JPMorgan Chase Urges Firms to Strengthen AI Cybersecurity

Businesses face growing cybersecurity risks as artificial intelligence accelerates vulnerability discovery and automated attacks, according to JPMorgan Chase in an article published November 2, 2026. The financial institution urges corporate leaders to strengthen digital defenses, reduce outdated technology risks and establish tighter controls over AI systems.

More than 200 days into what JPMorgan Chase describes as the Super Intelligence era, technological capabilities are advancing faster than many organizations can address existing security weaknesses. The growing gap between attack automation and remediation is creating additional pressure on enterprise security teams.

JPMorgan Chase identifies accumulated technology complexity as a significant business risk. Critical vulnerabilities can trigger urgent remediation efforts, while unsupported software and aging infrastructure can become security liabilities with little warning.

The company recommends that executives reassess their tolerance for technology risks, shorten decision-making processes and establish clear accountability across product development, technology, security, operations and suppliers.

Outdated software and hardware require particular attention. When vendors discontinue support for older products, security updates may no longer be available. This creates additional exposure even when the technology continues operating normally.

PHP provides an example of this challenge. Following the emergence of serious vulnerabilities, security fixes were made available only for the current version. Organizations using older versions needed to upgrade or eliminate the affected dependency.

JPMorgan Chase recommends maintaining a complete inventory of software and hardware, identifying unsupported systems and assigning accountable owners to manage exceptions. Companies should also establish funding, additional security measures and deadlines for replacing vulnerable technology.

Internet-facing infrastructure represents another major concern. Firewalls, virtual private network gateways and remote-access systems connect internal corporate networks to external environments, potentially creating entry points for attackers.

Recent Citrix vulnerabilities highlighted the exposure associated with these systems. JPMorgan Chase recommends reducing direct internet exposure, introducing independent authentication controls and improving network monitoring, segmentation and containment.

Security should also become part of product architecture from the beginning rather than being added after development. The company advises businesses to evaluate potential attacks, restrict unnecessary access, protect sensitive information and test security throughout product development.

Organizations should establish clear responsibility for unresolved architectural risks and incorporate security requirements into product launches, technology investments and partnerships. Designing systems so that one weakness cannot disrupt critical operations is another recommended measure.

AI agents introduce additional challenges because they can increasingly interact with enterprise systems, access information and execute tasks with limited human involvement. JPMorgan Chase emphasizes that technical capabilities should not automatically translate into unrestricted operational authority.

The company recommends limiting AI agents to the permissions necessary for their assigned tasks. Businesses should identify agents, monitor their activities in real time, maintain investigation records and preserve the ability to restrict or stop their operations quickly.

Human oversight should reflect the potential consequences of each action. Reversible, low-impact tasks require different controls from activities involving financial transfers, production systems or direct customer communications.