Hong Kong FinTech Week x StartmeupHK 2026 was held at the Hong Kong Convention and Exhibition Centre from November 2 to 6.

Fabian Astic, Global Head of Digital Economy and Managing Director at Moody's Ratings, said in an exclusive interview that in the AI era, cybersecurity risks require vigilance, and companies need to engage earlier in systematic risk screening.

For companies or institutions, what truly determines success is whether they can embed technology into their own business models and constrain it with a proper risk and control framework.

1. Cyber Attacks Have Increased Since the Rise of AI

Question: Moody's published an AI research report in September, assigning more weight to "more advanced AI scenarios." How does Moody's define "advanced"? What are the criteria for dividing these scenarios?

Fabian Astic: We indeed updated our 2025–2030 AI scenarios again in September this year, the third adjustment following last September and this May. The reason is simple — AI is evolving faster than expected.

Currently, we have lowered the weight of our base scenario "Moderate-Capability AI" from 70% to 50%, raised "Human-Equivalent AI" from 20% to 30%, and raised "AGI (Artificial General Intelligence)" from 10% to 20%.

Among these, "Moderate-Capability AI" refers to AI increasingly taking on enterprise tasks and even complex tasks, but with humans still deeply involved. "Human-Equivalent AI" means AI has reached the level of an average mid-level employee, capable of completing most valuable knowledge work and being widely adopted in enterprise environments. "AGI" is the most disruptive scenario.

It must be emphasized that raising the weights does not mean AGI is imminent. Looking ahead to 2030, AGI may not arrive, but the probability of its realization has indeed increased.

Although technological evolution remains highly uncertain, our core judgment remains unchanged: a company's true competitive advantage comes from "embedding AI into its own business model." Simply applying general-purpose AI tools makes it difficult to form sustainable differentiated advantages. Ultimately, the winners will be those companies that can embed AI into products and services while simultaneously establishing appropriate risk and control frameworks to manage AI risks.

Question: Another Moody's cybersecurity report in October pointed out that "AI is accelerating cyber attacks." What is the basis for this?

Fabian Astic: We believe AI is systematically amplifying cyber risk — meaning that even if a company does not use AI itself, it can still become a target of attacks driven by AI tools.

In the past, cyber attacks were mainly carried out by sophisticated attackers: they needed time to analyze targets, deploy operations, and people needed rest. Now, with AI agents involved, the entire attack chain has been compressed, and the number of potential attackers has increased.

One set of data illustrates the point: in 2020, the average time from vulnerability disclosure to exploitation was 745 days; by 2025, that number has dropped to 44 days — attackers are succeeding significantly faster than before. Meanwhile, Moody's analysis of approximately 9,500 rated issuers shows that the median remediation time for known exploited vulnerabilities is still 87 days. In other words, attackers operate on a daily basis, while companies still operate on a weekly or even monthly basis.

Question: You mentioned that more and more attacks are being transmitted to companies through "shared technology providers." What should the market be vigilant about?

Fabian Astic: Over the past few years, companies have delegated a large amount of business to third parties, which has improved operational efficiency, standardization, and even some cybersecurity practices. But the hidden danger that followed is: once a third party has problems, all companies relying on it may be affected, creating a high concentration of risk.

One set of data: among the 8,000 Moody's-rated issuers we observed, 19% of companies attacked in 2020 reported being affected by attacks through third-party security incidents; by 2025, this proportion has risen to about 39%, nearly doubling.

More and more companies are being attacked through shared technology providers, and the correlation of cyber risk within the financial system has accordingly strengthened. For credit, this means that third-party concentration is evolving from an operational issue into a source of credit risk and even systemic risk.

Question: Can we use AI to prevent these bad things from happening?

Fabian Astic: There are certainly ways to protect organizations from attacks, but the logic of defense has changed. The mainstream assumption of the past was: as long as the firewall is tight enough and outsiders cannot get in, the system is impenetrable. But today, it is hard to imagine an airtight "wall."

The new cybersecurity defense cycle must start earlier, beginning with suppliers and affiliated third parties, and running throughout the organization's entire lifecycle; beyond the firewall, there is also a need to continuously monitor the threat environment to achieve faster detection, faster remediation, and faster threat expulsion. The entire chain of protecting organizations from cyber risk is far more complex than it was a few years ago.

2. Stablecoin Credit Risks Require Comprehensive Assessment

Question: Moody's just published a stablecoin rating methodology this year and assigned its first stablecoin rating. What is the core risk assessment framework? (Moody's on October 27 assigned the U.S. dollar stablecoin RLUSD a long-term A2 and short-term P-1 rating, the first stablecoin to receive an investment-grade rating.)

Fabian Astic: We published our stablecoin credit rating methodology in March this year. The reason was that the market repeatedly raised the same question: stablecoins are increasingly being viewed as a potential settlement asset for the financial industry, with more and more transactions and instruments settled in stablecoins — the implicit question here is: does the stablecoin itself carry credit risk?

The answer is yes. Settling in central bank money, whether digital or not, carries almost negligible credit risk; but settling in stablecoins does — the redemption promise of a stablecoin is similar to a bank deposit, but the issuer is not a bank. It is a kind of "deposit-like promise": I give you 1 dollar, and you promise I can redeem on demand, and in full within a short period (such as a few days).

There are already many indicators and assessments about stablecoins in the market, but most revolve around market prices and market sentiment. What we need to do is return to credit fundamentals:

First, look at reserve assets — credit quality, market value risk, liquidity risk, and assess them under stress scenarios, because ratings must be a through-the-cycle, forward-looking benchmark, not a snapshot of the stablecoin's current situation.

Second, look at operational risk — the technology adopted by the blockchain, cyber risk, the legal aspects of the structure, the third parties involved in transactions and the consequences of their default.

Third, look at the overall structure — how cash flows are transmitted from the portfolio level to the investor level.

Fourth, look at governance — the governance of the stablecoin, and the legal and regulatory environment.

All elements will be discussed and voted on in the rating committee, just like any other rating, and then publicly announced.

Question: How do you view Hong Kong's stablecoins? How do they differ from U.S. dollar stablecoins in terms of credit quality? What still needs to be resolved for institutional investors to adopt this rating system more broadly?

Fabian Astic: For stablecoins that have not yet been publicly rated, I cannot comment. But one thing is very clear: Hong Kong has established a clear and relatively strict regulatory framework for stablecoins. As the stablecoin market further develops, market demand for independent credit assessments may also increase. As for institutional adoption, our role is to provide neutral, independent assessments — as the market increasingly adopts stablecoins, our ratings precisely help the market enhance transparency.

Question: Looking ahead two to three years, at the intersection of AI, cyber risk, and digital assets, what do you think is most important for global and Asian credit portfolios?

Fabian Astic: We focus on two things. First, agentic AI workflows will increasingly use tokens, including real-world asset (RWA) tokens — there is no tool better suited for AI agents to call than asset tokens. What needs to be closely watched is whether, as agents enter the digital financial ecosystem, the risk and control frameworks that supervise them are in place at the same time.

The second is quantum risk. Companies around the world are preparing for the quantum era, but "Q-Day" — the day when quantum computers can break mainstream cryptographic technologies — was once considered distant, and now, according to some industry estimates, may arrive within the next 8 to 15 years. Companies must begin preparing today: inventory all assets and cryptographic keys, and determine protection priorities. This work is large in scope, high in investment, and must start immediately. We see varying degrees of readiness among companies, with some clearly leading.