Five Eyes cyber security agencies statement
The Five Eyes cyber security agencies have jointly issued a statement warning that the rapid advancement of artificial intelligence (AI) is fundamentally reshaping the cyber threat landscape and demanding immediate action from organisational leaders.
The agencies emphasize that while AI presents significant opportunities to strengthen cyber defence, it is also enabling cyber criminals and nation-state actors to operate with greater speed, scale and sophistication. According to the statement, frontier AI models are expected to surpass current industry expectations within months rather than years, accelerating both offensive and defensive cyber capabilities.
Cyber Resilience Must Become a Business Priority
The Five Eyes agencies stress that cyber security can no longer be treated solely as a technical function. Instead, cyber resilience must be viewed as a core business risk and leadership responsibility, critical to operational continuity, market confidence and long-term organizational value.
Leaders are urged to:
Assess cyber risk, readiness and accountability across their organizations.
Prioritise foundational cyber security controls and best practices.
Empower cyber security leaders with appropriate authority and resources.
Remain actively engaged as threats and guidance continue to evolve.
The agencies warn that organizations that fail to act risk increasing operational disruption, financial losses and strategic disadvantage.
AI Is Accelerating the Threat Landscape
The statement highlights that AI is already reducing barriers for malicious actors, enabling faster exploitation of vulnerabilities and increasing the complexity of cyber attacks. As a result, the window between vulnerability discovery and exploitation continues to shrink.
At the same time, AI offers powerful opportunities for defenders to improve detection, response and resilience.
Key Actions for Organizational Leaders
The Five Eyes agencies outlined several immediate actions organizations should take to strengthen their cyber posture:
Reduce the Attack Surface
Limit unnecessary system access and external connectivity, and isolate systems that do not need to be publicly exposed.
Accelerate Patching and Updates
As AI shortens the time between vulnerability discovery and exploitation, organizations should prioritise security updates and reduce delays in patch management.
Address Legacy Technology Risks
Unsupported and outdated systems remain attractive targets for attackers and should be treated as strategic business risks rather than technical debt.
Strengthen Identity and Access Controls
Implement strong authentication measures, restrict access to critical systems and regularly review permissions.
Prepare for Cyber Incidents
Test response plans, train teams and assume breaches will occur. Effective preparation enables faster containment and recovery when incidents happen.
Secure-by-Design Must Become the Standard
The agencies reaffirm that secure-by-design and secure-by-default principles should become standard practice across technology development and deployment.
They also stress that resilience cannot rely on any single technology or solution. Defence-in-depth strategies remain essential as AI systems introduce new and previously unknown vulnerabilities, including potential zero-day threats.
Leveraging AI for Defence
Recognising that adversaries are already using AI to enhance their operations, the agencies encourage organizations to adopt AI-enabled security capabilities to improve vulnerability detection, software quality, threat monitoring and incident response.
The statement notes that success will not be determined by the number of security tools deployed, but by an organization's ability to implement strong cyber fundamentals, act decisively and integrate cyber security into overall business strategy.
A Collective Responsibility
The Five Eyes agencies conclude that cyber resilience is central to economic stability, operational continuity and public trust. They call on business leaders, government agencies and technology vendors to work together to address evolving AI-driven cyber threats.
The agencies reaffirmed the importance of international collaboration and information sharing, noting that the Five Eyes partnership remains committed to strengthening collective cyber security and protecting communities, organizations and critical infrastructure from emerging risks.