"firms consider adopting automated and AI-enabled defenses capable of operating at "comparable speed" to AI-driven attacks" [comparable speed]
The phrase 'comparable speed' directly names the mechanism: regulators are acknowledging that the attack-defense tempo gap is structural, not incidental, and that automation is the required response — not merely an option.
Reasoning from this article
This is not a sector-specific quirk; the same logic applies to any critical infrastructure where AI lowers attacker cost and compresses exploitation timelines. The regulatory move from 'improve controls' to 'match machine speed' represents a categorical shift in the baseline expectation for defensive posture. As frontier AI capabilities diffuse, this dynamic will replicate across energy, telecoms, and healthcare regulators. The UK financial authorities are effectively setting a precedent that human-in-the-loop security is no longer sufficient against AI-assisted adversaries.