Philippine banks may need to rethink how quickly they identify vulnerabilities, patch systems and monitor privileged accounts as artificial intelligence lowers the technical barrier for cybercriminals to launch attacks at scale, according to ManageEngine.
In an exclusive interview with FintechNewsPH, Sujatha S Iyer, Head of AI Security at ManageEngine, said generative AI is making it easier for attackers to use established hacking techniques without requiring the same level of expertise previously needed to plan and execute complex cyberattacks.
The warning comes as the Bangko Sentral ng Pilipinas (BSP) pushes banks and other BSP-supervised financial institutions to strengthen their defenses against emerging AI-enabled cybersecurity threats.
The BSP’s recent guidance warns that advanced AI systems could be used by malicious actors to identify software vulnerabilities, generate exploit pathways and execute multi-stage attacks with minimal human intervention.
For ManageEngine, the bigger concern is not necessarily that AI will discover entirely new types of vulnerabilities. Instead, it can make existing attack methods easier to execute and repeat at a much larger scale.
“The entry barrier to be an attacker, a malicious person, has lessened so much,” Iyer told Fintech News Philippines.
She said attacks that previously required substantial cybersecurity knowledge, time and manual planning can increasingly be orchestrated with the assistance of large language models.
This means conventional security practices such as quarterly or even monthly vulnerability checks may no longer be enough for institutions operating large and constantly changing digital environments.
Banks need to know which vulnerabilities actually matter
One of the areas highlighted by the BSP is the need for financial institutions to maintain accurate inventories of externally exposed assets, cloud services, identities, applications and software dependencies.
ManageEngine said visibility becomes increasingly difficult as banks operate thousands of endpoints alongside cloud platforms, on-premises infrastructure, third-party software and customer-facing systems.
But simply maintaining a list of vulnerabilities is not enough.
Iyer pointed to the limitations of prioritizing vulnerabilities solely through severity scores. A highly rated vulnerability on an isolated device could pose less immediate danger than a moderately rated vulnerability affecting a public-facing system used by customers.
“The biggest visibility gap is not just about having scores or just quantifying on some number. It is more of adding the right context,” she said.
Financial institutions therefore need to examine not only how severe a vulnerability is, but also whether the affected system is exposed to the internet, what services it supports and how far an attacker could potentially move through the organization if it were compromised.
For ManageEngine, this means shifting from periodic vulnerability assessments toward continuous visibility of the institution’s technology environment.
Legacy banking systems cannot always be patched immediately
Faster patching becomes more complicated when banks depend on older systems that support critical operations.
ManageEngine acknowledged that replacing a legacy platform immediately may not always be technically or operationally feasible.
Instead, banks can create additional layers of security around vulnerable systems while waiting for a permanent software update or replacement.
The BSP’s guidance includes virtual patching as one way institutions can protect systems when conventional patches cannot immediately be deployed.
Iyer said a bank could isolate a vulnerable legacy application from the public internet, place it inside a segmented network and tightly restrict which privileged users are able to access it.
Financial institutions could also adopt just-in-time access for administrators.
Rather than giving a privileged account permanent access to a critical system, access could be granted only during the period needed to complete a specific maintenance or operational task.
ManageEngine also recommends testing critical legacy applications in controlled environments to understand how attacks could affect them and what additional security controls may be required.
The goal, according to Iyer, is still to patch vulnerabilities whenever possible. When that cannot be done immediately, institutions should build defensive controls around the vulnerable system.
Privileged accounts could turn one breach into a wider attack
Administrative and privileged accounts are another major area of concern.
ManageEngine described these accounts as particularly high-risk because a compromised administrator could allow an attacker to move from one system to another and potentially interfere with the security tools designed to detect the intrusion.
A compromised privileged account could turn an isolated cybersecurity incident into an enterprise-wide compromise, Iyer said.
Attackers that gain control of these accounts may be able to move laterally across systems or even disable endpoint detection and response tools.
ManageEngine said this is where AI can also be used defensively.
Instead of assessing a login solely based on whether the correct username and password were entered, financial institutions can analyze other factors such as the device being used, location, login time and the activities performed after authentication.
For example, an administrator who normally accesses a server during office hours to perform routine maintenance could trigger additional scrutiny if the same account suddenly logs in during the middle of the night and begins accessing or encrypting large numbers of files.
AI can help identify this deviation from normal behavior and provide security teams with an earlier indication that an account may have been compromised.
What banks can automate with AI
While AI creates new cybersecurity risks, the BSP is also encouraging financial institutions to use the technology to strengthen their own defenses.
Areas identified in the guidance include patch management, threat hunting, exposure management and security orchestration.
ManageEngine said banks should begin by automating repetitive, low-risk tasks where the expected outcome is relatively predictable.
Asset discovery, vulnerability scanning and routine patching are among the activities that can increasingly be automated.
AI can also help security teams analyze the results by identifying which assets remain unpatched, which systems are more exposed and how much of the organization could potentially be affected if a particular endpoint were compromised.
However, ManageEngine said more consequential decisions should continue to involve people.
When an AI system detects behavior that could indicate an insider threat or a compromised account, for example, it can correlate alerts from multiple security tools and provide analysts with additional context.
A human analyst may still need to determine whether the behavior is actually malicious or simply part of an authorized business or maintenance activity.
Iyer described this approach as “AI-assisted human judgment,” where AI helps process large volumes of security information while people remain responsible for higher-risk decisions.
Three cybersecurity metrics banks should watch
For banks trying to determine whether their defenses are improving, ManageEngine identified three areas management should closely monitor.
The first is asset exposure and coverage.
Financial institutions should know how much of their infrastructure is visible to their cybersecurity teams, how many assets remain unpatched, when systems reach end-of-life and how exposed those assets are to potential attacks.
The second is the possible “blast radius” of a cybersecurity incident.
Banks should understand how much of their network or operations could be affected if a particular system were compromised and what controls are available to prevent the attack from spreading.
The third is the time required to contain an attack.
Instead of measuring only whether an intrusion was detected, banks should also determine how quickly they can isolate a compromised device or system and prevent the threat from moving further across the network.
For ManageEngine, the shift ultimately requires banks to combine traditional cybersecurity fundamentals with continuous, context-aware monitoring.
Regular patching, asset management and access controls remain important, but AI can help institutions perform these tasks more continuously and identify risks that would be difficult for security teams to detect manually across thousands of systems.
At the same time, the same technology is giving attackers new ways to automate familiar techniques.
For Philippine financial institutions, ManageEngine said strengthening defenses will increasingly depend on knowing what assets they have, understanding which vulnerabilities pose the greatest real-world risk and responding quickly enough to prevent a single compromised system or account from developing into a much larger incident.
