The Australian Prudential Regulation Authority (APRA) has published a speech delivered by Member Therese McCarthy Hockey to the AFIA Risk Summit in Melbourne.
In ‘Fighting fire with fire’, Ms McCarthy Hockey spoke about the need for banks, superannuation funds, and insurers to move more urgently in response to the threats posed by frontier AI models and the looming realisation of encryption-breaking quantum computers.
Key points included:
- “As we race to identify and patch vulnerabilities before they can be exploited by bad actors, nothing will achieve this faster than AI – whether frontier models or the advanced models already in circulation. By harnessing AI to build the fire breaks we need to keep the flames from spreading, we can fight fire with fire.”
- “Frontier AI is not just a cyber risk issue. It’s third-party risk, a concentration risk and a sovereign access risk. A critical business process, control or cyber-defence capability that depends on a single offshore frontier AI model may be disrupted not only by an outage or cyber incident but by a regulatory decision made overseas.”
- “We expect to see organizations granted early access to frontier AI models sharing information and insights with peers and suppliers. Where one institution learns something material about AI-enabled vulnerabilities, model limitations, jailbreak techniques or defensive use cases, the system as a whole benefits when that knowledge is shared quickly and safely.”
- “Cyber security isn’t the only risk which is being accelerated by developments in AI…. In short, technological advancement makes other technological advancements possible. We are now at the point where AI is advancing exponentially, with capabilities doubling in a matter of months rather than years. One such advancement this will likely bring forward is quantum computing, which proposes to use the rules of quantum physics to exponentially increase computing power.”
- “For the moment, quantum computing doesn’t yet exist in any practical sense. But the clock is ticking. Until recently, the hypothetical day when quantum computers become powerful enough to break the cryptographic security that currently protects global digital infrastructure or ‘Q-Day’, as some have dubbed it, was thought to be more than 10 years away. But advancements in computing technology, including AI, have led to speculation that cryptographically relevant quantum computing could become a reality much sooner – years earlier in fact. All of us – businesses, regulators, governments and agencies – are in another race against time to prepare for this threat before Q-Day arrives.”
- “Locally, the ASD recommends organizations should have a plan to transition to post-quantum cryptography by the end of this year and have commenced that transition by the end of 2028. In line with this, APRA wants to see our regulated entities at least starting to map where cryptography is relied upon across their systems, data, and third-party providers, including long-lived data and critical infrastructure. Over the coming year, we intend to step up our supervisory engagement on this issue too – commensurate with the threat. We will want to see evidence that boards understand the risk, recognise their obligation to act and are advancing plans to meet the ASD’s recommended timeline.”
