Five Eyes cyber agencies warn AI is reshaping attack risk in months, not years
Five Eyes cyber security chiefs jointly warn that frontier AI is transforming cyber risk on a timeline of months, urging leaders to act now.
What the agencies said
In a joint statement titled "The AI shift in cyber risk: why leaders must act now," the leaders of the Five Eyes cyber security agencies say they are "united in our call to action": the evolving landscape of artificial intelligence is rapidly transforming cyber risk, and organisations must act swiftly to remain ahead. The statement is signed by the heads of the Australian Cyber Security Centre, the Communications Security Establishment, the Government Communications Security Bureau, the National Cyber Security Centre, the National Security Agency, and the Cybersecurity and Infrastructure Security Agency. The agencies write that frontier AI models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities, and that "the timeline is not years, it is months."
The risk the agencies describe
According to the statement, AI lowers barriers for malicious actors and increases the speed and complexity of attacks, shrinking the window between vulnerability discovery and exploitation. At the same time, the agencies say AI offers powerful tools to strengthen defence, and that organisations integrating AI into their security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to incidents. The agencies stress that cyber risk can no longer be treated as a purely technical issue, calling it a core business risk and leadership responsibility that boards and executives must ensure their organisations are prepared to handle under real pressure.
Five actions for leaders
The statement lists five specific actions organisations should take: reduce the attack surface by limiting unnecessary system access and external connectivity; accelerate patching, since AI is shortening the time between vulnerability discovery and exploitation; address legacy systems, which the agencies call "strategic liabilities" rather than just technical debt; review and strengthen identity and access controls; and prepare for incidents before they happen by testing response plans and training teams. The agencies write that secure-by-design and secure-by-default must become standard practice, not an aspiration, and that resilience cannot depend on a single solution or technology.
Key facts
- The warning is signed jointly by the heads of six Five Eyes cyber security agencies, including the Australian Cyber Security Centre.
- The agencies say the relevant timeline for AI's effect on cyber risk is months, not years.
- Five recommended actions: reduce attack surface, accelerate patching, address legacy systems, strengthen identity and access controls, and prepare for incidents in advance.
- The statement warns that new and previously unknown vulnerabilities, including zero-day vulnerabilities, will emerge as AI systems evolve.
- The agencies frame cyber resilience as a business risk and leadership responsibility, not solely a technical issue.
Why it matters
The agencies frame this as a shared warning rather than a technical advisory aimed only at security teams: they write that success will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy, and that organisations which delay will face growing and avoidable risk. Because the statement comes jointly from the Five Eyes cyber security agencies rather than a single vendor, it carries weight as a call for boards and executives, not just IT departments, to treat AI-driven cyber risk as an active planning problem now.
Check your understanding
According to the agencies, what is the timeline over which frontier AI is expected to transform cyber capabilities?
What five actions does the statement recommend organisations prioritise?