Community Bank Cybersecurity: A Practical Guide to AI Threats and Resilience

Community banks face familiar cyber risks in an increasingly complex environment. In opening remarks at the September 29, 2026, Community Bank Cyber Workshop, Federal Reserve Vice Chair for Supervision Michelle W. Bowman highlighted ransomware, business email compromise, vendor data breaches, and risks associated with artificial intelligence. She emphasized that resilience starts with strong cyber hygiene and continues through preparation, training, and oversight.

Questions about applying these priorities? Contact NETBankAudit.

What Bowman said, and what banks can do next

In her opening remarks, Bowman said AI can accelerate vulnerability identification, create sophisticated social engineering campaigns, lower the barrier to cybercrime, and allow attacks to adapt in real time. She also identified up-to-date asset inventories, phishing-resistant multifactor authentication, strong identity and access controls, vulnerability and patch management, employee training, and incident response testing as important defenses.

Bowman’s remarks establish the priorities. The implementation ideas below are NETBankAudit’s practical guidance for applying those priorities in a community bank, not additional recommendations attributed to Bowman or a Federal Reserve timetable. Her speech states that the views expressed are her own and not necessarily those of her colleagues on the Federal Reserve Board or the Federal Open Market Committee.

Make cybersecurity a board and senior management priority

Bowman said cybersecurity requires proactive risk management by boards of directors and senior management. She also emphasized aligning investment in people, processes, and technology with an institution’s risk and complexity. For bank leaders, that means treating cybersecurity as an ongoing governance responsibility, not solely a technical department’s concern.

As a practical management step, establish a consistent way to raise material cyber risks, decisions, and unresolved issues. Reports should help directors and senior leaders understand what is at risk, who is responsible for addressing it, and where management needs to make or approve a decision.

NETBankAudit recommends using one action-tracking process for material control issues. For each item, record an accountable owner, supporting evidence, a target date, and a point for reassessment. That shared discipline can reduce duplicate documentation across audit, remediation, vendor, and incident response processes.

When reviewing repeat findings, internal audit teams may also find NETBankAudit’s discussion of audit and exam issues relevant. Prioritizing issues according to the bank’s risk profile can help management focus resources on areas with the greatest potential effect on important services and operations.

Translate cyber hygiene priorities into reviewable controls

Use the asset inventory to guide decisions

Bowman specifically identified up-to-date asset inventories as part of strong cyber hygiene. As a practical audit matter, an inventory is most useful when the bank can use it to identify what supports important activities and where a control gap may require attention.

NETBankAudit suggests reviewing whether inventory records give staff a usable view of the environment. The right level of detail depends on the institution’s systems and risk profile. Consider whether the inventory identifies:

• Important systems, devices, applications, and services.
• Business or technical owners who can answer questions about operation and maintenance.
• Significant connections to sensitive information, internal networks, or external providers.
• Known vulnerabilities, patch status, and material remediation exceptions.

Also consider how inventory information is updated after a system change, a new service, or a vendor relationship change. Connecting inventory maintenance to existing change management and third-party oversight processes can help prevent important dependencies from being overlooked.

Review authentication and access together

Bowman called out phishing-resistant multifactor authentication and strong identity and access controls. As an implementation step, review who can access important systems, whether access aligns with job responsibilities, and how the bank approves, changes, and removes access when roles change.

Include privileged accounts in that review. Consider whether elevated access is limited to appropriate users and whether management can identify who is accountable for those accounts. CISA’s MFA guidance offers an additional reference for institutions evaluating phishing-resistant authentication.

Connect vulnerability identification to remediation

Bowman’s remarks call for robust vulnerability identification and patch management programs. NETBankAudit recommends checking whether findings are assigned, prioritized, and tracked through resolution, rather than relying only on evidence that scanning or patching occurs.

Review whether the process covers relevant operating systems, applications, and networked devices. Where remediation is delayed, management should be able to explain the decision and understand when the issue will be reconsidered. NETBankAudit’s resource on vulnerability and patch management offers a deeper look at this control area.

Prepare employees for evolving social engineering

Bowman noted that AI can be used to create sophisticated social engineering campaigns. She also emphasized employee training as a cyber hygiene measure. A bank’s training approach should help staff apply established policies when requests or communications raise questions.

As a practical recommendation, make training relevant to employees’ roles and the bank’s workflows. Staff should know how to verify unusual requests through a trusted channel, protect sensitive information, and report a suspected phishing message or other concern.

Testing can help management assess whether awareness procedures are understood in practice. NETBankAudit offers social engineering testing that can include phishing simulations, pretext calling, and onsite testing. Findings can help identify awareness gaps and inform later training, based on the institution’s objectives and agreed scope.

Keep employee guidance focused on prevention and reporting. Make the reporting route clear, and explain what information employees should provide when raising a concern. The incident response process should then take responsibility for escalation, coordination, and response decisions.

Manage AI adoption as a risk decision

Bowman described AI as both a potential defensive tool and an evolving risk. She encouraged financial institutions to understand when, where, and how to use it while balancing innovation with sound risk management. That framing supports deliberate review rather than automatic adoption or assumptions that every use presents the same risk.

For each proposed use, NETBankAudit recommends documenting the business purpose, users, information involved, relevant dependencies, and decision-maker. Consider whether the tool will receive sensitive information, influence a control or business decision, or depend on an external provider. These are practical review questions, not specific requirements stated in Bowman’s remarks.

The Financial Stability Board’s AI adoption report, which Bowman referenced, presents practices for financial institutions to consider. Her remarks note that some of its case studies were aimed at smaller institutions. Community banks can use the report as a discussion resource while assessing each use case against their own activities and risk.

Connect AI review to existing governance where possible. Involve relevant business, information security, compliance, technology, and vendor management personnel. Set expectations for how the tool may be used, how outputs will be reviewed, and how staff should raise data or control concerns. NETBankAudit’s article on AI risk assessment can help readers explore this topic further.

Test incident response and continuity plans

Bowman called for periodic incident response program testing and emphasized collaboration, continuous education, and support for employees and customers. A written plan is an important reference, but NETBankAudit recommends exercises to examine whether responsibilities and communication procedures work in practice.

Choose scenarios that reflect the institution’s risk environment. Ransomware, business email compromise, vendor data breaches, and AI-enabled social engineering are among the risks identified in Bowman’s remarks. An exercise can explore how the bank would recognize an event, involve the appropriate teams, and make decisions about its response.

Keep exercises focused on response and coordination, distinct from employee awareness training. Observe whether participants know whom to notify, who can make key decisions, and how internal teams and providers should communicate. Add resulting issues to the action-tracking process used for other material control gaps.

Incident response should also connect with the bank’s continuity planning. Consider how a cyber disruption could affect important services and which internal or external stakeholders would need to coordinate. The FFIEC continuity booklet is an institutional reference for business continuity management. For a focused discussion of bank incident preparation, see NETBankAudit’s resource on ransomware response planning.

Use a focused plan to turn priorities into action

For institutions looking to operationalize Bowman’s priorities, NETBankAudit suggests the following 90-day starting framework. It is a planning aid, not a Federal Reserve timetable or regulatory requirement. Adjust the sequence to the bank’s risk profile, current control program, and available resources.

1. Weeks 1 to 3: Confirm ownership of the asset inventory and identify important systems, key providers, and material open issues.
2. Weeks 4 to 6: Review authentication, access controls, vulnerability tracking, and patch management exceptions.
3. Weeks 7 to 9: Select an incident scenario and test the relevant response and communication procedures with appropriate stakeholders.
4. Weeks 10 to 12: Present significant findings to management, agree on priorities, and schedule follow-up testing or review.

The NIST Cybersecurity Framework 2.0 can serve as a resource when organizing cybersecurity discussions. NETBankAudit’s guide to cybersecurity assessments provides a related perspective. Whichever framework the institution uses, tie review activities to its systems, operations, and risk decisions.

How NETBankAudit can support community bank cyber resilience

NETBankAudit works with financial institutions on IT audits, cybersecurity assessments, risk assessments, and technical testing. Services can be tailored to the institution’s needs and budget, and engagements can support an existing internal audit function or management self-assessment.

Relevant services include cybersecurity controls evaluations, vulnerability assessments, penetration testing, social engineering testing, incident response assessments, business continuity work, and IT general controls audits. These services can help institutions evaluate controls, identify gaps, and develop prioritized recommendations suited to their operating environment.

To discuss an audit, assessment, or testing engagement related to your bank’s cyber resilience, contact NETBankAudit.