Keith Bulfin 
We are becoming increasingly sophisticated at detecting activity. We are becoming less certain about understanding intent.
At a recent cyber security and intelligence forum attended by professionals from technology, defence, governance, cyber security, and artificial intelligence backgrounds, a question was raised that generated considerable discussion:
If global illicit financial flows now exceed US$4.5 trillion annually, and we have more compliance officers, AML specialists, cyber experts, AI systems, governance frameworks, and regulatory controls than ever before, why do organised criminal groups continue to grow stronger and more sophisticated?
The answer was not immediately obvious. In fact, several highly experienced panellists openly acknowledged that they did not have a clear answer.
What followed was perhaps the most important part of the discussion.
There was broad agreement that organised criminal groups are adapting rapidly, while artificial intelligence is accelerating capability across almost every sector of society.
Unfortunately, criminal organisations are benefiting from the same technologies.
AI can assist with:
• automation
• pattern recognition
• predictive analysis
• fraud detection
• anomaly identification
• behavioural modelling.
These capabilities are valuable. However, organised criminal groups are increasingly using technology to improve their own operations.
They are becoming more agile. More distributed. More international. More difficult to identify. More capable of adapting to regulatory and technological change.
This creates a challenge that technology alone may not solve. Technology identifies patterns, but humans still need to interpret intent. This distinction is becoming increasingly important.
Most cyber systems, AML platforms, monitoring environments, and governance frameworks are designed to identify anomalies.
They identify what appears unusual. They generate alerts. They provide signals.
But sophisticated criminal systems increasingly understand these environments. They understand how organisations monitor activity. They understand how institutions share information. They understand how to operate across multiple jurisdictions simultaneously.
Most importantly, they understand how to fragment activity so that no individual participant sees the complete picture.
This is what I describe as the Operational Interpretation Gap – the gap between detecting activity and understanding the behavioural architecture operating behind it.
The challenge facing governments, financial institutions, regulators, cyber security professionals, and intelligence agencies is no longer simply collecting more information.
We already have enormous quantities of information – the challenge is interpretation. Understanding how transactions, behaviours, relationships, technologies, and incentives connect together into larger operational systems.
This becomes increasingly important when considering:
• organised crime
• terrorist funding
• cyber-enabled financial crime
• human trafficking
• digital assets
• sanctions evasion
• foreign influence operations.
In many cases, the transaction itself is not suspicious. The individual event is not suspicious. The risk sits within the broader architecture connecting multiple legitimate-looking activities.
This is why operational intelligence remains critically important. As artificial intelligence continues to evolve, the organisations that succeed will not simply be those with the best technology.
They will be those capable of combining:
• AI capability
• governance
• compliance
• operational intelligence
• behavioural analysis
• professional judgement.
Because while AI can identify patterns, sophisticated criminal systems continue to focus on something much older and much harder to measure: human behaviour.
Keith Bulfin is the founder of the Applied Financial Intelligence Programme and author of the bestselling book “Undercover”. His background includes work across global financial intelligence, organised crime investigations, illicit finance systems, and operational intelligence environments involving international agencies and investigations.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.