Why The Hong Kong Securities and Futures Commission’s AI Cyberattack Warning Demands Architectural Change

The Hong Kong SFC circular warns that AI has increased the speed, scale, and sophistication of cyber threats—accelerating reconnaissance, vulnerability discovery, phishing, deepfakes, and exploitation—shrinking the exploit lifecycle and reducing defender response time. It recommends a layered defence across five control domains (patching and vulnerability management, identity and access, detection and monitoring, third‑party supply chain risk, and incident response/recovery), emphasizes phishing‑resistant MFA and least‑privilege identity controls, and calls for AI‑specific protections (prompt‑injection defenses, data protection for RAG systems, model integrity, and strong encryption/key management).