Government issues open letter to business leaders outlining AI cyber threats
The Government has written an open letter to UK business leaders, warning them of the rapidly evolving cyber risks posed by advances in AI systems. This follows an announcement that some new models could uncover weak cyber defenses at unprecedented speed.
The letter echoes another letter in the Financial Times by Richard Horne, CEO of the National Cyber Security Center, highlighting the accelerating pace of change in cybersecurity and urging organizations to raise their security baseline.
A recent analysis by the Department of Science, Innovation and Technology’s (DSIT) AI Security Institute (AISI) found that models such as Mythos are significantly more capable of cyberattacks than any previously tested. According to AISI’s latest report, Frontier model capacity is doubling every four months compared to previously every eight months.
The government recommends that businesses take the same steps to protect against AI-powered cyberattacks as they do against traditional cyberthreats. these are:
- Even at the top of your organization, you need to take cyber security very seriously. Boards should use the Cyber Governance Code of Practice.
- Businesses should use Cyber Essentials, a government-backed certification scheme, to protect against the most common attacks.
- Get free practical advice, training and guidance according to the NCSC. The Early Warning service is free to use and helps organizations consider what steps to take before an incident escalates.
You can read the open letter here, the NCSC blog on why cyber defenders need to prepare for frontier AI here, and the blog of NCSC Director of Homeland Resilience, Captain Jonathan Ellison, here.
TechUK’s reaction
The potential for AI to transform cybersecurity is not new. For years, the industry has anticipated the defensive benefits and risks associated with increasing AI model capabilities, and we have seen the steady development of standards and frameworks designed to mitigate the damage that businesses may face. What has changed is the speed and scale at which these vulnerabilities can be identified. This has understandably caused concern within government and should cause similar concern among business leaders.
From conversations with our members, it is clear that the journey to the frontier model has only just begun. We are seeing new attack surfaces emerge and evolve as rapidly as the models themselves. This shift has the potential to reshape how companies think about and implement cybersecurity standards. But importantly, business leaders can no longer afford to treat this as an abstract risk, and this could be a development that forces business leaders into thinking about business resilience.
If you would like to find out more about what techUK is doing with AI security, please contact us at annie.collings@techuk.org.
