A large majority of U.S. bank executives reported a rise in cyberattacks during the past year and are expanding security budgets in response, according to KPMG’s 2026 Banking Technology Survey. More than three-quarters of banks that participated in the survey saw an increase in attacks over the prior year. Nearly all respondents, 92%, said they are raising budgets to address cyber risk, and 84% are increasing spending specifically to counter risks introduced by artificial intelligence.
Those AI-driven risks are reshaping how banks think about defense. The top emerging threats cited were AI-introduced vulnerabilities in code (63%), deepfakes (62%), AI bots (57%), and securing agentic technologies (50%). To manage data security and compliance in the era of generative AI, banks reported leaning on regular audits (80%), robust security measures (79%), and outside experts (59%).
Technology has also become a central driver of dealmaking. More than three quarters of executives (77%) named it a key factor in merger and acquisition strategy. The most valued objectives in evaluating deals were acquiring data, analytics, or AI capabilities (67%), strengthening cybersecurity or risk capabilities (65%), accelerating core banking platform modernization (46%), and expanding digital or customer experience capabilities (45%).
The survey also flagged where integration goes wrong. The biggest M&A technology risks were core banking platforms (56%), cybersecurity and identity access management (55%), data architecture and integration (51%), and regulatory or risk technology (50%). Payments platforms, by contrast, were viewed as low risk at just 4%.
One data point worth watching for vendors: 53% of large banks named vendor concentration a top resiliency risk, behind only cloud providers at 69%. As banks tighten oversight of third parties, collection agencies and debt buyers should expect deeper due diligence on their own AI governance, data quality, and breach readiness. The clear takeaway is that AI is now both the threat and the defense, and the firms that supply banks will be measured against the same standard.
