“AI is not a future consideration – it is already here,” the leaders said.

“It lowers barriers for malicious actors and increases the speed and complexity of attacks, shrinking the window between vulnerability discovery and exploitation ever more quickly. At the same time, AI offers powerful tools to strengthen defence.”

According to the Five Eyes call to action, organisations must be aware of the risks they face in the current landscape, be accountable, make foundational cyber security practices a priority, give cyber leaders the authority they need to act, and stay engaged with emerging threats and guidance.

Like many in the industry, the Five Eyes agencies said that cyber risk can not be considered a technical issue, but rather a core bore business risk and the responsibility of business leaders.

“Boards and executives should ensure cyber resilience is in place and works under pressure. It is not enough to have controls. Leaders must be confident those controls will perform during a real incident,” the call to action said.

“This requires reassessing long-standing trade-offs and using AI deliberately to strengthen defence – not just improve efficiency.”

The core principles leaders need to adopt are secure-by-design & secure by default standards, defence-in-depth, and an understanding that AI will contribute to a rise in zero-day vulnerabilities.

In addition, the agency representatives listed five key, practical actions for organisations to follow urgently:

1. Reduce your attack surface by eliminating unnecessary access paths, limiting external connectivity, and isolating systems that do not need to be exposed.
2. Accelerate patching efforts, as AI-driven threats are shrinking the window between vulnerability disclosure and exploitation, making delays increasingly risky.
3. Address legacy systems proactively, as unsupported technologies represent strategic liabilities that attackers can readily exploit.
4. Strengthen identity and access management by enforcing strong authentication, restricting access to critical systems, and regularly reviewing user permissions.
5. Prepare for incidents in advance by testing response plans, training teams, and focusing on rapid containment and recovery when breaches occur.

While AI may be a threat driver, the agencies said, it is, however, still a vital tool in network defence, and defenders must be able to move as quickly as their adversaries.

“Organisations that integrate AI tools into their security operations can detect vulnerabilities earlier, improve software quality, monitor unusual behaviour, and respond faster to incidents – reducing both the cost and impact of incidents,” the call to action said.

“Success will not come from having the most tools. It will come from getting the basics right, acting quickly, and integrating cyber security into core business strategy.”

Speaking to the urgency of the Five Eyes statement, Gary Barlet, Public Sector CTO at cyber security firm Illumio, said the idea that advanced models such as Anthropic’s Mythos would be a cyber silver bullet were “wishful thinking”.

“Whether it's Mythos, Fable, or the next frontier model, it isn't a matter of if these capabilities become widely available; it's when,” Barlet said.

“The Five Eyes warning is a wake-up call that AI is about to dramatically accelerate the speed, scale, and sophistication of cyberattacks, lowering barriers for adversaries and giving them capabilities that were once limited to highly skilled actors."

What concerns Barlet most, however, is the common attitude that organisations can “patch their way out of the problem”.

"We couldn't keep up before AI, and we certainly won't keep up after it. Attackers have always had the upper hand because they don't operate under the same constraints as defenders, and that's even more true in the age of AI,” Barlet said.

“It's time for organisations to stop treating a breach as a possibility and start treating it as an inevitability."