"The rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years," the leaders of intelligence agencies from the Five Eyes nations warned, and their message is plain: get the basics of cyber resilience right now or face attacks that can cascade into ruinous operational and financial crises.
Five Eyes intelligence leaders: urgency, inevitability, and business responsibility
The intelligence chiefs from Australia, Canada, New Zealand, the USA and the UK issued strongly worded advice stressing that frontier AI will both accelerate threats and change the timetable for risk. "While AI will help us improve cyber defence over time, it also accelerates the speed, scale, and sophistication of cyber threats," the advisory says, adding that "Frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities. The timeline is not years, it is months."
They make a pointed governance claim: "Cyber risk can no longer be treated as a purely technical issue... This is a core business risk and leadership responsibility." The chiefs do not promise prevention; instead, they insist preparedness to contain inevitable breaches — "Breaches will occur. Preparedness helps you contain them quickly and prevent escalation into major operational and financial crises."
The four organisational priorities the spies want leaders to adopt
- Understand and assess risk, readiness and accountability — identify who is responsible, what the gaps are, and how ready operations truly are.
- Prioritise foundational cybersecurity practices and controls — return attention to fundamentals rather than chasing only novel defences.
- Empower cyber leaders with authority and resources — give security leaders the remit and budget to act decisively.
- Stay actively engaged as threats and guidance evolve — maintain continual attention to changing guidance and adversary capability.
The advisory calls these priorities "not new," but insists they are "now urgent to reduce not only technical risk, but also operational, financial and reputational exposure."
Five immediate technical actions the advisory lists
- Reduce your attack surface: limit unnecessary system access and external connectivity; question whether systems need to be exposed and isolate those that do not.
- Accelerate patching processes: "AI is shortening the time between vulnerability discovery and exploitation," so prioritise security updates, particularly for operational systems with long update cycles.
- Address legacy systems: unsupported systems are described as strategic liabilities, not merely technical debt.
- Review and strengthen identity and access controls: limit who can access critical systems, enforce strong authentication and regularly review permissions.
- Prepare for incidents before they happen: test response plans, train teams, assume breaches will occur and focus on fast containment and recovery.
"It is not enough to have controls," the chiefs warn. "Leaders must be confident those controls will perform during a real incident. This requires reassessing long-standing trade-offs and using AI deliberately to strengthen defence — not just improve efficiency."
Anthropic's Mythos revelation and the catalyst for renewed worry
The advisory comes against a backdrop where interest in AI-enabled offensive tools spiked after Anthropic revealed the existence of its Mythos model. According to the advisory's account, the company "hid it behind a regwall lest criminals use it to swiftly slice holes in important software." The intelligence leaders note it has been "a couple of years" since it became apparent that generative and agentic AI can fuel "new and unusually potent cyber-attacks," and say recent events have accelerated the timetable for concern to months rather than years.
What this means for technologists, policymakers, and enterprise leaders
- Technologists and security teams: the advice stresses testing controls under realistic incident conditions, reassessing trade-offs, and integrating AI into security operations to "detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to incidents."
- Policymakers and regulators: the intelligence chiefs reframed cyber risk as a leadership and business issue, signalling that guidance and oversight should account for operational and financial exposure, not only technical compliance.
- Enterprise leaders and procurement teams: the advisory directly addresses "leaders" and lists concrete, urgent steps — from shrinking attack surfaces to accelerating patching and replacing unsupported systems — that senior management must prioritise now.
The Five Eyes intelligence leaders have offered a blunt, actionable checklist: shore up basics, empower cyber leaders, and test resilience continuously while using AI deliberately to bolster defence — not merely to cut costs. They close with a reminder that preparedness, not hubris, is the hedge against escalation into "major operational and financial crises."
