A warning from the Five Eyes cyber agencies is not the sort of thing most small business owners will read with their morning coffee… But it should be.
The intelligence and cyber security agencies from the UK, US, Australia, Canada and New Zealand have issued joint advice on the way artificial intelligence is changing cyber risk.
The headline is simple enough: AI is making cyber attacks faster, more scalable and potentially more damaging.
The uncomfortable bit is that the advice is not really aimed at IT teams. It is aimed at leaders.
Business owners. Directors. Trustees. Senior managers. Anyone responsible for keeping an organisation running.
Because cyber security is no longer being framed as a technical problem. It is being framed as a business continuity problem, and rightly so.
A cyber incident is rarely just an “IT issue” once invoices stop going out, staff cannot access systems, customers start asking questions, and the phone starts ringing.
AI has changed the timescale
One of the strongest lines in the Five Eyes advice is:
“The rapid pace of frontier AI development means cyber risk assumptions can become outdated in months, not years.”
That is worth sitting with for a moment. Many organisations still think of cyber security in yearly cycles.
An annual review.
A renewal meeting.
Security awareness training.
A tick-box insurance questionnaire.
A policy document that gets updated when someone remembers it exists.
That pace is starting to look very slow.
The concern from the Five Eyes agencies is that AI can shorten the gap between a weakness being found and that weakness being exploited.
Attackers have always looked for unpatched systems, weak passwords, poor access controls and exposed services. AI does not invent those problems. It makes it easier to find and attack them at speed.
That is the real issue, not robots in hoodies, speed.
The basics are not basic anymore
There is a slightly awkward truth in the guidance – most of the recommended actions are not new.
Patch your systems.
Reduce unnecessary access.
Remove unsupported software.
Use strong authentication.
Prepare for incidents before they happen.
Anyone hoping for a silver bullet will be disappointed.
The message from the agencies is much more practical than that. Get the foundations right, because the cost of getting them wrong is rising.
That may sound dull, but it is also where many incidents begin.
Old VPNs.
Forgotten remote access tools.
Weak admin accounts.
Unsupported servers.
Cloud systems no one quite owns.
Backups that exist, but have not been properly tested.
These are not glamorous cyber risks. They are everyday business risks.
AI just makes them easier to exploit.
“Breaches will occur” does not mean giving up
The Five Eyes statement also says breaches will occur.
That phrase can make people bristle, especially when it is used badly by cyber security vendors.
We have all seen the lazy “it’s not if, it’s when” messaging. It often comes across as fear dressed up as advice.
But the point here is not defeatism. It is preparedness.
A business that has planned for an incident is in a very different position to one making it up on the day.
Who shuts down access?
Who speaks to customers?
Who calls the insurer?
Who restores the data?
Who checks whether the backup is clean?
Who decides whether the business keeps trading or pauses operations?
Those are leadership questions, not just IT questions.
The agencies warn that without preparation, incidents can escalate into “major operational and financial crises”.
That is the line business owners should notice.
AI tools inside the business need watching too
There is another side to this. AI is not only something attackers use.
Businesses are starting to use AI tools inside their own operations. Some are simple assistants. Others are more powerful agentic tools that can connect to systems, handle data, use APIs and take actions on behalf of people.
That creates a new question – what can those tools actually do?
If an AI tool can access files, send emails, connect to customer systems, trigger workflows or make changes, it needs proper controls around it.
Who approved it?
What data can it see?
Can it act without human approval?
Is its activity logged?
Can access be removed quickly?
Does it have more permission than it needs?
This is not about blocking AI.
It is about using it with the same common sense you would apply to any other system with access to business data.
If you would not give every member of staff full admin rights, do not give broad access to an AI tool just because it feels convenient.
What should businesses actually do?
The Five Eyes agencies set out five practical actions.
The first is to reduce the attack surface. In plain English, do not leave systems exposed to the internet unless they really need to be there.
The second is to speed up patching. If AI shortens the time between discovery and exploitation, slow patching becomes a bigger risk.
The third is to deal with legacy systems. Unsupported software is not just an IT headache. It is a liability.
The fourth is to strengthen identity and access controls. That means multi-factor authentication, sensible permissions, strong passwords, password managers, and regular reviews of who has access to what.
The fifth is to prepare for incidents before they happen. Not by buying a binder full of policies, but by testing the plan, checking backups, and making sure people know what they would actually do.
None of this is flashy, but that is the point.
Why this matters to small businesses
It would be easy to read a Five Eyes warning and assume it is aimed at banks, government departments and large enterprises.
Small businesses use the same cloud platforms, email systems, devices, websites, payment services and supply chains as everyone else.
They also tend to have fewer people to help when things go wrong.
A cyber incident does not need to be technically sophisticated to hurt a small business. A compromised email account, encrypted files, a fake invoice, a locked Microsoft 365 tenant or a failed restore can be enough.
This is where Cyber Essentials still has real value.
It is not perfect. It does not cover everything. It is not a magic shield.
But it does force businesses to look at the controls that matter most:
secure configuration
access control
malware protection
firewalls and internet gateways
security updates
For many small businesses, that is a sensible place to start. Especially if customers, insurers or supply chains are starting to ask for proof that cyber security is being taken seriously.
The real warning
The Five Eyes message is not that AI has made cyber security impossible.
It is that the margin for delay is shrinking.
Slow patching is riskier.
Weak access controls are riskier.
Unsupported systems are riskier.
Untested backups are riskier.
Incident plans that have never been rehearsed are riskier.
AI may be changing the threat, but the answer still starts in a familiar place.
Know what you have.
Limit what is exposed.
Patch what needs patching.
Control who has access.
Test your recovery.
Treat cyber security as part of running the business.
Not because a vendor says so, because the people who watch this stuff for a living are now saying the clock is moving faster.
