Over the past week, I kept seeing headlines about the Five Eyes warning regarding AI and cybersecurity. After taking some time to read through the announcement and think about it, I realized something… The AI portion of the announcement actually wasn’t what stood out to me the most.
Don’t get me wrong, AI is absolutely changing cybersecurity, both for defenders and attackers. That’s not really up for debate anymore. But I don’t think that’s the biggest takeaway. What really caught my attention was who was delivering the message.
It’s not every day that the cybersecurity leaders from the United States, United Kingdom, Canada, Australia, and New Zealand come together and issue a joint public warning. When organizations with that level of visibility into the global threat landscape speak with one voice, I think it’s worth slowing down for a minute and asking ourselves why.
To me, their message wasn’t simply, “AI is coming.” It was something much bigger. Cybersecurity has officially become a business issue and not just an IT issue. And I think that’s a conversation every IT and Cyber executive team should be having.
This Isn’t a Technology Conversation Anymore
I’ve worked in IT for more than three decades, and for much of that time cybersecurity discussions centered around technology. Topics such as… What firewall should we buy? Do we have antivirus? Should we implement MFA? How do we protect email? How do we secure remote access?
Of course, those conversations are still important. But they’ve changed.
Today, I think the more important questions sound very different…
- If we experienced a ransomware attack tomorrow morning, how would the business respond?
- How quickly would we know something was wrong?
- Who would be making decisions?
- Could we continue operating?
- How long would it realistically take us to recover?
Notice something?
Those aren’t technology questions, they’re business questions.
AI Isn’t Creating New Criminals… It’s Making Existing Ones More Efficient.
One thing I think gets misunderstood is the role AI is actually playing. AI doesn’t magically create world-class hackers. What it does is make capable attackers much more efficient while lowering the barrier for everyone else. Things that once required hours, or even days, of manual effort can now be completed in minutes. Things such as:
- Researching an organization.
- Building convincing phishing emails.
- Writing scripts.
- Creating malware variants.
- Impersonating executives.
- Translating attacks into multiple languages.
- Scaling social engineering campaigns.
Attackers don’t necessarily have to become smarter. They simply have to become faster. And that changes the equation for everyone trying to defend against them.
And Another Thing… More Security Products Aren’t Necessarily the Answer
One thing I’ve learned over the years is that most organizations don’t suffer from a lack of security products. If anything, they have the opposite problem. They’ve invested in endpoint protection, email security, identity platforms, firewalls, SIEM, cloud security, backup platforms, threat intelligence, vulnerability scanners, and the list goes on.
The challenge isn’t usually that these tools don’t work. The challenge is that they often work independently. Then an incident happens… And everyone opens fifteen different dashboards trying to answer the same questions:
“What exactly is happening?”
That’s where I think our industry is headed. Not toward buying more tools, but toward making better use of the information we already have. Such as:
- Better visibility.
- Better context.
- Better correlation.
- Better decision making.
Because during a cyber incident, information without context doesn’t help much. It often just muddies the water, creating more noise at the exact moment you’re trying to find the signal.
Maybe We’ve Been Measuring Success the Wrong Way
Cybersecurity success is often measured by prevention. Did we stop the attack, block the malware, or did the firewall catch it?
Those are still important metrics. But I don’t think they’re enough anymore. The reality is that no organization is going to prevent every attack forever. Eventually, something gets through. It isn’t whether an incident occurs, it’s how quickly they recognize it. More importantly…
- How well they understand it.
- How effectively they communicate.
- And how fast they recover.
I feel that those are just as important as prevention itself.
If I Were Sitting in a Board Meeting…
I don’t think I’d spend much time talking about products. I’d spend time asking questions such as:
- Do we truly understand our biggest cyber risks?
- Have we actually tested our backups?
- How confident are we in our recovery plan?
- Have we practiced responding to a cyber incident?
- Does executive leadership know exactly what their role is during a major security event?
- Are we measuring resilience, or simply hoping our security tools never fail?
I believe those conversations are infinitely more valuable than debating the latest security appliance or the newest AI feature.
Once Again, Why I Feel The Role of IT Leadership Is Changing
I also think this announcement highlights something many of us have been experiencing for a while. The role of the IT leader, and especially the CISO, has evolved significantly. We’re no longer responsible only for deploying technology. We’re helping our organizations with …
- Understanding the business risk.
- Supporting executive decision making.
- Preparing for audits and compliance.
- Evaluating third-party risk.
- Developing recovery strategies.
- Planning for mergers and acquisitions.
- Helping shape AI governance.
- Building resilience.
That’s a much different job than it was just ten years ago. And honestly, I think it’s a much more important one.
One thing I’ve learned over the years is that technology almost always changes faster than most organizations do. AI is simply the latest example of this. Some organizations are still trying to solve yesterday’s security problems while today’s threat landscape continues to evolve.
The Five Eyes announcement shouldn’t create panic, it should create perspective. To me, the message wasn’t really about AI. It was about leadership, preparation, and resilience.
Technology, along with attackers, will continue to evolve. The organizations that will be most prepared won’t necessarily be the ones with the biggest security budgets or the newest security products. They’ll be the ones that know their environment, understand their risks, have practiced their response, and can make informed decisions when something eventually goes wrong. Because at the end of the day, cybersecurity isn’t really about protecting technology. It’s about protecting the business. And I think that’s the real message behind the Five Eyes announcement.
