The thousand-franc cyberattack: repricing risk

A cyberattack used to require time, expertise, and coordination. Not anymore.

In April 2026, the UK AI Security Institute reported that Anthropic’s Claude Mythos executed a corporate-network intrusion end to end — a task that takes a skilled professional roughly twenty hours, now performed autonomously at a cost of a few thousand francs per attempt. Weeks later, OpenAI’s GPT-5.5 reached the same level of capability — and, unlike Mythos, is accessible through standard commercial channels.

AI attack capability is now fast, repeatable, and accessible. The cost of being attacked is not.

For Swiss and European financial institutions, average breach cost runs into millions of CHF or EUR — before any supervisory consequences under DORA, FINMA, or NIS2. The economic asymmetry is no longer abstract. It is industrial.

The cost of waiting is now measured in posture decay against a threat environment strengthening week by week. That is the business case for this session.