The provider of essential database governance solutions for many of the world’s top financial services organizations, Liquibase has published an executive guide to help financial institutions modernize and secure one of the last major, “mostly manual” control gaps in enterprise technology delivery: database change.
Research for The Financial Services Playbook for Governed Database Change was conducted across hundreds of financial services engagements spanning enterprise banks, regional institutions, credit unions, global insurers, payment processors, fintechs, and capital markets firms.
The real AI risk for financial services organizations isn’t the model – it’s the database.
Ryan McCurdy notes that Mythos-class AI has turned autonomous agents into an attack surface that can independently scan, chain, and exploit weaknesses across applications, infrastructure, and databases at machine speed. This effectively compresses the gap between discovery and attack in global banking systems.
Financial institutions are over-invested in model and application-layer controls while leaving the database, where AI-driven decisions are persisted and reconciled, as the least-governed and least-prepared layer for autonomous interaction.
In this new threat model, the primary risk is not just data exfiltration but silent state corruption – schema changes, data mutations, and transaction updates that appear legitimate while undermining ledgers, risk models, and customer records.
When AI agents can manipulate both activity paths and logging, manual tickets and ad hoc scripts are no longer sufficient to prove who changed what, when, and under which controls, putting SOX, PCI DSS, SOC 2, and DORA compliance at direct risk.
Key takeaway: while financial services organizations focus on AI models, Mythos‑class attackers focus on their databases.
Every other step in your software delivery pipeline has been automated, secured, and made auditable. Application code flows through version control, automated testing, policy enforcement, and governed deployment. Infrastructure is provisioned through code. Your database changes are still manual.
…The process looks like this: a database change is authored, routed through a ticket or shared workflow, and left waiting in a queue… days later, a DBA picks it up, reviews it, and executes it directly in production. There is no automated policy check. No reliable rollback plan. No tamper-evident approval record. The only documentation is a ticket that may or may not capture what controls were applied.
Among key findings:
- The problem is both structural and universal. Manual database change execution and database administrator bottlenecks are the sector’s baseline, not merely a maturity problem at lagging organizations.
- Compliance is the accelerant. SOX, PCI DSS, SOC 2, and DORA are driving purchase decisions. When auditors flag deficiencies, budget materializes.
“Financial institutions are entering a phase of AI adoption under a perilous assumption: that governance frameworks built for human-driven systems can simply be extended to autonomous agents,” said Chris Steffen, Research VP, Enterprise Management Associates. “That assumption is now clearly outdated. Governance that ends too early is a crucial misstep, one that leaves databases exposed to a kill chain that’s now moving with unprecedented speed and lethality.”
Playbook chapters walk readers through the operational realities financial institutions face today, and provide a practical maturity path for modernizing.
- The governance gap: why database delivery remains structurally different from application delivery
- How governance failures create operational, audit, and regulatory exposure
- The evolving role of DBAs, platform engineering, and compliance teams
- An eight-principle target operating model for governed database change
- A phased rollout strategy covering pilot, platform, and enterprise adoption
- A framework for evaluating build-versus-buy governance approaches
- Metrics financial leaders can use to justify modernization investments
- The impact of AI-generated SQL and hybrid cloud database environments on governance strategy
