Time Is Running Out For Cyber Security, Warn Top Tech Firms
More than 100 major technology, financial and security organisations have warned that businesses and public bodies have only a limited window to strengthen their cyber defences before increasingly capable AI makes attacks faster, cheaper and considerably more difficult to contain.
Why Is The Warning Being Issued Now?
The open letter has been signed by organisations including OpenAI, Anthropic, Google, Microsoft, IBM, Mastercard and Visa, reflecting growing concern that advances in AI are beginning to change the economics of cyber crime.
As AI models become more capable, attackers can potentially use them to search for vulnerabilities, analyse unfamiliar systems, generate attack code and coordinate complex operations far more quickly than would previously have been possible.
The letter begins with an unusually direct warning: “We have a limited window to strengthen cyber defenses.”
It predicts that “in the coming months, AI-enabled cyber attacks will become far more widespread and sophisticated as models around the world become increasingly capable”, placing particular emphasis on essential services such as hospitals, water treatment plants and the infrastructure supporting the internet.
Existing Weaknesses Could Become Much More Dangerous
The problem is not necessarily that AI will invent completely new categories of cyber attack, but that it could become extremely effective at finding and exploiting weaknesses that organisations have tolerated for years.
For example, the letter highlights longstanding bugs, excessive permissions, misconfigured systems, insecure or unpatched software, weak authentication and technical debt in legacy infrastructure, warning that “status quo security won’t be enough”.
Many of those weaknesses are already familiar to cyber-security teams, but exploiting them has traditionally required significant time, expertise and effort. If increasingly capable AI agents can automate more of that work, flaws that were previously difficult or uneconomic to exploit could become attractive targets.
Recent testing has already provided some indication of what that could look like, with advanced AI agents demonstrating the ability to find vulnerabilities, combine weaknesses and perform multiple stages of an attack with far less human involvement than conventional hacking would normally require.
Why Critical Infrastructure Is A Particular Concern
Hospitals, utilities and other essential services face an especially difficult challenge because many depend on older technology that cannot simply be switched off while patches or upgrades are installed.
Their security teams may also have fewer resources than those protecting major technology or financial companies, despite the potentially serious consequences of disruption.
The letter argues that security teams, “particularly for critical infrastructure, have been historically under-resourced and need a surge in tools and resources”.
Where vulnerable systems can’t be patched without interrupting essential services, organisations are being urged to introduce and verify alternative safeguards, including stronger access controls, least-privilege permissions and multiple layers of defence.
AI Could Also Strengthen The Defence
Interestingly, the organisations behind the warning do not believe the answer is simply to restrict the use of AI. Instead, they argue that defenders should be given access to increasingly powerful AI capabilities as well.
According to the letter, “AI brings specialist skills to more defenders and makes core security tasks faster, cheaper and better”, potentially allowing organisations to identify vulnerabilities, prioritise patches and analyse attacks more rapidly.
Governments are being asked to give hospitals, water utilities, local authorities and other under-resourced organisations access to capable defensive AI, testing and practical support.
Frontier AI companies are also being asked to provide “responsible model access, significant funding, training, and hands-on support”, particularly for critical-infrastructure defenders that may otherwise struggle to keep pace with attackers.
Who Needs To Take Action?
The letter spreads responsibility for taking action across businesses, governments, technology suppliers, cyber-security companies and AI developers rather than suggesting that one group can solve the problem alone.
Organisations themselves are being urged to make cyber defence an immediate leadership priority, fix their highest-risk weaknesses and raise the security standards applied to technology they buy, develop and deploy.
Cyber-security suppliers are being encouraged to test defences continuously against the capabilities of frontier AI models, while governments are being asked to improve threat-intelligence sharing, fund defensive measures and coordinate incident response internationally.
The letter summarises the scale of the proposed response by saying that industry and government should “bring the full weight of their technology, resources, and expertise to this effort”.
What Does This Mean For Your Business?
For businesses, the most important message here is not that every organisation suddenly needs an advanced AI cyber-security platform, but that weaknesses which have been tolerated for years may become much easier for attackers to discover and exploit.
That makes familiar security work more urgent rather than less important, including patching vulnerable systems, removing unnecessary administrator privileges, strengthening authentication, replacing unsupported technology and testing whether backups and incident-response plans actually work.
Businesses should also review software produced with AI assistance, because faster development can create additional risk if generated code is deployed without proper security checks.
The opportunity presented by AI should not be overlooked either, with defensive tools increasingly able to help smaller security teams identify vulnerabilities and investigate suspicious activity more efficiently.
Perhaps the clearest warning from the letter is that organisations should not wait for AI-powered attacks to become commonplace before strengthening their defences. The technology is improving rapidly, while many of the weaknesses attackers will target are already sitting inside business systems today.
