AISpy Agencies Say AI Can Help Combat AI Cyber Risks. But Don’t Forget the Basics
Defenders should assume their adversaries already have access to AI on par with that used for cyber defense. Only by investing in strong foundations can they hope to escape the cat-and-mouse AI cyber arms race.
Cybersecurity agencies of Australia, Canada, New Zealand, the United Kingdom and the United States issued a call to action on Monday for cyber defenders. The message was clear: artificial intelligence (AI) is a powerful weapon for cyber attackers; defenders must act urgently to improve their cyber defenses.
There is much hype and uncertainty surrounding AI and cybersecurity right now. This latest statement comes little over a week since the US government caused frontier AI provider Anthropic to block access to Mythos and Fable, its most advanced AI technology, over fears they might be misused by foreign adversaries to attack US government systems.
In this torrid environment, it’s important for cyber defenders to look past the noise and prioritize what is truly important in protecting their systems.
A Call to Arms
The joint statement was issued by the heads of the national cybersecurity agencies of the Five Eyes. It warns that AI is dramatically shifting cyber risk and spells out how defenders must act to secure their organizations.
It notes how powerful AI is already helping adversaries carry out more sophisticated attacks more quickly.
One way this is happening is through automated vulnerability discovery and exploitation. No software is perfect. Adversaries leverage subtle design or implementation flaws in a system’s software to break into that system. They then take control of it and use it as a staging ground to launch further attacks.
This is why it’s so important for cyber defenders to keep up to date with deploying software patches. These are small modifications to system software that close off known vulnerabilities.
AI is enabling adversaries to find flaws orders of magnitude faster, as well as to work out how to exploit those flaws to carry out attacks.
For this reason, the Five Eyes statement warns that AI is dramatically shrinking the time between when a vulnerability is first discovered and when it is first exploited in an attack. Defenders can no longer afford to wait weeks before deploying software patches.
What Can Defenders Do?
The Five Eyes report notes cyber fundamentals are crucial and encourages organizations to use AI to boost defenses. But deploying AI without first investing in cybersecurity basics would be a mistake.
