Manifesto
Risk is changing. So must our defenses.
Capability reaches defenders and the people institutions defend against at the same time. The operating model for risk has to change with it.
Built for a different era.
The architecture of modern risk management was built in the early 2000s, for a world where markets moved at a pace humans could follow, fraud took recognizable forms, and compliance teams could review alerts by hand. That world no longer exists. The adversaries have professionalized: fraud rings, laundering networks, intrusion crews, and market manipulators run operations with the organizational sophistication of the companies they target.
AI accelerated both sides.
In the hands of bad actors, it generates synthetic identities at scale, automates social engineering, and probes for vulnerabilities at machine speed. For defenders, it can absorb the manual work that drowns analysts and surface behavioral patterns no rule writer anticipated.
Risk understood in pieces is risk misunderstood entirely.
Risk pays no attention to organizational boundaries. A single bad actor can trigger signals across compliance, market surveillance, and fraud detection at once, and when those systems sit in separate departments, the institution sees only fragments. The most dangerous threats hide in the blind spots between teams.
When the problem changes in kind, the response must change in kind.
The frameworks designed for 2005 cannot be patched into adequacy for 2026. Institutions face a choice: rebuild the foundations of risk detection with systems designed for current conditions, or keep defending against evolved adversaries with inherited tools.