Are your defences ready?

AI-Powered Cyber Attacks Are Coming. Are Your Defences Ready?

Some of the world’s biggest technology companies, including Google, Microsoft, Anthropic and OpenAI, have issued a stark warning: organisations have a limited window to strengthen their cyber defences before AI significantly changes the threat landscape.

More than 100 organisations have signed an open letter calling on governments, businesses and technology providers to work together to improve cyber resilience and ensure that critical infrastructure is better protected against increasingly capable AI-driven attacks.

The message is clear: the security measures that have protected organisations to date may not be enough for what is coming next.

Read Open AI’s letter here

AI is changing the cyber threat landscape

Artificial intelligence is already being used to make cyber attacks more sophisticated.

AI can analyse information at scale, identify weaknesses, automate tasks and adapt its approach far more quickly than a traditional attacker. As AI models matures, these capabilities are becoming increasingly accessible.

Recent incidents have demonstrated that this is not simply a theoretical future risk.

AI agents have already been observed working together, creating their own communication channels and attempting to overcome security controls. In one reported incident, a group of AI agents successfully compromised systems operated by Hugging Face, a platform widely used by AI developers.

At the same time, vulnerabilities that had remained undiscovered for years have reportedly been identified by advanced AI systems in seconds.

The concern is that these capabilities will continue to improve, potentially allowing attackers to identify and exploit weaknesses faster than organisations can respond to them.

The fundamentals matter more than ever

It can be tempting to think that the answer to AI-powered cyber attacks is simply more advanced AI-powered security.

But organisations shouldn't overlook the fundamentals.

Weak passwords, missing multi-factor authentication, unsupported software, poor patch management, exposed services and misconfigured cloud environments remain common security weaknesses.

AI doesn't need to be involved for an attacker to exploit these issues.

In fact, as attackers become better at identifying weaknesses, having strong baseline security controls becomes increasingly important.

This is where established security frameworks and independent testing remain valuable.

Cyber Essentials: establishing the baseline

Cyber Essentials provides organisations with a practical framework for addressing some of the most common cyber security risks.

It focuses on fundamental technical controls, including secure configuration, user access control, malware protection, software updates and firewalls.

For organisations concerned about the evolving threat landscape, these controls provide an important starting point.

Cyber Essentials Plus takes this a step further by introducing independent technical verification of the organisation's security controls.

The importance of this distinction is becoming increasingly apparent.

It is one thing to have policies stating that security controls are in place. It is another to have those controls independently assessed and verified.

As attackers gain access to increasingly capable tools, organisations should be asking a simple question: Are our security controls actually working as intended?

Penetration testing: thinking like an attacker

A security baseline is important, but it doesn't tell the whole story.

Penetration testing provides an opportunity to assess an organisation's security from an attacker's perspective.

Rather than simply checking whether individual controls exist, a penetration test attempts to identify and exploit weaknesses across the agreed scope.

This can include external infrastructure, internal networks, web applications, APIs and other systems.

That distinction matters in an environment where attackers may increasingly use automation and AI to identify potential attack paths.

Organisations should understand not only whether they have vulnerabilities, but what an attacker could potentially do with them.

A penetration test can help demonstrate how individual weaknesses could be chained together to gain access, move through an environment or access sensitive information.

Regular testing therefore provides an important reality check, particularly as infrastructure, applications and security controls change over time.

Cloud security cannot be overlooked

The move towards cloud services has fundamentally changed the way organisations operate.

Microsoft 365, Azure, AWS, Google Cloud and other platforms now form a critical part of many organisations' infrastructure. But cloud security also introduces a different set of risks.

Misconfigurations, excessive permissions, insecure authentication settings and inappropriate access controls can create significant exposure, even where an organisation's traditional network security is strong.

A Cloud Security Review provides an opportunity to assess the configuration and security posture of cloud environments against recognised security best practice.

For organisations relying heavily on cloud services, this should be considered alongside traditional security testing rather than as a replacement for it.

The question is no longer simply: "Is our network secure?" It is also: "Is our cloud environment configured securely, and are we controlling who can access it and what they can do?"

AI makes regular security testing even more important

One of the biggest challenges presented by AI is the potential speed at which attackers can discover weaknesses.

Historically, an attacker might need significant time, expertise and resources to identify a vulnerable system.

If AI can automate or accelerate parts of that process, the window between a vulnerability being exposed and being exploited could become much smaller.

Organisations therefore need to move away from treating cyber security as a one-off exercise.

Cyber Essentials can help establish a baseline.

Cyber Essentials Plus can independently verify key technical controls.

Penetration testing can challenge the organisation's defences from an attacker's perspective.

Cloud Security Reviews can identify weaknesses in increasingly critical cloud environments.

Together, these activities provide a much stronger picture of an organisation's security posture than relying on any single assessment.

Don't wait for the threat to arrive

The warning from more than 100 major technology and financial organisations should be interpreted as a reason to act.

Organisations don't necessarily need the most advanced AI security technology available. They do, however, need to ensure that their existing security controls are effective, properly configured and regularly tested.

The organisations best positioned for the next generation of cyber threats will not necessarily be those with the most sophisticated technology.

They will be those that understand their environment, have established strong security fundamentals and regularly challenge their own defences.

AI may make cyber attacks faster and more sophisticated. The best time to strengthen your defences is before you need them.

Build confidence in your cyber security

At Delta Cyber Security, we help organisations assess and strengthen their security posture through:

• Cyber Essentials – establishing a recognised baseline of essential technical security controls.

• Cyber Essentials Plus – independently verifying that key security controls are implemented effectively.

• Penetration Testing – identifying and demonstrating exploitable weaknesses from an attacker's perspective.

• Cloud Security Reviews – assessing cloud environments against recognised security best practice and identifying configuration and security weaknesses.

  
  

If you're concerned about how prepared your organisation is for the evolving cyber threat landscape, these assessments provide practical ways to identify weaknesses, prioritise improvements and build greater confidence in your security.