Mambu VP Warns Banks: ECB AI Cyber Deadline Must Not Be a Box-Ticking Exercise

The European Central Bank’s October 31 deadline for large eurozone banks to submit action plans against AI-powered cyberattacks marks a critical shift in regulatory oversight. For fintech professionals, this represents a transition from theoretical AI risk to mandatory operational resilience, as institutions are forced to prove they can withstand automated, high-velocity threats that bypass traditional security patching cycles.

What was announced

The European Central Bank (ECB) has mandated that the eurozone’s largest financial institutions deliver comprehensive strategies by October 31 to defend against the rising threat of AI-driven cyberattacks. This regulatory requirement follows increasing concerns that artificial intelligence is being used to automate the discovery and exploitation of vulnerabilities at a pace that manual security teams cannot match.

Peter Cooper, VP of Security at Mambu, highlighted that the traditional "whack-a-mole" approach to vulnerability management is no longer viable. In the current landscape, AI allows attackers to aggregate minor, seemingly insignificant weaknesses into complex, multi-stage breaches before defensive teams can identify the flaw. The focus of these ECB-mandated plans must extend beyond simple software patches to address deeper structural risks. These include flaws in business logic, the governance of internal AI tools, and security gaps within the broader supply chain.

The deadline serves as a catalyst for banks to move beyond compliance exercises. The core challenge identified is the erasure of the "time-to-fix" window; where security programmes previously assumed a period of grace between a flaw's discovery and its exploitation, AI-powered tools have effectively eliminated this buffer. Consequently, the ECB is pushing for a more proactive stance where banks must demonstrate their ability to contain attacks in real-time when immediate fixes are unavailable.

“On 31 October, Europe’s biggest banks are due to hand the ECB their plans for surviving AI-powered cyberattacks. But banks can’t patch their way out of this threat, and the danger is that many will treat the deadline as a box to tick and move on.

With AI, banks are facing an old enemy that moves at an entirely new pace. Most vulnerability programmes assume there’s time to fix a flaw before it’s exploited. However, AI is erasing that window, allowing attackers to stitch together seemingly minor weaknesses into a serious breach before security teams can react. Banks can’t play whack-a-mole with vulnerabilities. And the biggest risks don’t appear on any list: flaws in business logic, poorly governed AI tools and gaps in supplier security can all leave critical systems exposed.

Banks should absolutely fight AI with AI, but they can’t afford to take humans out of the loop. Crucially, they need to be able to contain an attack when a fix can’t come quickly enough.

Attackers aren’t waiting for banks to get their house in order. The ECB deadline should mark the start of a new way of operating, not the end of another compliance exercise.

The companies involved

Mambu is a prominent player in the cloud banking space, providing a Software-as-a-Service (SaaS) engine that powers modern financial institutions. The company offers a "composable banking" approach, allowing banks, fintechs, and lenders to build and scale financial products without the constraints of legacy core banking systems. By operating as a cloud-native platform, Mambu enables its clients to integrate various best-of-breed services through APIs, making it a central component in the digital transformation of the global banking sector.

The company has established a significant footprint in the market, serving a diverse range of clients from traditional Tier 1 banks to digital-first neobanks and non-bank financial companies (NBFCs). Its position in the industry gives it a unique vantage point on the security challenges facing the eurozone's largest banks as they migrate away from on-premise infrastructure toward more agile, cloud-based environments. As these institutions adopt more sophisticated technology stacks, the security of the underlying core and the governance of integrated AI tools become paramount to maintaining the integrity of the financial system.

What FF News has reported before

FF News has extensively covered Mambu’s expanding ecosystem and its role in modernising global finance across 118 previous reports. Most recently, the company entered a significant collaboration in late 2026, as seen in Mambu and Mastercard Partner to Streamline Global Cross-Border Payments for Banks. The platform’s versatility was further demonstrated through its work with Newgen and Mambu Partner to Deliver Plug-and-Play Lending Stack for Banks, Digital Banks, NBFCs, and Islamic Lenders, which targeted a wide array of lenders including Islamic financial institutions. Geographically, Mambu has maintained a strong presence in emerging markets, highlighted by the report Jeel and Mambu Join Forces to Power Saudi Arabia’s Fintech Sandbox and Pave the Way for Banking as a Service and the renewal of its relationship with Indonesia’s Krom Bank in Krom Bank Renews Multi-Year Partnership With Mambu to Accelerate Digital Banking Innovation in Indonesia.

What this means

The ECB’s intervention signals that the era of treating AI security as a "future problem" has ended. This mandate puts immense pressure on Chief Information Security Officers (CISOs) at major European banks to move beyond perimeter-based defense. The industry is now facing a fundamental question: can a legacy-heavy banking sector ever truly match the speed of AI-driven adversaries? While the ECB demands plans, the real test will be whether these institutions can implement the "human-in-the-loop" containment strategies required to mitigate breaches. This move likely forces a faster consolidation of security vendors as banks seek integrated, AI-native defense platforms to replace fragmented legacy security tools.