Five Eyes Finally Says The Quiet Part Out Loud
Key quote:
Unsupported systems are easy targets. They are not just technical debt, they are strategic liabilities.
Why it matters: Five Eyes is awfully chatty lately, from warning about the risks of China recruiting spies via LinkedIn to giving context on the use of agentic AI. In their latest report, they say “Cyber risk can no longer be treated as a purely technical issue. This is a core business risk and leadership responsibility.” Which is what I’ve been saying for years (including in my new book), except now it’s coming from the five prominent western spy agencies.
Anthropic’s marketing campaign for Mythos seems to have been a prelude to Fable, which was suddenly pulled in June 2026 when the Trump administration blocked foreign nationals from accessing it. And that’s because they recognized the same thing that this report points out: a lot of software (they call that software “strategic liabilities”) hasn’t been subjected to the same level of adversarial testing as modern web browsers, and so AIs aren’t having problems finding vulnerabilities. This isn’t a new problem, though. We’ve known the enterprise security software market has been terrible for decades, and Neils Provos was shelling software using older models earlier in 2026. It’s just reaching fever pitch as new models (and harnesses for older ones) get better. That urgency is backed by hard numbers: CISA’s pointing out that we can’t just ‘patch harder’ – after all, only 26% of known exploited vulnerabilities were remediated in 2025, down from 38% the year prior. Meanwhile, Zscaler found a 93% year-over-year spike in sensitive enterprise data being uploaded to AI tool; companies don’t have adequate controls in place.
Checkbox compliance isn’t going to work in this case, although honestly, it hasn’t worked for years. Companies need to start thinking very quickly about attack surface management and actual zero trust (I’ve been on about this for years), and then have demonstrable evidence that those controls actually work. If you can’t prove your controls hold under pressure, you’re just hoping for the best when being investigated or audited. It’s likely that this will be the year insurers and attorneys sit up and take notice of how companies were (or weren’t) operating their defensive controls at a new level of detail in response to breaches.
