Cyber Threat Hunting for Wealth and Asset Management Firms

Wealth and asset management. They’re businesses that run on intersecting circles of trust. Trust in a firm’s brand reputation. Referrals. Confidence in executives. Faith in advisors who understand clients’ financial needs and goals and thoughtfully chart a path forward.

AI has made these circles of trust easy to infiltrate, and inexpensive to hack.

A video call with a familiar advisory face is actually a conversation with a deepfake. A spoofed web site (one looking very like the firm’s own) tricks clients into divulging financial information. Documentation provided at onboarding to support a new client’s source-of-wealth narrative looks perfectly legitimate. But the new client is actually a money launderer.

AI-powered attacks now target wealth- and asset-management firms (WAMs), along with individual executives, advisors, vendors, clients, prospects, and the relationships among them. AI empowers these crimes at an industrial scale and helps criminals evade detection.

That’s why, according to Ernst & Young, “The rapid pace of digital innovation and the rise of artificial intelligence … have emboldened fraudsters, enabling them to execute increasingly sophisticated schemes targeting both firms and their clients.”[1] Fully 88 percent of industry executives interviewed for the company’s Wealth and asset management fraud insights: 3rd edition identified scams as the most pressing fraud threat, closely followed by account takeovers and wire fraud.[2]

The legacy technologies and manual cyber-hunting processes used by WAMs can’t keep up.

Security Operations Centers (SOCs) at many WAMs hunt too narrowly. They base investigations on internal sources of data. These include reports and logs generated by security information and event management systems (SIEMs), along with data generated by other systems designed to protect networks and devices, and to detect intrusion. Some WAMs also work with outsourced Managed Detection and Response providers for these services — depending on them for constant monitoring of pertinent IT components.

It’s not enough.

These systems only detect imminent or realized threats — wolf-at-the-door scenarios. These include an employee downloading proprietary data to sell on the dark web, or a criminal organization pinging a WAM’s network to probe for vulnerabilities.

In order to find the “wolf in the wild” — to detect potential risks before they become imminent threats — WAMs need intelligence-led cyber-threat hunting. The Babel Street Agentic Risk Intelligence Platform can help. Setting a new standard for threat detection, the platform finds and coalesces billions of pieces of publicly available information to provide WAMs with panoramic, up-to-the-second strategic threat intelligence, identity risk intelligence, and vendor risk intelligence.

The AI-powered cyber threat landscape for wealth management firms

AI-powered crimes take many forms and can exploit vulnerabilities in every arc of WAM circles of trust.

Let’s take vishing as an example. Vishing, or “voice fishing,” is a scam whereby criminals impersonate others in phone calls to coerce their victims into revealing sensitive information.

Harry is one such scammer. He calls a WAM client pretending to be an advisor. He calls an advisor pretending to be a client. He telephones a CFO pretending to be an Executive VP. And he telephones a WAM CIO pretending to be the CEO of a fintech on which the firm’s financial stack depends. (Since WAMs outsource much of their organizational technology, these types of impersonations can have particularly damaging, wide-ranging implications.)

AI both empowers and enhances these scams. Harry may be sophisticated enough to use voice cloning software to make himself sound like the Executive VP calling the CFO, or the advisor calling a client. Even if he’s not, he certainly uses AI to search for information on firms he wants to target. In these searches, AI may detect a photograph of a WAM’s Executive VP and CFO playing softball at the firm’s annual picnic. When posing as the VP, Harry can use this information to generate trust. All he has to say is, “Ever since that softball game, my shoulder has really been bothering me. I may be getting too old for this.”

Additional AI-powered crimes that can be conducted across an array of attack vectors include:

• Fraud via deepfake impersonations. Criminals use AI to create or alter video, images, or audio files to make it seem as if a person has said or done something he has not. How can deepfakes affect WAMs? Imagine a deepfake video depicting your CEO urging people to buy a stock or invest in a fund that your CEO does not actually endorse.

• Fraud via spoofed domains, portals, and solicitations. Criminals construct fake web site pages or asset-management portals to closely resemble those of legitimate WAMs. These culprits often use domains that are only a letter or so off from that used by a legitimate institution: OurFirm.com vs. OurFirn.com. Scammers may also email solicitations to clients or prospects using domains that look similar to yours, and that contain actual firm branding along with the names and photographs of trusted employees.

• Firm infiltration via synthetic identities. “Synthetic identities” are AI-generated personas created by combining authenticated personal data with fabricated information. They can affect WAMs in at least two significant ways. First, they make it easier for wrongdoers to enter the organization as employees. These criminals pose as job applicants when their real intent is to steal data. Second, synthetic identities make it easier for money launderers and others to pass know-your-customer screenings.

• Firm infiltration via vendor breach. WAMs typically work with an array of outside vendors and managed service providers for technological services, reporting functions, compliance services, and more. If one of those vendors is compromised by an AI-enabled attack, WAMs and their clients can be hurt. In a real-world example from 2026, a ransomware group targeted a vendor responsible for compiling bank customers’ tax documents. Personal data from nearly four million customers was exposed.[3]

• Attacks on executives and high-profile clients plotted through use of AI. Criminals may use AI to determine the likely location of executives and high-profile clients in order to violently extort money from them, abduct them for political purposes, disrupt annual meetings, or commit other malfeasance.

Why traditional cybersecurity can leave wealth management firms at risk

As noted above, WAM cyber-threat hunting efforts have traditionally relied on the detection of wrongdoing at the organization’s perimeter. No matter how sophisticated, these systems cannot detect AI-powered threats percolating in the wider world: new cyberattack methods developing in Nigeria or a disreputable Indian security company that has begun selling hacking capabilities to criminal “clients,” for example.

Due diligence processes meant to protect clients and the firm also fall short. Processes for investigating employees, clients, and vendors at onboarding and periodically thereafter are insufficient protection against a threat landscape that changes minute-by-minute. Point-in-time due diligence cannot protect against continuous risk.

The siloed nature of security and due diligence processes exacerbates WAM vulnerabilities.

Security and facility departments may take charge of executive protection. Spotting brand impersonation may be the purview of marketing teams or the Chief Information Security Officer. HR conducts background checks on new hires, while compliance teams handle client due diligence. As for client protection? It’s too often left completely unaddressed.

Still, SOCs often sincerely but erroneously believe their firms, executives, and clients are safe. Why? They take the absence of alerts provided by SIEMs, endpoint management systems, network-traffic analysis tools, or Managed Detection and Response providers as an absence of threat. But absence of these perimeter alerts does not equal security.

To keep pace with AI-powered threats, WAMs must reconsider security operations. They must broaden search parameters to detect wolf-in-the-wild threats.

The answer? Intelligence-led cyber threat hunting for wealth management firms

This discipline incorporates worldwide events and trends into hunting hypotheses and processes. It requires the use of agentic risk intelligence platforms to automate investigative processes and to surface signals appearing in publicly available information.

Babel Street, a global leader in mission-grade risk intelligence, has spent more than a decade providing the financial community with AI-powered insight based on world-class data. That experience and expertise have shaped the Babel Street Agentic Risk Intelligence Platform. The platform helps WAMs outpace dynamic threats by providing panoramic, up-to-the-second strategic threat intelligence, identity risk intelligence, and vendor risk intelligence. Our platform draws on data sources ranging from social media platforms and legacy media databases to established cybersecurity frameworks, CISA malware alerts, and threat indicators — including behavioral trends, malicious IPs, and phishing schemes — bubbling on the dark web. All told, Babel Street bases its insight on more than 100 billion searchable documents, published in more than 200 languages, and translated into the user’s language of choice.

To outpace evolving threats, our persistent search capabilities continuously scan this data for high-risk names, locations, date, geographies, and events — keeping search operations running regardless of whether someone is actively using them. Persistent search then records updates and changes, automatically appending this information to search terms. And those searches are secure. Babel Street protects investigators’ identities and firm infrastructure via a managed attribution capability that combines advanced anonymization, controlled attribution, and isolated research environments with tools for capturing and reviewing online investigative activity.

How intelligence-led cyber threat hunting benefits wealth management firms

With Babel Street, you can:

• Protect brand reputation. Find emerging signs of executive deepfakes, advisor impersonations, cloned credentials, and company credentials offered for sale on the dark web. Use social media monitoring and sentiment analysis to detect threats to the brand.
• Improve vendor vetting. Find evidence of foreign ownership, control or influence — including evidence designed to evade routine, questionnaire-based checks. Uncover hidden ownership. Better spot the type of vulnerabilities that leave a vendor open to hacking.
• Better vet prospective clients. Learn more about your clients, and about the real people behind client businesses, trusts, or foundations. Examine client networks, including associates, business partners, and related entities. Uncover adverse media, undisclosed litigation, and more.
• Improve pre-hire intelligence. Unmask synthetic identities. Uncover undisclosed business activity, adverse media, regulatory exposure, and network associations. Continuously identify risk throughout an employee’s term of employment.
• Detect attempts to defraud clients. Find deepfakes, spoofed domains, spoofed advisor profiles, fraudulent mobile apps, and fake wealth-management portals.
• Physically protect executives, employees, and clients. Monitor public data sources — including social media, traditional media, and dark web forums — to uncover targeting activity, detect early warning signs of violence, and assess executive travel and geopolitical risk. Spot the potential for disruption during annual general meetings, investor days, and other events.

Point-in-time investigations are no match for continuous risks. Your organization has worked hard to build the trust of its clientele and prospects. Work with Babel Street to not only maintain that trust but enhance it.