AI will drive up credit cost of weak cyberdefenses, says Moody's

Use rising capital cost spikes to reframe cyber risk for the board

Increasing capital costs could provide a valuable way to communicate cyber risk to the board, agreed Chris Cochran, field CISO and vice president of AI security at SANS Institute. Business interruption, financial exposure and insurability are other useful talking points.

"Security leaders must stop leading with vulnerabilities, patching metrics and technical debt," Cochran said. "The conversation should sound more like, 'Here are the systems that generate revenue or keep the business operating, here is how long we could afford to lose them, and here is where our current resilience falls short.'"

From there, he added, CISOs can provide boards with a small set of meaningful indicators -- such as exploitable exposure, patch latency, privileged access and tested recovery time -- to track whether financial exposure is increasing or decreasing.

According to Mogull, the key message should be that baseline risk metrics -- including time to patch, the likelihood of being targeted and likely volume of attacks -- have fundamentally changed.

"We recommend focusing less on the technology and more on the modified risk assumptions," he said.

Better cyber resilience is a win-win

According to Moody's, organizations with weak cyber resilience will face the greatest credit risk.

"Well-resourced companies can offset the rising risk by investing in stronger defenses," said the report. "Those with weak patching practices are likely to fall further behind, especially if they have large digital networks that greatly broaden their attack surface."

On a practical level, experts agreed that organizations should start with fundamental cybersecurity controls, such as patching known exploited vulnerabilities, eliminating unnecessary connectivity and minimizing access privileges.

"This is actually the hardest part of the problem since even simple security isn't simple when it needs to scale," Mogull said. "AI is really good at finding that one place you missed a patch or closing a port, so we need to do our best to reduce those misses."

In Moody's analysis of roughly 9,500 rated issuers, 60% had at least one unpatched, known exploited vulnerability on their networks, and the median time to remediate a known exploited vulnerability was nearly three months. But to defend against frontier-level AI threats, experts predict cybersecurity teams will need to patch public-facing resources within days -- if not hours.

"We've started recommending moving toward a practice called 'VulnOps,' which views vulnerability management more as a DevOps-style continuous process than something you do on a monthly batch basis," Mogull said.

Organizations that cannot patch or modernize their legacy systems quickly should use containment strategies such as segmentation, access restrictions, compensating controls and tested recovery, according to Cochran.

"AI dramatically reduces the time defenders have to compensate for those vulnerabilities," he said.

Defenders should also prepare to confront multiple AI-enabled incidents simultaneously, Rob Lee, chief AI officer and chief of research at SANS, warned.

"Resilience looks like red team and tabletop exercises," he said. "Ask what is the hardest thing you could potentially deal with and start planning for several incidents at the same time."

While rising borrowing costs give CISOs immediate financial leverage with boards, experts emphasize that the underlying imperative remains purely operational.

"I don't know if it's going to affect credit ratings," Lee said. "What I do know is that you do need to be focused right now on resilience, because the adversary is going to be different, bigger, stronger and faster than it was before."

Alissa Irei is an Informa TechTarget senior reporter covering cybersecurity news.