What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
JPMorganChase uses AI-generated behavioral fingerprints and digital twins to help its cybersecurity analysts investigate unusual activity. The system looks for deviations from an individual’s normal work patterns, evaluates them in context and over time, and gives human analysts information to decide whether they are benign or a threat. Dark Reading reported in March 2026 that it monitored about 19,000 users; broader coverage was an ambition, not a completed rollout.
How the digital-twin threat-hunting workflow works
Andrew Plummer, JPMorganChase’s chief scientist for AI and machine learning in cybersecurity and technology controls, described the system at RSAC 2026, according to Dark Reading’s March 24, 2026 report. The report describes two related stages: a behavioral fingerprint identifies activity worth examining, and a digital twin analyzes flagged deviations with additional context.
1. Build a picture of ordinary work behavior
A digital fingerprint represents an individual’s work patterns and habits, including what Plummer described as their “casual and cognitive” aspects. The system compares activity with that person’s ordinary pattern rather than treating every deviation as equally suspicious.
Recommended Free Tools
2. Identify and assess deviations
When activity falls outside the person’s typical pattern, the AI can investigate it and estimate its potential maliciousness. It can also decide whether the activity should be flagged for future review. An unusual action is therefore a signal to assess, not proof of an attack.
#1 Best Overall
3. Use a digital twin to add time and context
The digital twin analyzes flagged anomalies, modeling how behavior might develop over time and considering wider circumstances that could explain a change. The report gives a major storm or geopolitical incident as examples of external events that might affect behavior.
4. Let analysts judge the alert
The system rates potential maliciousness; human analysts determine whether unusual activity is benign or a threat. Dark Reading’s demonstration also showed prescribed containment and mitigation steps, but the report does not establish that the system executes those steps autonomously.
What was monitored—and what expansion meant
Dark Reading reported that the system monitored about 19,000 users as of March 24, 2026. That is the reported user count, not a count of applications or AI agents.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchThe bank environment described in the report included more than 6,000 applications, with AI agents used by employees as well as agents built for applications. Plummer’s stated ambition was to extend coverage to all employees, AI agents, and the company’s applications. The report does not establish that this broader deployment was complete.
Can AI digital twins reduce false positives?
Reducing false-positive alerts while finding malicious activity early enough to prevent harm is JPMorganChase’s stated goal. Contextual analysis may help distinguish an explainable change from a more concerning deviation, but Dark Reading’s account provides no before-and-after alert counts, false-positive rate, detection accuracy, loss avoided, or independently measured results. The goal should not be read as a demonstrated performance outcome.
The report also does not name a commercial platform or implementation partner. It is an account of a conference presentation, not a technical specification or audited evaluation, so it does not establish enough detail to reproduce or independently assess the system.
How this example differs from other banking uses of AI and digital twins
Digital twin can refer to different kinds of systems. In JPMorganChase’s reported example, the focus is employee and AI-agent behavior for cybersecurity threat hunting. Other financial-sector examples address different problems:
| Example | Focus | What it does—and does not show |
|---|---|---|
| JPMorganChase, as described by Dark Reading | Behavioral cybersecurity threat hunting | Fingerprints model work patterns; twins analyze flagged deviations over time and in context. The account does not disclose measured performance or a named supplier. |
| BIS Project Danu | Financial-stability monitoring, especially natural-catastrophe risk | Describes real-time monitoring, scenario simulation, and data integration. It is not the employee-behavior system described at JPMorganChase. |
| Lloyds Banking Group’s Global Correlation Engine | Correlating alerts across security technologies | Lloyds described an engine for finding common attributes and likely genuine threats, and said it was developing the engine further using AI. It is a separate approach, not evidence about JPMorganChase’s architecture. |
The European Central Bank’s Banking Supervision said in 2026 that more than 85% of banks under European banking supervision use AI. That figure concerns AI use generally within that supervised population—not digital twins or the JPMorganChase deployment. In the same speech, the ECB noted that AI can strengthen operations, risk management, and IT security while also improving malicious actors’ capabilities. European Central Bank Banking Supervision
What the example means for bank cybersecurity
AI-assisted behavioral analysis is one possible layer in a wider security program, not a substitute for core controls. In an April 2025 speech, Federal Reserve Governor Michael S. Barr described defenses against emerging AI-enabled fraud and cybercrime that include identity verification, multifactor authentication, transaction monitoring, staff training, and information sharing. These are broader defensive measures; the speech does not identify them as components of JPMorganChase’s digital-twin system. Federal Reserve
Rank #4
UK authorities set out separate supervisory context in a May 15, 2026 joint statement from the Bank of England, FCA, and HM Treasury. It calls for regulated firms to maintain protective, detective, threat-containment, and cyber-response capabilities, including vulnerability triage and remediation, attention to third-party and supply-chain risks, access management, network security, data protection, and rapid response and recovery. This is UK financial-sector context, not a JPMorganChase-specific requirement or a prescription to use digital twins. Bank of England
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Questions to ask when comparing threat-hunting systems
The reported case leaves important details open. When assessing a similar approach, ask:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Quick Recap
- What is modeled? Is the system tracking users, agents, applications, infrastructure, or some combination?
- How is normal behavior defined? Does it account for role, work patterns, and legitimate changes in responsibilities?
- How do time and outside context affect the assessment? Can analysts see why a deviation was flagged and what context influenced its score?
- How are alerts scored and escalated? What triggers human review, and what happens when confidence is low?
- Who approves containment? Determine whether actions are recommendations, analyst-approved steps, or automated execution.
- What coverage and outcomes are disclosed? Look for deployment scope and measured precision, false-positive rates, detection, and response results, along with how those measures were evaluated.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
