Federal Reserve Vice Chair for Supervision Michelle W. Bowman on September 29, 2026, opened the 2026 Community Bank Cyber Workshop in Denver, Colorado, urging community banks to reinforce their cyber defenses as artificial intelligence reshapes the threat landscape. Her remarks were delivered via pre-recorded video at the annual event, hosted by the Federal Reserve Banks of Chicago, Kansas City, St. Louis, Minneapolis, and San Francisco.

"Good morning, and welcome to the 2026 Community Bank Cyber Workshop," Bowman said, adding that it was a pleasure to join the annual event again. "As the cyber environment grows more complex, events like this one enable us to continue the discussion of evolving approaches to address these challenges."

Bowman noted that over the past year, a number of community banks have experienced significant cyber events, a development she said emphasizes the importance of cyber hygiene and resiliency. The workshop, she said, offers community banks practical information to help prepare for potential cyber disruptions and brings together regulators, bankers, law enforcement, and industry professionals to advance the conversation on cyber and information technology risk management.

Two-Day Agenda on Cyber and IT Risk

Over the two days of the event, attendees are set to gain perspective through a cybersecurity tabletop exercise, explore how AI can enhance cyber defenses as well as the potential risks it introduces, and hear from the U.S. Secret Service — the federal agency that investigates cyber-enabled financial crime — and the Federal Reserve's Cybersecurity Analytics Support Team. Participants will also engage more deeply with examiners, community bankers, and industry professionals, including representatives of the Cyber Risk Institute, an organization that maintains a standardized cybersecurity assessment framework for financial institutions.

AI Reshaping the Threat Landscape

In her remarks, Bowman described a cyber threat landscape that has "advanced exponentially." While banks continue to face risks including ransomware, business email compromise, and vendor data breaches, the increased availability and use of AI by threat actors adds complexity to the risk environment, she said.

AI, according to Bowman, offers great potential — both to threat actors and to those buttressing their defenses against those threats. The technology has the ability to accelerate vulnerability identification, create sophisticated social engineering campaigns, lower the barrier to entry for cyber criminals, and adapt attacks in real time as they are carried out. That dual-use character — the same capabilities that can strengthen defenses can also empower attackers — has pushed AI toward the center of the supervisory agenda, a point underscored by the international work Bowman went on to highlight.

These changes, she said, have clear impacts on banks, which must continuously evolve their cyber defense strategies and tactics.

Back to Basics: Cyber Hygiene

Defending against these risks begins with strong cyber hygiene, Bowman said, citing up-to-date asset inventories, phishing-resistant multifactor authentication, strong identity and access controls, and robust vulnerability identification and patch management programs. Comprehensive employee training and periodic incident response program testing are also required, she added.

Bowman said AI is becoming a critical component of these security measures, both as a defensive tool and as an evolving risk. Many workshop participants, she observed, are already exploring how to safely and strategically deploy AI for these purposes. Understanding when, where, and how to properly use AI, she said, is instrumental to balancing innovation with sound risk management.

FSB Report on Responsible AI Adoption

Bowman also highlighted recent international work on the topic. Over the summer, under her leadership of the Standing Committee on Supervisory and Regulatory Cooperation, the Financial Stability Board — the international body that coordinates financial regulatory and supervisory standards across major jurisdictions — published a report on Sound Practices for Responsible Adoption of Artificial Intelligence (AI). Dated June 10, 2026, the report offers several practices for financial institutions to consider in the adoption and use of the technology.

She noted that some of the case studies described in the report were targeted to smaller financial institutions, and said she welcomes feedback from banks on how supervisors can continue to improve clarity around expectations for smaller banks — an indication that supervisory expectations around AI use at smaller institutions are still taking shape.

Governance and Tailored Supervision

Cybersecurity, Bowman said, requires proactive risk management by boards of directors and senior management, along with strategic investments in people, processes, and technology that are aligned with the risk and complexity of the institution. Regulators recognize that this can be burdensome and challenging for community banks — institutions that typically operate with leaner security resources than the largest banks — which is why they continue to tailor their approach to IT examinations to consider each institution's risk profile and emerging threats and risks, she said.

Bowman added that this year's workshop demonstrates the Federal Reserve System's ongoing commitment to identifying and equipping community banks with resources that may be necessary to combat cyber risks.

Collaboration at the Core

In closing, Bowman emphasized that cyber readiness is not built through technology alone. It requires collaboration with internal and external stakeholders, continuous education and training, and support for those on the front lines: employees and customers.

She thanked the five Reserve Banks involved in organizing this year's event and offered a single thought to frame the discussions: "Cyber resilience is built upon a strong cyber security foundation fortified one step at a time."

In a footnote to her remarks, Bowman said the views expressed are her own and are not necessarily those of her colleagues on the Federal Reserve Board or the Federal Open Market Committee.

The full text of the speech is available on the Federal Reserve's website.