“Breaches Will Occur. Preparedness Helps You Contain Them”: Five Eyes Releases Statement on AI and Cyber Risk
By: Cameron Abbott, Daniel Knight, Rob Pulham and Emre Cakmakcioglu
Western intelligence alliance Five Eyes has issued a strong warning to business leaders: AI-driven transformation of cyber risk is already here, and the time to act is now.
The alliance, comprising of domestic cyber security agencies from Australia, Canada, New Zealand, the United Kingdom and the United States of America, published a joint statement calling on boards and executives to treat cyber resilience as a core business priority rather than a technical consideration.
The shift in the threat landscape is attributed to increasingly capable AI models, which can rapidly detect vulnerabilities in cyber security infrastructure. While this benefits defenders, it equally enables malicious actors to exploit those vulnerabilities and simultaneously lowers the technical barrier to entry.
Five Eyes recommends the following while noting that these are urgent, but not novel priorities:
- Reduce your attack surface: Limit unnecessary system access and external connectivity.
- Accelerate patching processes: AI is shortening the time between vulnerability discovery and exploitation.
- Address legacy systems: Unsupported systems are easy targets.
- Review and strengthen identity and access controls: Limit who can access critical systems. Enforce strong authentication and regularly review permissions.
- Prepare for incidents before they happen: Test response plans, train and prepare teams, and assume breaches will occur.
For organisations, the Five Eyes statement is a timely reminder to review cyber resilience and ensure protection. Controls need to be appropriately tested, response plans need to be up-to-date and cyber security needs to be incorporated into core business strategy. And as the timeline being measured in months rather than years, there is little room for delay, and significant risk in waiting.
You can read the full report here.