Which large banks lead in AI for cybersecurity?

Which banks have AI for cybersecurity on the record?

The 30 highest of the 71 banks with at least two cyber entries that state AI (cybersecurity use cases, dated moves on cyber, security operations, threat detection, phishing, fraud rings or deepfakes, or cyber figures, combined). Ranked by depth score, then by the best stage among the AI cyber use cases, then by US AI-index score.

Each row quotes the bank's page on this site; the bank link opens the full record with every source. “Not disclosed” means the page records nothing on that point. Banks absent from the table have no evidence on this topic on their page. The AI index score is the bank's score out of 100 on the US AI index; non-US groups are outside that index and show n/a.

Which banks disclose a cyber budget, investment or headcount?

Every bank whose page carries a cyber figure, ranked or not, quoted as reported. 3 banks disclose a budget, investment or headcount; other cyber figures (attack volumes, detection rates) are listed where no budget is given.

How is this ranking computed?

Cybersecurity use cases are split into those whose text states AI, machine learning, agents, models or security automation and those that describe a programme without AI. Depth score = 3 × AI cyber use cases in production + 2 × AI cyber use cases at other stages + 1 per dated timeline move that mentions cyber, security operations, threat detection or intelligence, phishing, fraud rings, deepfakes, SOC or information security and also states AI + 2 per disclosed cyber figure. Programmes without AI add nothing. A bank needs at least two entries that state AI (use cases, moves and figures combined) to be ranked. Order: depth score, then best stage among the AI cyber use cases, then US AI-index score (non-US groups last). Entries that deny AI use, and entries that are guidance, advice or marketing to clients about AI threats rather than the bank's own defence, are not counted as AI.

Cyber budgets and headcount are quoted as the bank states them; a bank that reports only an overall technology budget is not credited with a cyber figure.

What are the caveats?

Banks disclose little about cyber defence for security reasons; a short record here is expected and is not evidence of weak defences.

Moves about AI-enabled threats (deepfake scams, frontier-model cyber risk) count alongside defensive AI because both describe the bank acting on AI in cyber; the move column says which.

How does this differ from the AI index?

The AI index scores AI disclosure across every business line; this page keeps only cybersecurity AI and adds disclosed cyber budgets and headcount. The AI index and its method are on their own page; the technology leaders and generative AI guides are hand-written cross-bank tables with their own sourcing.