According to the «Global Security Research Report» by edge cloud and cybersecurity provider Fastly, financial services firms pursuing a consistent «AI-first» strategy take an average of 96 days longer to recover fully from a security incident than companies that do not consider themselves part of this category.

Overall, recovery at AI-focused companies takes more than seven months, according to the study.

Costs Almost Three Times as High

The longer downtime and recovery period also has financial consequences. Fastly estimates that losses caused by cyberattacks at «AI-first» financial firms are 189 percent higher than at the other financial services companies surveyed.

One possible reason is the growing technical attack surface. Some 49 percent of «AI-first» companies said that AI had been directly exploited in their most recent security incident. Among companies without such a focus, the figure was just 7 percent.

New structures such as AI agents and increasingly decentralised data flows add another layer of complexity. While they can automate processes, they also make it more difficult for security teams to maintain an overview of which systems are accessing which data.

Security Architecture Fails to Keep Pace

Fastly sees the problem as lying less in the use of AI itself than in the speed at which it is being introduced. «The speed at which AI is being adopted is changing security infrastructures virtually overnight. For AI-first companies, it is not about slowing innovation, but about modernising security at the same pace,» says Marshall Erwin, Chief Information Security Officer (CISO) at Fastly.

The figures suggest that companies have not yet managed to do so across the board. Around 32 percent of «AI-first» companies said AI had contributed to a security gap or blind spot during their most recent security incident. Among the other companies, the figure was 16 percent.

This makes so-called shadow AI a particular concern – AI applications and services used within a company without being fully controlled by its IT and security teams.

AI Crawlers Generate Additional Costs

The new AI infrastructure is not only placing a financial burden on financial services firms when a cyberattack occurs. Automated access by AI crawlers and so-called AI scraping also generates costs.

Almost two-thirds, or 64 percent, of the companies surveyed already regard this as a measurable cost factor. Fastly puts the average additional annual infrastructure cost at more than 380,000 euro.

The impact of AI adoption is also being felt elsewhere: 47 percent of financial services firms reported higher infrastructure costs, while 43 percent experienced operational disruptions. Another 35 percent observed negative effects for visitors to their online services, including longer loading times or malfunctioning features.

Banks Step Up Cyber Defences

Demand for new security solutions is rising accordingly. Among the companies surveyed, 62 percent are interested in «agentic discoverability» solutions designed to make the activities of AI agents visible and controllable. Another 61 percent are prioritising API security, while 53 percent are focusing on web application firewalls.

Concerns nevertheless remain high: 77 percent of respondents fear DDoS attacks targeting AI agents. In addition, 57 percent see a growing need for specialists with specific expertise in securing AI systems.

For banks and insurers, this creates a classic transformation dilemma: the faster AI is integrated into core processes, the greater the potential economic benefits – but at the same time, complexity and the demands placed on cyber defences increase.

One point should also be kept in mind: Fastly is itself a provider of cybersecurity and infrastructure products and therefore has a commercial interest in rising investment in this area. For the report, 2,000 IT decision-makers with influence over cybersecurity at large companies across different industries and regions worldwide were surveyed. The research was conducted by Sapio Research on behalf of Fastly in the fourth quarter of 2025.