Five Eyes agencies say AI is shrinking the vuln-to-exploit window to "months, not years" — what are you actually changing?
The heads of the Five Eyes cyber agencies (NSA, NCSC, ASD, CSE, GCSB) plus CISA put out a joint statement last week. Core argument: frontier AI is compressing the gap between a vuln being discovered and exploited, and that shift is months away, not years.
Source (NSA): https://www.nsa.gov/Press-Room/News-Highlights/Article/Article/4523810/five-eyes-cyber-security-agencies-statement/
Longer NCSC writeup (PDF): https://www.ncsc.gov.uk/sites/default/files/2026-06/Five-Eyes-cyber-security-agencies-statement-ai-shift.pdf
Most of the recommendations are unglamorous basics — reduce attack surface, patch faster, kill legacy, tighten identity. What's new is the urgency, and the explicit "defenders should be using AI too, because attackers already are."
Curious how people here are reacting: are you actually shortening patch SLAs on internet-facing stuff, or is this just more agency messaging? And for anyone drowning in automated-scanner output — is AI helping you separate signal from noise yet, or just adding to the pile?
.
(Disclosure: I work on tooling in this space, so I'm biased toward the "window is closing" read — more interested in whether practitioners are seeing it bite.)