UK NCSC and Five Eyes warn of accelerating AI-driven cyber risk
The joint advisory, co-signed by the NSA and CISA among six agencies, urged organisations to assume breaches will happen and to deploy AI defensively rather than wait for formal regulation.
- Security & misuse
- Notable
The UK’s National Cyber Security Centre, alongside its Five Eyes counterparts — the US National Security Agency and Cybersecurity and Infrastructure Security Agency, Australia’s Signals Directorate, Canada’s Communications Security Establishment and New Zealand’s Government Communications Security Bureau — published a joint advisory arguing that frontier AI was accelerating both offensive and defensive cyber capability faster than most organisations were adapting to.
The timeline is not years, it is months.
The agencies argued AI was lowering the barrier to entry for less-skilled attackers while increasing the speed and complexity of attacks from sophisticated ones, and that new categories of vulnerability, including AI-discovered zero-days, would keep emerging as the technology developed. Rather than treating cyber risk as a purely technical problem, the advisory framed it as a core business risk requiring board-level attention.
The recommendations were largely about basic preparedness rather than novel technical controls: reduce attack surface by limiting unnecessary access, accelerate patching cycles to match shorter windows between vulnerability disclosure and exploitation, treat legacy systems as strategic liabilities, mandate strong authentication, and test incident-response plans on the assumption that breaches would occur regardless of defences. The agencies also encouraged organisations to deploy AI tools of their own for defensive monitoring and vulnerability detection, positioning the technology as double-edged rather than purely a threat.
The warning arrived amid a live, contested debate over how far Chinese labs had actually closed the AI-cybersecurity gap with US developers — a dispute that played out publicly three days later over a Wall Street Journal report on Zhipu’s GLM-5.2.