Konstantina |
| contents | European financial institutions face mounting regulatory pressure while their security operations centres remain constrained not by data or staffing but by reasoning capacity: enterprise SIEMs cover only a fraction of MITRE ATT&CK techniques, two thirds of SOC teams cannot keep pace with alert volumes, and the majority of breaches are preceded by alerts that are generated but never investigated. Frontier large language models now achieve state-of-the-art results on isolated cybersecurity tasks (one-day vulnerability exploitation, code-level patching, intrusion detection) yet no narrow win constitutes a platform that can compose across functions, persist multi-tenant state, map findings to regulatory regimes and survive an audit. This position paper argues that the right unit of construction is a hybrid multi-agent system in which specialised LLM subagents reason over classical SIEM/XDR telemetry rather than replacing it, share accumulated agent state across institutions through privacy-preserving federation, and can connect to complementary capability packs such as quantum-based authentication, digital twins for adversarial validation, and eBPF-based kernel telemetry. We present CyberAId, a model-agnostic, on-premise-deployable platform in which a Main Agent coordination layer, a Reporting capability, and specialist subagents operate within a shared runtime under bounded human-in-the-loop autonomy, organised around four falsifiable design principles, and aligned with relevant regulations. CyberAId will be validated at four representative financial use cases (client impersonation, anti-money-laundering for payment service providers, retail-banking incident response, and high-frequency-trading resilience) and propose skill-based agent adaptation as the most promising research direction for turning each deployment into a contribution to a continuously refined collective defence. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2605_01892 |
| institution | arXiv |
| publishDate | 2026 |
| record_format | arxiv |
| spellingShingle | CyberAId: AI-Driven Cybersecurity for Financial Service Providers Fatouros, George Makridis, Georgios Soldatos, John Kyriazis, Dimosthenis Malo, Pedro Kousiouris, George Ledakis, Giannis Kachrimani, Louiza Rizomiliotis, Panagiotis Almeida, Bruno Tomkou, Despina Metaxas, Kostas Ilias, Konstantinos Gkizelis, Christos de Gooyert, Ernstjan Babazadeh, Amin Mavrogiorgos, Kostis Paraskevoulakou, Pepi Xenakis, Christos Chouchoulis, Giannis Tripodi, Konstantina Artificial Intelligence Cryptography and Security Information Retrieval 68T42, 68T05, 94A60 I.2.11; K.6.5; I.2.1; C.2.0 European financial institutions face mounting regulatory pressure while their security operations centres remain constrained not by data or staffing but by reasoning capacity: enterprise SIEMs cover only a fraction of MITRE ATT&CK techniques, two thirds of SOC teams cannot keep pace with alert volumes, and the majority of breaches are preceded by alerts that are generated but never investigated. Frontier large language models now achieve state-of-the-art results on isolated cybersecurity tasks (one-day vulnerability exploitation, code-level patching, intrusion detection) yet no narrow win constitutes a platform that can compose across functions, persist multi-tenant state, map findings to regulatory regimes and survive an audit. This position paper argues that the right unit of construction is a hybrid multi-agent system in which specialised LLM subagents reason over classical SIEM/XDR telemetry rather than replacing it, share accumulated agent state across institutions through privacy-preserving federation, and can connect to complementary capability packs such as quantum-based authentication, digital twins for adversarial validation, and eBPF-based kernel telemetry. We present CyberAId, a model-agnostic, on-premise-deployable platform in which a Main Agent coordination layer, a Reporting capability, and specialist subagents operate within a shared runtime under bounded human-in-the-loop autonomy, organised around four falsifiable design principles, and aligned with relevant regulations. CyberAId will be validated at four representative financial use cases (client impersonation, anti-money-laundering for payment service providers, retail-banking incident response, and high-frequency-trading resilience) and propose skill-based agent adaptation as the most promising research direction for turning each deployment into a contribution to a continuously refined collective defence. |
| title | CyberAId: AI-Driven Cybersecurity for Financial Service Providers |
| topic | Artificial Intelligence Cryptography and Security Information Retrieval 68T42, 68T05, 94A60 I.2.11; K.6.5; I.2.1; C.2.0 |
| url | https://arxiv.org/abs/2605.01892 |