Sixty AI vendors. Two hundred and twenty banks. One compromise can turn into losses that look, from the outside, like a run on the banking system.

That is the central finding of a new paper by Alex Leytes. Banks and large enterprises have spent two years buying fraud screening, credit decisioning, anti-money-laundering triage, and customer analytics from a handful of shared AI vendors. Efficiency went up. So did concentration.

The paper models what happens when one of those vendors is compromised. The damage does not stay with the vendor. It travels through operational links, then informational links, then financial links, until it surfaces as balance-sheet loss.

Why This Paper Matters

Boards already understand counterparty risk. They reason about it every quarter when a large supplier fails or a clearing house wobbles. What they do not yet have is that instinct for AI vendors.

The AI services banks depend on are not commodities sitting on a shelf. They are shared. A fraud-screening model that 40 institutions rely on is, functionally, a single point of failure with 40 dependents. When it degrades, whether from an attack or a bad update, the degradation is correlated across every institution using it.

Supervisors have been circling this without a quantitative handle on it. This paper gives them one. It argues that cyber concentration among AI vendors is a first-order financial-stability issue, not an IT footnote. For any company running an AI Assessment for companies in a regulated sector, that reframing matters. Vendor concentration stops being a procurement line item and becomes a risk-register entry next to your credit exposure.

Methodology, Explained Simply

Think of the banking system as four stacked floors. On the ground floor sit the AI vendors. Above them, the banks that buy from them. Above the banks, a web of loans they hold to each other. On top, the real economy: customers, accounts, and the businesses that depend on all of it.

A shock enters at the vendor floor and climbs. First it disrupts operations: a fraud model flags the wrong transactions, an AML system goes quiet, a credit score drifts. Then it becomes informational, as institutions lose confidence in each other’s outputs. Then it becomes financial, and losses land on the balance sheet.

The engine is called CFC-Prop. It is a clearing model, which just means it asks one question over and over: given this shock, who owes what to whom, and who can still pay? It runs that across 60 vendors, 220 banks, and 1,400 interbank exposures, day by day. Stochastic simply means the simulation runs many times with different random draws, so the output is a distribution of outcomes, not one clean number.

The second half is the practical half. The authors train CFC-GNN, which watches vendor incident telemetry and the shape of the network to answer a supervisory question: which vendors, if hit today, would cause the worst cascade? It reaches AUROC 0.82, meaning it separates high-cascade-risk vendors from the rest reliably, and AUPRC 0.60, which matters because true cascades are rare and a naive model scores near zero there.

Results and Practical Insights

The most useful result is not the classifier’s score. It is where the losses come from. Split vendors by criticality and system loss concentrates overwhelmingly in a small set of top-critical providers, with the tail reaching the trillion-dollar range in the worst cases. Mid- and low-critical vendors contribute almost nothing.

Then there is patching, and this part I did not expect. How fast a compromised vendor gets patched dominates the severity of the outcome. A short remediation delay does not shift losses slightly upward. It changes the shape of the tail. Patch latency is not operational housekeeping. It is a lever on your worst-case balance sheet.

Together, the two findings tell you where to spend attention. Find your top-critical shared vendors. Measure your exposure to each and how fast you could remediate. Watch their incident telemetry instead of waiting for loss to appear, because by then the window has closed.

What This Means for Your Chief AI Officer

A Chief AI Officer is usually measured on delivery: how many models shipped, how much cost came out, how fast the org moved. This paper suggests a second mandate arriving quietly. Someone has to own AI vendor concentration as a risk.

That owner needs three numbers ready before the next board meeting. How much of critical operations depends on your top vendors. How long their failure would take to recover from. And whether you watch their telemetry or only their invoices.

Key Takeaways for Finance and Risk Leaders

Thanks to All Authors