AI Agents for Banking: Security Hardening Before You Ship

Meridian Trust, a $4.8 billion-asset regional bank running 46 branches on a Fiserv core, wanted its mobile app relaunch shipped before Q4: real-time account opening, instant virtual card issuance, and a new API layer sitting in front of the core banking system. The engineering team had the code ready in three weeks. What they didn't have was six weeks of security review capacity, because nobody on the team wanted to be the one who signed off on a defect in the core banking integration and then had to explain it to the state banking examiner. Meanwhile the controller's team was three weeks into the quarter-end close, and the fraud analytics lead was flagging that the scoring rules hadn't been retuned since before the last core migration, model drift nobody had capacity to look at with a launch on the calendar. That's the actual bottleneck for ai agents for banking: not writing the API, but producing security work an examiner will accept as evidence, with a paper trail, before the app goes live, without pulling the same three people off every other deadline the bank has that quarter.

Why ChatGPT and Copilot stall at your core banking security review

Ask ChatGPT or Claude.ai to review your core banking API for security gaps and you get a competent-sounding list: validate inputs, rotate secrets, add rate limiting. What you don't get is anything an examiner from the OCC, FDIC, or a state banking department would recognize as a completed control review. A generalist chatbot has no memory of your actual IAM policy graph between sessions, no visibility into which service accounts touch the core banking layer versus the marketing CRM, and no mechanism for producing the kind of dated, versioned artifact your compliance team needs to file next to the GLBA Safeguards Rule risk assessment. It answers the question you typed. It does not know that the question underneath your question is "will this survive an audit," because banking is the one domain where the deliverable isn't working code, it's defensible evidence that the code was reviewed properly.

Cursor and GitHub Copilot solve an entirely different problem, and a bank's engineering team knows it the first time they try to lean on either for this work. Autocomplete tools are excellent at finishing the function you're typing. They have no concept of least-privilege IAM design across a service account graph, no threat-modeling pass that asks what happens if the mobile app's new account-opening endpoint gets hit with a credential-stuffing attack from a botnet, and no output format that a security team can hand to an examiner. When a bank engineer asks Copilot to "secure this endpoint," they get a suggested header and a try/catch block. When the same engineer asks Warden the same question, they get a hardening spec that names the specific attack surface, the specific control, and the specific compliance mapping, because that's the actual job in a regulated environment.

Warden: security hardening that produces audit-ready output

Warden is the Tonone security specialist, and for a bank, its value isn't generic vulnerability scanning, it's that every skill produces output shaped like something your compliance and risk teams already know how to file. Warden doesn't start by writing code. It starts by reading the system: what secrets exist and where, which service accounts have access to the core banking layer, what the current IAM policy graph actually grants versus what it should grant, and where encryption and audit logging have gaps. That inventory becomes the baseline every subsequent hardening decision is measured against, which is exactly the sequence a bank's own security review committee expects to see documented.

Tonone's Warden hardens banking systems the way an examiner reads them, starting with a full inventory of IAM, secrets, and audit logging before touching a single line of hardening code.

Reconnaissance before touching the core banking layer

The warden-recon skill performs the full inventory: secrets management, IAM policy graph, dependency tree, auth flow, encryption at rest and in transit, audit logging coverage, and compliance gaps against whatever framework applies, GLBA Safeguards Rule, FFIEC guidance, PCI DSS if card data is in scope. For a bank, this recon step matters more than it would for a typical SaaS company, because "we didn't know that service account had write access to the core banking table" is not an acceptable answer during an exam. Running warden-recon before any mobile relaunch work starts means the engineering team knows the actual exposure, not the exposure they assumed, before a single API endpoint gets exposed to a new mobile client.

Threat modeling the new attack surface

Every new customer-facing endpoint on a core banking system is a new line item on the bank's threat model, and warden-threat produces exactly that: the assets at risk (customer PII, account balances, transaction history), the ranked threats against the new surface (credential stuffing on account opening, session hijacking on the mobile token exchange, enumeration attacks against the new card issuance endpoint), the mitigations for each, and the risks the bank is knowingly accepting versus the ones it's closing before launch. This is the artifact a risk committee actually reads before approving a launch date, and it's the artifact a generalist chatbot has no framework for producing because it has no concept of what "accepted risk" means in a regulated institution.

Producing the hardening spec

Once recon and threat modeling establish what's actually at risk, warden-harden produces the spec and implements it: auth patterns for the new mobile token exchange, security headers on every new endpoint, rate limiting tuned to the transaction patterns a bank actually sees (not generic API defaults), input validation on every field that touches the core banking write path, and a secrets management plan that gets the new API's credentials out of environment variables and into a proper vault. Then warden-audit runs the full pass, secrets, dependencies, IAM, auth, injection, XSS, HTTPS, rate limiting, public storage exposure, and warden-scan runs the automated SAST and dependency vulnerability scan underneath it, producing a structured report that names every CVE-matched dependency in the new API's stack by version number. Together, that's four artifacts a compliance officer can date, version, and file, not a chat transcript.

Mint, Tonone's finance specialist, is the second agent worth knowing here, because the pain point sitting right next to the security review is almost always regulatory reporting eating a week of the finance team's time every quarter. Mint's mint-report skill generates the monthly close package and variance analysis that a bank's controller team spends days assembling by hand from the core system and spreadsheets, and mint-board produces the board financial package with P&L, cash position, and variance against plan. Neither skill touches the mobile app's code, but for a bank running a relaunch and a quarter-end close in the same month, having Mint compress the reporting cycle is what frees up the finance team's attention for the launch itself.

Shield, Tonone's regulatory risk advisor, covers the third leg: before the mobile app's new account-opening flow goes live, someone needs to check it against GLBA, state money transmission rules, and whatever FTC disclosure requirements apply to a new customer-facing financial product. shield-recon surveys the product features and data flows for regulatory exposure, flagging the places where a new feature, like instant card issuance, quietly creates a new compliance obligation nobody scoped for. Warden hardens the system technically; Shield checks whether the feature itself is exposing the bank to a regulatory gap that no amount of encryption fixes.

Tonone's Warden produces the hardening spec, the threat model, and the audit report as separate dated artifacts, because a bank's examiner needs evidence of the review, not just the result of it.

Worked example: hardening Meridian Trust's core banking API

Back to Meridian Trust. The mobile relaunch team hands Warden the actual scope: a new Node.js API layer sitting between the mobile app and the Fiserv core, exposing seven endpoints, account balance read, transaction history read, instant card issuance, real-time account opening, KYC document upload, push notification token registration, and a session refresh endpoint. Warden runs warden-recon first and finds what the team suspected but hadn't confirmed: the KYC document upload endpoint writes to an S3 bucket with an overly permissive IAM policy inherited from a marketing microsite project two years earlier, and three of the seven endpoints have no rate limiting configured at all.

Warden Recon, Meridian Trust Mobile API
Stack: Node.js/Express, Fiserv core via SOAP gateway, AWS.
7 endpoints exposed. 2 critical findings, 3 high, 4 medium.

─────────────────────────────────────────────────────
 CRITICAL: KYC upload bucket IAM policy grants s3:* to a role
  originally scoped for a decommissioned marketing microsite.
  Compliance exposure: unauthorized read access to customer ID docs.

 CRITICAL: card-issuance and account-opening endpoints have no
  rate limiting. Credential-stuffing and enumeration risk confirmed
  in warden-threat pass.

 HIGH: session refresh token has 30-day expiry, no rotation,
  no device binding.

 HIGH: three dependency CVEs in the SOAP gateway client
  (warden-scan, CVE-2024-xxxx class, patch available).

 HIGH: audit logging captures request but not response payload
  on account-opening endpoint, gap for dispute resolution evidence.
───────────────────────────────────────────────

Hardening spec (warden-harden), 4-day implementation:
  Day 1: rescope KYC bucket IAM to least privilege, rotate role.
  Day 2: rate limiting on all 7 endpoints, tuned to observed
         transaction patterns (60 req/min per authenticated session).
  Day 3: session refresh moved to 15-min token + refresh rotation,
         device binding added.
  Day 4: patch SOAP gateway dependency, extend audit log to
         capture full response payload on write endpoints.

Output: warden-audit report + warden-threat model, dated and
versioned, filed against GLBA Safeguards Rule risk assessment.
Recommendation: launch blocked on Day 1 and Day 2 items. Days 3-4
can ship in a fast-follow within 2 weeks of launch.

That output does two things a generalist tool can't. First, it gives the engineering team a prioritized, time-boxed plan instead of a wall of undifferentiated findings, so the launch isn't blocked on four days of work when two days of work closes the actual launch-blocking risk. Second, it gives Meridian Trust's compliance officer a dated artifact that maps directly to the GLBA Safeguards Rule risk assessment she has to keep current, without her having to translate a chat transcript into examiner-facing language herself. The mobile app ships on schedule with the two critical findings closed, and the two remaining high findings ship two weeks later with their own dated warden-audit follow-up, which is the paper trail an examiner actually wants to see: found, prioritized, closed, documented. None of that required pulling the fraud analytics lead off the model retuning work or asking the controller's team to pause the close, because the security review ran as its own workstream instead of eating the same three people's calendars twice in one quarter.

Install and try

Tonone is free and MIT-licensed. Install it once and Warden, Mint, Shield, and the rest of the 100-agent team are available in your Claude Code session. You pay only for the Claude Code token usage during the work itself.