Publication date: 17 October 2026
G7 finance leaders have agreed to conduct tabletop exercises focused on cyberattacks enabled by artificial intelligence. The move is modest compared with new regulation, but strategically important: it tests whether governments and financial institutions can coordinate under pressure rather than merely agree that the risk is growing.
Japan’s finance minister, Satsuki Katayama, announced the plan during the IMF and World Bank meetings in Bangkok. It builds on work by the G7 Cyber Expert Group, which has already developed principles for cross-border exercises, incident management and information sharing.
The immediate concern is not that AI creates an entirely new category of cyberattack. It can accelerate existing tactics—finding vulnerabilities, producing convincing social engineering, adapting malicious code and coordinating activity across targets. Agentic systems also introduce the possibility that automated tools exceed their authorised objectives or behave unpredictably.
Exercises reveal failures that policy papers cannot
A tabletop simulation places officials and executives inside a constructed incident and forces them to make time-bound decisions. Participants must determine who has authority, what information can be shared, when the public should be warned and how essential services continue while the cause remains uncertain.
Those questions are especially difficult in finance. A cyber incident can move across banks, payment systems, cloud providers and national borders faster than formal diplomatic channels. One institution may see anomalous activity without knowing whether peers are affected. Governments may possess intelligence they cannot immediately disclose, while premature attribution can escalate a crisis.
AI makes scenario design more demanding because attackers can alter tactics quickly. Exercises should therefore test not only a single breach, but changing evidence, false signals and simultaneous disruption at third-party providers. They should also include communications teams, supervisors and senior decision-makers, not only technical specialists.
Success is measured after the simulation
The value of the G7 initiative will depend on what happens after each exercise. Participants need agreed findings, named owners for corrective actions and deadlines for fixing gaps. Otherwise, the event risks becoming proof of participation rather than preparedness.
The group should also clarify how lessons reach institutions outside the largest economies. Global finance depends on correspondent banks, payment networks and technology suppliers operating in many jurisdictions. A defence plan concentrated in G7 capitals may miss the weakest link through which an incident spreads.
For corporate leaders, the announcement is a prompt to review their own exercises. Boards should know who can isolate systems, approve service shutdowns, contact authorities and communicate with customers. Recovery plans must account for compromised credentials, unavailable cloud services and uncertainty about whether AI-generated evidence is genuine.
Warnings establish awareness; exercises test capability. By choosing joint simulations, the G7 is acknowledging that resilience depends less on predicting the exact next attack than on building institutions able to make coordinated decisions when prediction fails.