The ECB sets rates. Two US companies set the terms of Europe's financial defence

The European Central Bank sets interest rates for the euro area. Two American companies now set the terms of Europe's financial cyber-defence.

That sentence would have read as a provocation a year ago. As of this month, it is a description of the operating environment.

What Project Glasswing and Project Daybreak actually do

In April 2026, Anthropic launched Project Glasswing — a confidential programme in which its Mythos AI model searches for vulnerabilities hiding inside critical global software. Capabilities disclosed so far include:

• The discovery of a flaw in a cryptography library used by billions of devices worldwide.
• The identification of a twenty-seven-year-old vulnerability sitting undetected in core internet infrastructure.
• More than 10,000 critical vulnerabilities identified across the world's most important software systems within weeks of the programme's launch.

EU institutions have not yet been granted access to the programme.

In May 2026, OpenAI launched Project Daybreak, anchored by its GPT-5.5-Cyber model and focused on closing vulnerabilities fast and at scale. According to disclosures shared during our recent webinar, the programme has already:

• Identified and remediated a single exploit capable of disabling 880,000 of the servers on which bank websites run worldwide.
• Closed more than 500,000 vulnerabilities across 30,000 software systems.

Only this week have France, Germany, and ENISA — the EU's cybersecurity agency — been granted access to Project Daybreak. The remainder of the European Union is still in negotiation.

Switzerland is in neither programme.

This is not an abstract sovereignty debate. It is an operating reality with direct consequences for European financial institutions, their regulators, and their boards.

The current access map at a glance

Project Glasswing — Anthropic (Mythos)

• Capability focus: vulnerability discovery.
• EU access: not granted.
• Switzerland: not in programme.

Project Daybreak — OpenAI (GPT-5.5-Cyber)

• Capability focus: vulnerability remediation.
• EU access: France, Germany, and ENISA only (this week).
• Switzerland: not in programme.

Three converging governance failures no board has yet priced in

In a recent StratEdge-hosted panel — featuring co-founder Caroline Perriard, alongside Daniela Sozzi and Andrei Kucharavy, moderated by Bruno Guinchard — three converging governance failures across European and Swiss financial companies were diagnosed. Each is individually familiar to risk officers. Their convergence is what makes them newly dangerous.

1. Misjudgement

State-sponsored actors have reclassified the objective. The goal is no longer stealing money — it is destabilising economies. Companies still running a financial-loss model — calibrating defences against expected fraud or theft — face an existential exposure they have not yet modelled. The risk has moved from balance sheet to systemic relevance.

2. Exposure

The EU's Digital Operational Resilience Act (DORA) has made surviving a cyberattack a legal obligation for financial institutions, not a best-effort commitment. Non-compliance now translates into fines, supervisory intervention, and — at the limit — loss of operating licence. Switzerland is not under DORA directly, but its institutions operate inside a regulatory environment shaped by it.

3. Liability

Companies deploying AI security tools without the corresponding skills and governance face a new category of operational and regulatory risk. Automated tools acting on incomplete data make irreversible decisions at speed. The downside of a misconfigured AI defence is no longer a slower investigation. It is an autonomous action a board cannot reverse.

The most vulnerable targets in the European financial system

Two categories of institution carry disproportionate exposure.

Mid-sized banks

Their systemic role is high, their security margins are thinner, and they are numerous enough that the failure of one is not contained. Mid-sized banks are essential to SME economies across Europe — and they are the segment least equipped to absorb the speed and sophistication of state-aligned threats.

Fintech partners classified as technology vendors

These are unpriced financial exposures sitting inside the supply chain of larger institutions. A breach entering through a fintech vendor propagates instantly into the systems of the banks that have embedded it. The classification of fintechs as vendors rather than as critical financial infrastructure understates the actual exposure.

The question every board should be asking

The Swiss and European financial sector is now operating with two facts. The first is that the most advanced AI cyber-defence capabilities currently deployed against critical infrastructure are controlled by two non-European companies, and most of Europe — and all of Switzerland — does not yet have access to them.

The second is that the regulatory environment now treats resilience as a duty, not a discretion — through DORA, supervisory expectations, and evolving liability frameworks.

Between those two facts sits a window in which boards must decide whether to wait for sovereignty arrangements to mature, or to act on the resilience they can build today — through governance, training, vendor classification, supplier auditing, and the disciplined deployment of the AI security capabilities they currently have access to.

Frequently asked questions

What is Project Glasswing?

Project Glasswing is a confidential Anthropic programme launched in April 2026, in which the company's Mythos AI model searches for vulnerabilities hidden in critical global software. Access is currently limited to a small number of trusted organisations.

What is Project Daybreak?

Project Daybreak is an OpenAI programme launched in May 2026, anchored by the GPT-5.5-Cyber model and focused on closing software vulnerabilities at scale. Initial EU access was granted this week to France, Germany, and ENISA.

Is Switzerland part of either programme?

No. As of publication, Switzerland is not in Project Glasswing or Project Daybreak.

What is DORA and why does it matter now?

The Digital Operational Resilience Act (DORA) is the EU regulation that makes cyber-resilience a legal obligation for financial institutions. Non-compliance can lead to fines, supervisory intervention, or loss of operating licence.

Who is most exposed in the current environment?

Mid-sized banks essential to SME economies, and fintech partners classified as technology vendors rather than as critical financial infrastructure, carry the highest unpriced exposure.

Watch the full analysis

The complete webinar has been edited into three ten-minute episodes:

• Part 1 — The AI threat to finance: trust and governance → https://www.youtube.com/watch?v=jNZIMZV2LxY
• Part 2 — Building cyber resilience and business continuity → https://www.youtube.com/watch?v=i3f2XwA27D0
• Part 3 — DORA, AI accountability and evolving regulators → https://www.youtube.com/watch?v=ELswvGZvcio