The G7 Is Preparing for AI-Enabled Cyberattacks. Is Your Leadership Team?
This essay will first examine recent G7 and Financial Stability Board (FSB) initiatives regarding AI-enabled cyber risks, then analyze how these developments underscore the necessity for organizations to conduct realistic crisis simulations and independent testing. The discussion will outline relevant regulatory guidance, present illustrative scenarios, and conclude with recommendations for integrating these practices into organizational risk management strategies.
Artificial intelligence is changing how organizations operate, compete, and make decisions. It is also changing the threats they face.
Over the past several years, organizations have invested heavily in cybersecurity, business continuity, and crisis management. However, a critical question remains for all leadership teams: Are they truly equipped to make effective decisions when confronted with a crisis that escalates more rapidly than their established plans and processes can accommodate? This question is particularly relevant for leaders seeking to ensure their organization’s resilience in an increasingly complex threat environment.
That question has become even more important with the rapid adoption of AI.
In October 2026, the G7 announced plans to conduct tabletop exercises focused on AI-enabled cyberattacks affecting the financial system. Reuters reported the announcement in its article, G7 to Launch Exercises to Guard Against AI Cyber Attacks.
At almost the same time, the Financial Stability Board (FSB) published its Sound Practices for Responsible Adoption of Artificial Intelligence, outlining 12 practices covering AI governance, risk management, human oversight, cybersecurity, and third-party dependencies.
These are important developments, but the underlying message is not new to us at PreparedEx.
Organizations need to test their ability to manage AI-related crises before they experience one.
That is precisely the type of challenge we already incorporate into our clients’ crisis simulation exercises.
Why the G7 Announcement Matters
The G7’s decision to introduce AI-focused cyberattack simulations represents an important evolution in how financial authorities approach crisis preparedness.
As noted in Reuters’ report on October 16, 2026, G7 finance leaders agreed to conduct exercises aimed at evaluating their ability to respond to AI-driven cyberattacks, with the intention of testing existing response protocols and informing necessary improvements (Reuters — G7 to Launch Exercises to Guard Against AI Cyber Attacks, 2026).
The announcement builds on earlier work by the G7 Cyber Expert Group. Its September 2025 statement, Artificial Intelligence and Cybersecurity, identified threats including AI-powered impersonation, automated exploitation, data poisoning, prompt injection, and third-party dependencies.
What makes this particularly interesting is the recognition that AI can fundamentally change the speed, complexity, and potential consequences of a cyber incident.
An attacker using AI may create convincing impersonations, accelerate vulnerability identification, or coordinate malicious activity across multiple systems. At the same time, organizations may increasingly depend on AI-enabled tools to detect threats, support operations, and recommend decisions.
This creates a difficult situation for executives. What happens when the technology they rely on to protect their organization becomes unreliable, compromised, or part of the problem?
The G7’s newly announced exercises have not yet produced published findings. Nevertheless, the decision to conduct them reinforces something we have advocated for years: preparedness cannot be demonstrated by having a plan alone. It must be tested through realistic exercises.
The FSB Is Bringing AI Risk Into the Boardroom
The Financial Stability Board’s October 2026 guidance adds another important dimension.
Its 12 sound practices address organization-wide AI governance and risk management throughout the AI lifecycle. They include clearly defined responsibilities, effective human oversight, performance evaluation, cyber and ICT risk management, and oversight of third-party AI dependencies.
Of particular relevance to PreparedEx is Sound Practice 11, which specifically addresses incorporating AI-related cyber and ICT risk scenarios into testing and exercises.
Although these are voluntary sound practices rather than mandatory certification requirements, they provide a useful framework for organizations seeking to strengthen AI resilience.
From our perspective, this convergence of governance and crisis preparedness is essential. Robust oversight structures alone are insufficient without complementary crisis management mechanisms that are specifically designed to address the complexities introduced by AI. Effective organizational resilience depends on integrating sound governance frameworks with proactive preparedness initiatives. This integration ensures that leadership is equipped not only to formulate policies but also to operationalize them during high-pressure, unpredictable scenarios precipitated by AI technology.
An organization might have an AI policy, a cyber incident-response plan, and a business continuity strategy. But have its executives ever had to decide whether to shut down an AI system supporting a critical business process?
Have they considered what happens when an AI-generated recommendation conflicts with experienced employees’ judgment?
Do they understand how a failure involving a third-party AI provider could affect customers, regulators, employees, and operations at the same time?
For example, an organization might assume its leaders will know how to respond if an AI-generated recommendation contradicts employee judgment, but only a crisis simulation can reveal whether executives are prepared to resolve such conflicts under real-time pressure. Therefore, these questions must be addressed through rigorous testing rather than relying on assumptions.
What We’re Already Testing at PreparedEx
At PreparedEx, we are already incorporating AI-related threats and operational failures into crisis simulations for our clients.
Our approach goes beyond asking participants how they would respond to a conventional cyberattack. For instance, we develop scenarios in which an AI-enabled system generates misleading information during an incident, resulting in executives receiving conflicting recommendations or workflows supporting essential services being disrupted. These situations present decision-makers with ambiguous, contradictory, or rapidly changing information, requiring them to assess and act under heightened uncertainty and time pressure. By incorporating such concrete examples into our exercises, we analyze how AI not only alters the nature of the crisis and the accuracy of information available to leadership, but also compels executives to navigate complex trade-offs and make high-stakes decisions that directly impact the organization’s capacity to sustain critical operations.
These exercises examine several important capabilities:
- Executive decision-making: Can leadership make timely, informed decisions when AI-related threats create uncertainty?
- Human oversight: Who has authority to challenge, override, or suspend an AI-enabled process?
- Operational resilience: Can the organization maintain essential services if an AI system fails or must be disconnected?
- Crisis communications: How does leadership communicate when AI-generated misinformation spreads faster than verified facts?
- Third-party dependencies: What happens when an external AI provider becomes unavailable or compromised?
- Recovery and assurance: How does the organization confirm systems are safe to restore and identify the improvements needed afterward?
We design these situations around the client’s operating environment, existing crisis-management arrangements, and leadership responsibilities.
The objective is not to test whether executives understand how an AI model works technically. It is to establish whether they can manage the operational, financial, reputational, and human consequences when something goes wrong.
An Example: When an AI System Becomes the Crisis
Consider an illustrative scenario based on the types of AI-related threats we incorporate into executive exercises. The following example is fictional and does not describe a particular client engagement.
A large organization has introduced an AI-enabled customer service platform to improve efficiency and reduce operating costs. The platform can access customer information, provide account-specific recommendations, and initiate certain approved workflows.
Initially, everything appears to be functioning normally.
Then employees begin receiving complaints that customers are being offered unauthorized discounts and receiving incorrect account information.
Within hours, the issue escalates.
An attacker exploited weaknesses in the AI platform’s instructions and connected workflows, causing it to act outside its intended purpose. The problem is spreading through customer interactions, and screenshots of the AI’s responses are circulating on social media.
The cybersecurity team believes it can contain the issue by turning off the platform. However, the system now supports a substantial percentage of customer interactions, and shutting it down will create significant operational disruption.
Meanwhile, the communications team is dealing with increasingly negative coverage, the legal team is evaluating potential notification obligations, and senior executives are receiving conflicting recommendations.
The crisis leadership team faces several immediate decisions.
Do they shut down the AI system and accept the operational consequences? Who has authority to make that decision? How do they determine the extent of the damage? And what do they tell customers before the full facts are known?
As the simulation progresses, new developments emerge. A third-party technology provider identifies a possible security issue, customers threaten legal action, and the board asks why existing AI controls failed.
The exercise moves from initial containment to executive coordination, communications, recovery, and accountability.
This is where simulation’s real value becomes apparent.
Participants are no longer discussing AI risk as an abstract concept. They must make decisions, set priorities, manage competing interests, and lead under pressure.
And frequently, the most valuable findings have little to do with technology.
They involve unclear decision authority, gaps between functional teams, incomplete escalation procedures, or uncertainty about who owns the consequences of an AI-enabled decision.
Organizations need to identify these issues before a real incident occurs.
AI Risk Is Not Just a Financial Services Problem
While the G7 initiative and FSB guidance primarily address AI-related risks within the financial sector, it is crucial to recognize that these underlying risks are relevant to a broad range of industries, each facing distinct operational, regulatory, and strategic challenges arising from AI adoption.
Healthcare organizations are using AI to support clinical and administrative decisions. Manufacturers are integrating AI into production and supply-chain operations. Hospitality companies are introducing AI-powered customer service and booking platforms. Utilities and critical infrastructure operators are exploring AI-enabled monitoring and support for operational decisions.
Each sector has different consequences if an AI system fails or is manipulated.
For one organization, the immediate concern may be financial loss. For another, it may disrupt essential services, compromise customer safety, increase regulatory exposure, or erode public confidence.
The common challenge is leadership.
When an AI-related incident occurs, executives must not only understand the evolving situation, establish control, make timely, informed decisions, communicate effectively, and guide the organization toward recovery, but also proactively develop and rehearse clear decision protocols and communication strategies tailored to AI-specific crises. By incorporating scenario-based training and structured after-action reviews, leadership can enhance the organization’s ability to respond decisively and minimize the impact of such incidents.
AI does not remove those responsibilities. In many cases, it makes them more demanding.
Moving Beyond the Tabletop Exercise
One of the most important lessons from our crisis preparedness work is that an exercise should never be the final objective.
An effective simulation should show what worked, what didn’t, and what needs improvement.
At PreparedEx, we place significant emphasis on evaluating performance, identifying capability gaps, and translating exercise findings into practical remediation actions.
For AI-related scenarios, that means examining whether governance arrangements are effective, whether human oversight works under pressure, and whether the organization can continue operating when an AI-dependent process becomes unavailable.
It also means revisiting those capabilities as technology, business dependencies, and threats evolve.
This is particularly relevant to the FSB’s emphasis on performance evaluation, effective oversight, and continuous improvement, as described in its October 2026 final report.
Organizations should be able to demonstrate not simply that they have considered AI risk, but that they have exercised their response arrangements and taken action on the findings.
The Question Every Leadership Team Should Be Asking
The G7’s planned exercises and the FSB’s guidance signal the direction of AI risk management and operational resilience.
But organizations don’t need to wait for further regulatory developments to act.
The threats are already relevant. AI adoption is accelerating, and the potential consequences of failures, misuse, and cyberattacks are becoming increasingly interconnected.
At PreparedEx, we already help clients explore these challenges through realistic crisis simulations that put executive leadership at the center of the response.
Our focus remains straightforward: create credible scenarios, challenge assumptions, evaluate performance, and help organizations improve their ability to respond.
The question is no longer simply whether your organization is using AI safely. It is whether your leadership team is prepared to manage the consequences when AI becomes part of a crisis.
That is something worth testing before it happens.
About PreparedEx
PreparedEx specializes in crisis management, executive tabletop exercises, business continuity, operational resilience, and independent preparedness assessments. We help organizations test their response capabilities through realistic simulations, structured evaluation, and practical improvement planning.
Contact PreparedEx to discuss incorporating AI-enabled threats into your next executive crisis simulation.
References and Further Reading
Reuters — G7 to Launch Exercises to Guard Against AI Cyber Attacks (October 16, 2026)
G7 Cyber Expert Group — Artificial Intelligence and Cybersecurity (September 2025)
Add your first comment to this post