Frontier AI models’ growing capabilities demand that business leaders take immediate steps to harden their networks and overhaul their operating philosophies, the members of the Five Eyes intelligence-sharing alliance said on Monday.
“The evolving landscape of artificial intelligence (AI) is rapidly transforming cyber risk, and we must act swiftly to remain ahead,” the cybersecurity agencies of Australia, Canada, New Zealand, the United Kingdom and the United States said in a joint statement. “AI is not a future consideration — it is already here.”
Now more than ever, the nations said, cybersecurity “is a core business risk and leadership responsibility.” The governments urged corporate executives and board members to carefully oversee how their IT and security teams manage and protect their computer systems and to regularly test incident-response processes to ensure they work during an emergency.
The Five Eyes’ warning is the latest sign of growing alarm among Western nations about AI tools’ ability to find and exploit vulnerabilities. Those concerns recently prompted the Trump administration to ban Anthropic from offering its cutting-edge Mythos and Fable models to foreign users, which led Anthropic to almost entirely freeze worldwide access to those models.
“Frontier Al models are anticipated to exceed current industry expectations, fundamentally transforming both offensive and defensive cyber capabilities,” the Five Eyes nations said. “The timeline is not years, it is months.”
The Cybersecurity and Infrastructure Security Agency and the National Security Agency signed the statement on behalf of the U.S., along with the Australian Signals Directorate, Canada’s Communications Security Establishment, New Zealand’s Government Communications Security Bureau and the UK’s Government Communications Headquarters.
Recommendations cover secure by design, legacy systems
In addition to encouraging increased executive-level oversight of cybersecurity functions, the multinational advisory also detailed the specific processes and principles that companies should embrace in the era of AI-fueled cyber threats. The recommendations mirror what cybersecurity experts have been saying for decades.
Executives should focus on risk assessment and “foundational” security practices, the advisory said. They should also empower cybersecurity leaders with the necessary authority and resources to implement changes — and hold those leaders accountable for failures.
Organizations should embrace secure-by-design and defense-in-depth operating practices to maximize network resilience and avoid single points of failure, the Five Eyes members said.
The advisory listed five “practical actions” for businesses to take, including reducing their attack surface, patching more quickly, removing or isolating vulnerable legacy systems, improving identity management and testing responses to breaches.
“Success will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy,” the advisory said. “Those that do not will face growing operational and strategic disadvantage.”
