Five Eyes: In months, AI will transform cyber attacks

The intelligence agencies responsible for signals intelligence (SIGINT) in five countries (US, UK, Australia, Canada, New Zealand) have signed a joint statement: they want businesses and political leaders to move quickly. Why? Because they believe that ‘frontier’ artificial intelligence (AI) models will radically alter cyber offense, and not in years, but months.

1What the warning actually says

The public statement by the so-called Five Eyes agencies is unequivocal in their assessment of the threat. “Advanced AI technologies could be used to bring down governments and companies — while simultaneously making it much simpler for others to do so,” they write. Attacks become faster and more complex; costs fall for ‘sophisticated’ cyber attacks. They also note that ‘frontier’ AI technologies have already been enabling less sophisticated threat actors to undertake operations that would have hitherto required much greater technical skills.

The intelligence agencies are also calling for a change in how we think about cyber security. In the past, cyber security has been seen as an IT issue, one that sits well below C-suite consideration. In their joint statement, they urge a change in approach: “Cyber risk should be considered a core business risk and a leadership responsibility”. That is a bold statement from five official security agencies who have signed a joint statement of concern.

2Why builders need to pay attention

If you are creating products with AI, there are two things to consider here. Firstly, the threat is real and growing rapidly. AI will make it much easier to find bugs, create believable phishing campaigns, and to automate previously ‘expert’ tasks. If you are collecting user data, then the ability for someone to write code faster applies equally to them probing your security.

Secondly, the services and APIs you use (AI vendors, cloud services, authentication) are being attacked with the same kinds of AI tools that you use to develop products. A previously expensive attack is made cheaper when it can be automated by AI to identify targets and conduct reconnaissance. Your supply chain risk is as real as your own.

When global intelligence agencies move their forecast of a threat from ‘years’ to ‘months’, it’s worth listening. This isn’t a case of five agencies getting together and issuing a statement without good cause. For businesses, it means that your current stance of reacting to breaches and escalating upwards is untenable: the agencies believe that you now have only weeks, not quarters, to prepare.