Fed's Bowman tells bank boards to scale cyber spending to their bank's own risk

"Cybersecurity requires proactive risk management by boards of directors and senior management," Bowman said. "It also requires strategic investments in people, processes, and technology that are aligned with the risk and complexity of the institution." ^[13] The second sentence is a budget rule that leaves each bank to supply the numbers. Her remarks did not include a dollar floor, a share of revenue or a peer benchmark ^[13]. A board that wants to meet the standard has to pick its own figure and be able to explain it.

The case for a bigger figure comes from the attackers' side. AI, Bowman said, has "the ability to accelerate vulnerability identification, create sophisticated social engineering campaigns, lower the barrier to entry for cyber criminals, and adapt attacks in real time as they are carried out." ^[11] Those are falling costs for the people mounting attacks. They come on top of the ransomware, business email compromise and vendor data breaches she said banks already face ^[10].

Enforcement is less settled than the board language suggests. At the Sept. 29 Denver workshop, Bowman said preparing for these threats can be burdensome and challenging for community lenders ^[2][6]. "That's why we continue to tailor our approach to IT examinations to consider risk profile and emerging threats and risks," she said ^[7]. She also asked small banks to tell the Fed how it could make its expectations clearer ^[8].

Examiners could fold the alignment sentence into IT exams and ask boards to show how cyber budgets track risk. Tailoring could instead mean narrower exam scope at small banks, with the sentence left as guidance. A third possibility is that the Financial Stability Board sound-practices report Bowman led, still in comment review, becomes the text examiners point to ^[16]. I think the first outcome is the likeliest. She put responsibility first and foremost with bank leadership ^[14], and she said regulators have a role in making sure these risks are addressed ^[12]. The counter-case is the second path, and her request for feedback supports it: a supervisor still asking what its expectations should say has not yet written the examiner's question. I would be wrong if Fed exam work at community banks keeps treating cyber as a controls checklist and leaves out board oversight of investment.

A size-based rule has a harder problem, raised by a report quoted in PYMNTS's coverage: "By accelerating vulnerability discovery and exploitation across shared technologies, AI can turn weaknesses that once produced isolated incidents into correlated disruptions affecting multiple institutions simultaneously." ^[18] A community bank can scale its patching and training to its own complexity. Spending more on its own staff will not fix a flaw in technology it shares with other banks.

The Fed's own commitment is events. Bowman said it will keep hosting workshops as part of its "ongoing commitment to identify and equip community banks with resources that may be necessary to combat cyber risks." ^[17] The banks' own budgets pay for the six practices she listed ^[15].