Frontier AI Models v Cybersecurity: 
Finding a path past the hype

What should I do?

• It should not take the emergence of frontier AI models to motivate a revisit of your organisation’s current cyber posture. It’s timely for management and boards to undertake a risk-aligned review of cybersecurity resilience and readiness measures, with frontier AI models front of mind. 
• Regulators expect boards (in line with their duties as directors) to maintain, at a minimum, sufficient understanding and literacy with respect to AI and cyber security to set strategic direction and provide effective challenge and oversight, including being responsible for setting risk appetite and overseeing risk management. 
• Do not run the wrong race or get distracted by the hype at the expense of good cyber hygiene. At this point in time, most of our adversaries are still attacking us with traditional techniques, including coming through the front door with compromised credentials or social engineering. 

To ensure your organisation is prepared, you should consider: 

	1. Strengthening the management of vulnerabilities  consider directing additional resources (including AI tools) to manage the incoming ‘patch wave' which is likely to result from the use of frontier AI models; be aware that existing approaches and timelines for testing and deploying patches are unlikely to be sufficient, as human-speed responses are inadequate against AI-speed attacks; and  consider and plan for legacy platforms critical to business operations.
	2. Focusing on good cyber hygiene fundamentals make sure you are running the right race. Most attacks do not turn on the use of AI enabled attack techniques; do not neglect current programs of work, noting traditional weaknesses, including compromised credentials, still prevail; and check that you have got the basics right and that your pace matches the heightened risk.
	3. Assessing the tools, including frontier AI models or AI harnesses which may assist on the defensive side interim cyber successes have been reported from companies using frontier AI defensively; and  AI tools will provide us with powerful defensive tools.
	4. Revisiting the risk allocation with your third-party software vendors  consider recalibrating existing contractual models for the AI-maximised threat landscape, including indemnities, warranties, liability frameworks, information security standards and notification obligations for cyber incidents and data breaches.
	5. Implementing a multifaceted ecosystem of cyber defence have an open mind to frontier AI models and cyber solutions, noting we may not have seen the last of the access suspensions, export restrictions, and broader concentration and economic risks.
	6. Using your organisation’s governance frameworks to test resilience in the face of frontier AI models  review and validate core controls; minimise attack surfaces; patch systems promptly;  implement layered, defence-in-depth architectures that assume breach; review third and fourth-party dependencies; prepare for incident response in any AI world; and  use AI for defensive purposes, including frontier AI models.