Key Takeaways
- AI is accelerating existing threats, not creating new ones
- Double down on patching, hardening, monitoring, and incident readiness
- Strengthen vulnerability management to keep pace with faster exploit timelines
- Ensure clear executive ownership of cyber risk and AI use
- Adopt AI cautiously with strong human oversight and controlled access
Frontier tools such as Mythos and ChatGPT's 5.5Cyber have generated a LOT of headlines and worries. While these are restricted in some ways, researchers are figuring out how to get the most out of existing publicly available models. For example, James Kettle's soon to be open sourced "HTTP Terminator" is effectively a harness with context and process steps that makes LLMs become an under-study James. Which is frankly terrifying.
Here in NZ, NCSC has been busy lately putting out guidance on AI (and getting access to Mythos – props). LLMs, specific advice on "frontier models", advice on agentic systems. You name it, they've probably got some recent advice on it.
So what's the consistent through line of that advice? The tl;dr or BLUF?
AI is accelerating cyber risk — and you need to act. now. Not next year. Not when your organisation “gets around to AI”. Now.
AI isn’t creating new weaknesses — it’s speeding everything up
There’s a lot of noise about AI introducing completely new risks.
That’s not really what the NCSC is saying.And I agree.
What they are saying (pretty clearly) is:
- Vulnerabilities you already have are now easier easier to find
- Weak controls are now easier to bypass
- Attack techniques are now easier to automate.
The tools that used to require skilled operators are getting cheaper, faster, and more accessible. Threat actors can automate targeting, individual recon, entire phishing campaigns, exploit dev and deployment. We’ve seen this pattern before with things like ransomware-as-a-service, but AI is pushing it further. Speed - speed is the key.
What matters most: the basics
Despite the focus on AI, when I read the NCSC guidance, it reinforces a simple but important point: Cyber security fundamentals are still your strongest defence. There’s a temptation with anything AI-related to assume the answer is “new shiny tooling”. But cyber fundamentals are still the most effective defence.
Organisations should focus on:
- Vulnerability and patch management
- Secure configuration and access control
- Monitoring and detection
- Incident readiness.
The key here is consistent execution, not new frameworks. The thing that's changing isn't so much the what, it's the when and how. AI removes your margin for error. A missing patch that sat quietly for months? That’s now something an attacker can find in hours.
A weak admin control that no one noticed? Same story.
This is where a lot of organisations are going to feel pressure. Not because the standards changed — NZISM, PSR, MCSS all still apply — but because the tolerance for inconsistency is dropping fast.
Where are we being told to focus?
The guidance highlights three immediate priorities:
1. Strengthen vulnerability management
Look I know I'm a vuln management nerd. But this is definitely an issue here. ZeroDayClock shows us that the time from vuln to exploit has driven down at an incredible pace.
Frontier AI increases the volume and speed of vulnerability discovery and exploit development. Organisations must be able to identify, prioritise, and remediate issues faster than before.
The latest guidance from NCSC frames this quite nicely at the leadership level:
- Can you handle a surge in vulnerabilities?
- Can you patch faster?
- Do your processes actually work under pressure?
Put in the time in now to get this right. You don't want to mess with a process while using it. Renegotiating patching with tech while slamming through dozens or hundreds of emergency patches is not how you win friends and influence CTOs. Have the conversations up front and figure out what you can do BEFORE the storm arrives.
If your vulnerability management programme is already stretched, AI is not going to make that easier.
2. Elevate governance and accountability
Executive leadership must own cyber risk in the AI era, with clear visibility of exposure and resilience. Similar to what I was saying earlier this year in my MVP AI governance talks - organisations need AI governance and leadership that helps them balance the benefits and the risks and enables you to make smart investment decisions on where you want to leverage AI for business benefit. Having internal AI governance gives you a place to have the conversations about what AI means for your defences.
3. Adopt AI carefully
Agentic AI introduces new risks through autonomous actions and broad system access. NSCS recommend organisations:
- Govern AI & identify goals and use cases
- Start small with controlled use cases
- Maintain human oversight
- Avoid unrestricted access to systems and data.
We're here to help...
As your trusted cyber security partnerBastion can support New Zealand and Australian organisations to respond to NCSC guidance by:
- Assessing cyber maturity against the cyber framework you use.
- Strengthening vulnerability management and resilience.
- Improving detection, response, and incident readiness.
- Testing and conducting assurance on your new AI tools and services.
- Advising on secure AI adoption, including governance and agentic risk.
Take care out there fellow humans.