APRA - Cyber resilience and AI

Question

1. Has APRA assessed whether Mythos or similar AI models can create cyber or operational resilience risks for Australian banks, insurers and superannuation funds? 2. Does APRA have access to Mythos, or detailed testing results from a trusted regulator or security agency? 3. If APRA does not have access to detailed testing results from a trusted regulator or security agency, has it sought access or requested briefings from overseas regulators? 4. Has APRA asked banks, insurers, super funds and critical service providers whether their systems have been tested against frontier AI-enabled cyber threats? 5. Does APRA have the technical capability to assess the risk itself, or is it relying on external agencies like ASD?

Answer

See attached response.

Documents

• Question with answer (PDF) (opens in a new tab)
• SQ26-000266 APRA - Cyber resilience and AI.pdf (opens in a new tab)