How Cyber Risk Quantification Is the Key to Navigating the New NYDFS AI Requirements

Financial companies must prove security against cyber attacks powered by artificial intelligence

by Jacqueline Lebo

As the digital world expands, so do the risks and regulatory demands. In a recent guidance letter, the New York Department of Financial Services (NYDFS) informed regulated companies how it expects them to adapt the stringent risk management requirements in the NYDFS Cybersecurity Regulation (Part 500) to the new threats introduced by artificial intelligence – both AI wielded by attackers and generated by the companies’ own use of AI. 

But here’s the real kicker: these regulations demand that companies not only secure their networks but prove they are securing their networks. Or as Part 500 says, organizations must demonstrate specific  “criteria for the evaluation and categorization of identified cybersecurity risks or threats” and how they will be mitigated or accepted. 

This is where cyber risk quantification shines. If you’re in the financial sector—or simply want to protect your organization’s assets in a measurable way—it’s time to seriously consider how quantifying cyber risk can be your ace in meeting these requirements. Let’s dig in.

Why the NYDFS is Laser-Focused on Cyber Risk Quantification

Let’s face it: the old-school approach to cybersecurity was to implement a blanket set of controls and hope for the best. But in 2024, hope isn’t enough. Financial institutions are targets, and NYDFS knows that, in a rapidly evolving cyber landscape, regulators and companies alike can’t afford to operate in the dark. 

By requiring organizations to assess cyber risks in clear, quantifiable terms, NYDFS is pushing the industry toward a future where companies understand their vulnerabilities in precise financial language.

How Cyber Risk Quantification Aligns with NYDFS Requirements for AI

NYDFS has made it clear that when it comes to AI, “black-box” systems won’t cut it. They want organizations to not only deploy AI but to measure its effectiveness in addressing cyber risk—meaning they want clarity, transparency, and continuous risk assessment. Here’s where cyber risk quantification enters the scene as the essential tool for bridging AI and compliance.

Imagine you’re using a new AI system internally to increase worker productivity throughout the enterprise.  Along with that you have deployed some additional controls to secure this new technology and established a governing body to approve expansion of this use case. 

That’s impressive—but if you can’t measure the risk reduction it’s achieving, regulators may view your efforts as insufficient. Cyber risk quantification tools translate these AI-powered insights into financial metrics that answer critical questions: 

• How are these controls reducing risk exposure to AI system vulnerabilities? 
• How much financial exposure do they represent? 
• What’s the ROI of our new AI control set?

Turning Insights into Dollars: Why Financial Quantification Is Game-Changing

Let’s get real about what “quantification” means in this context. This isn’t just about assigning a risk score; it’s about measuring potential losses in dollars and cents. When your board, executives, and NYDFS auditors ask what’s at stake, cyber risk quantification allows you to answer in the language they care about: business impact.

With SAFE, you can translate your new AI systems into scenarios with business impacts to 

• Understand how new risks like training-data poisoning stack up against your existing risks such as ransomware
• Compare AI controls implementation versus other cybersecurity controls to understand the risk impact of your new control stack.  
• Not only cover the access controls and such that NYDFS mentions but your entire control stack’s risk.

AI system risk scenario analysis on the SAFE One platform 

We developed the SAFE One platform’s SAFE GenAI Risk Module to offer: 

• Tailored Risk Insights specific to an organization’s AI use cases, with targeted risk assessments and mitigation strategies.
• Real-Time Risk Visibility with continuous monitoring of AI-related threats and vulnerabilities, through the Live Threat Center module
• Comprehensive Risk Quantification. By assessing the likelihood and potential business impact of AI risks, SAFE helps prioritize resource allocation effectively

Compliance Isn’t the Only Reason to Care About Risk Quantification

Yes, the new NYDFS rules are a wake-up call, but meeting the minimum isn’t enough. In a world where cyber threats are evolving faster than regulations, quantifying your risk is crucial for making strategic, data-driven decisions. Here’s why:

1. Justify Your Security Investments: When budgets are tight, it’s hard to justify spending without data. Quantification turns abstract threats into concrete numbers, proving the value of robust defenses.

2. Plan for Future Risks: Cyber risk quantification helps organizations anticipate probable losses and build an agile security posture that evolves alongside new threats. It’s a crystal ball for the financial side of cybersecurity.

3. Build a Cyber-Resilient Culture: When everyone—from the C-suite to the compliance team—understands cyber risks in financial terms, the whole organization starts to prioritize security in more meaningful ways.

Looking Forward: Embracing Quantification to Get Ahead of Compliance

The truth is, NYDFS requirements won’t be the last word in cybersecurity regulation. Federal agencies, industry organizations, and international bodies are all moving toward a world where companies must prove—not just promise—that they’re managing cyber risks.

At Safe Security, we believe that cyber risk quantification is not only the path to compliance but the foundation of a proactive, resilient cybersecurity strategy. Whether it’s meeting the latest NYDFS requirements, protecting customer data, or securing your organization’s financial future, quantifying cyber risk is the key to building a defense that stands the test of time.

It’s time to ask yourself: Are you ready to meet the new demands, or will you let your organization remain in the dark? Quantify now or pay later—the choice is yours.

See how Safe Security can introduce your organization to cyber risk quantification. Schedule a demo.