“AI is going to take over the world!” We’ve heard it all before, but according to some of the world’s top cybersecurity agencies, this particular future has already arrived, and it’s moving a lot faster than most governments and businesses can keep up with.
Their message is simple: artificial intelligence is changing the cybersecurity landscape so quickly that leaders and citizens can’t afford to treat it as tomorrow’s problem anymore.
Who are the “Five Eyes”?
For anyone wondering who the Five Eyes are, you’re not alone. It sounds more like the title of a spy thriller than an international partnership. In reality, Five Eyes is a long-standing intelligence alliance between New Zealand, Australia, Canada, the United Kingdom and the United States. These countries share intelligence and work closely together on national security issues, including cyber threats.
New Zealand is represented through the Government Communications Security Bureau (GCSB) and its National Cyber Security Centre, meaning this isn’t just overseas advice, our own cybersecurity experts have signed their name to it.
image source: RNZ
The concern isn’t that AI itself is dangerous. In fact, the statement makes it clear that AI has enormous potential to strengthen cyber defences. The problem is that cybercriminals are just as excited about AI as cybersecurity professionals are. Criminal groups can now use AI to create more convincing phishing emails, automate attacks, find software vulnerabilities faster and launch scams at a scale that simply wasn’t possible a few years ago. According to the Five Eyes agencies, the timeline isn’t measured in years anymore, it’s measured in months, and soon could even be measured in minutes or seconds.
In mid-June, the U.S. Commerce Department ordered Anthropic to suspend all access to its AI models: Mythos 5 and its consumer-friendly counterpart, Fable 5, by any foreign national worldwide, after learning of a method to bypass the model’s safeguards (referred to as a “jailbreak”), specifically by utilising prompts such as “fix this code” to surface software vulnerabilities. Because Anthropic couldn’t selectively filter by nationality in real-time, they were forced to take the models completely offline.
Essentially, you didn’t have to be a hacking genius to potentially break through high-level security infrastructure; you can just ask Claude to figure it out for you, which was flagged as an immediate national security concern.
New Zealands “She’ll be ‘right” Problem
We often like to think of ourselves as being tucked away at the bottom of the world, safely distant from the problems making headlines overseas. Unfortunately, the internet has never been particularly interested in geography. Cybercriminals don’t care whether they’re targeting a multinational bank in London or a family-owned engineering firm in Hamilton. If there’s money to be made or systems to exploit, they’ll have a go.
New Zealand businesses already know this all too well. Ransomware attacks, data breaches and phishing scams have become increasingly common over the past few years. AI simply makes those attacks faster, cheaper and harder to detect. A scam email no longer needs obvious spelling mistakes or awkward grammar to give itself away. AI can produce polished, personalised messages in seconds, making it much easier to fool even cautious people.
image: Scam email designed to look like an official IRD inquiry. Please always forward IRD scam emails to: phishing@ird.govt.nz.
What makes this statement different from previous warnings is that it isn’t aimed solely at IT departments. The Five Eyes agencies are calling on government leaders, company directors and executives to take responsibility. Their message is that cybersecurity can no longer be treated as something that sits quietly in the server room until something breaks. It’s now a business risk, an economic risk and increasingly a national security issue.
What makes us a target?
Our economy relies heavily on critical infrastructure, healthcare, agriculture, logistics and thousands of small and medium-sized businesses. Many don’t have large cybersecurity teams or any dedicated cybersecurity staff at all. Some are still running older systems because replacing them is expensive, while others delay software updates because they’re worried about disrupting operations.
The Five Eyes agencies argue that these are exactly the kinds of weaknesses attackers are looking for. Their recommendations aren’t particularly flashy. In fact, they’re almost refreshingly boring. Keep systems updated. Replace unsupported software. Limit who has access to sensitive systems. Prepare for cyber incidents before they happen rather than after. Use AI to strengthen your own security, not just improve productivity.
image source: RNZ
The statement also acknowledges an uncomfortable truth: organisations should assume that breaches will happen. No system is perfect. The goal isn’t to become impossible to attack; it’s to detect incidents quickly, contain them and recover before they become full-blown crises.
For New Zealand, that’s a timely reminder.
As AI becomes embedded in everything from customer service to software development and everyday office tools, it’s easy to focus on the productivity gains while overlooking the new risks that come with them.
How to Prepare
Perhaps the biggest takeaway from the Five Eyes statement is that waiting isn’t really an option. Cyber threats are evolving faster than most organisations can comfortably adapt to, and AI is accelerating that pace. The agencies warn that assumptions about cyber risk can become outdated in months rather than years, making regular review and continuous improvement essential.
It’s easy to dismiss cybersecurity warnings as something that only concerns governments, banks or giant technology companies. But every New Zealander has a stake in this. Whether it’s protecting our businesses, our essential services or simply the personal information we hand over online every day, stronger cybersecurity benefits everyone.
Download – What to do in a breach | SMB
If you’re looking for more complex solutions, or want us to take a look at what security would be best for your situation personally, feel free to reach out to cybersmart@chillisoft.net – we can evaluate your security from sole traders and small business owners, households, or even enterprises.