The UK government published an open letter to UK business leaders this morning, warning that AI is fundamentally changing the cyber threat landscape and urging boards to act now. The letter, signed by Secretary of State Liz Kendall and Security Minister Dan Jarvis, points to accelerating AI capabilities making sophisticated attacks easier to carry out at scale. It calls on businesses of all sizes to treat cybersecurity as a board-level priority and to get Cyber Essentials certified.
https://www.gov.uk/government/publications/ai-cyber-threats-open-letter-to-business-leaders
Commenting on this, Charlotte Wilson, head of enterprise for the UK and Ireland at Check Point, said, “This is a wake-up call businesses can’t afford to ignore. AI is making attacks more advanced, more personalised and far easier to execute at scale, and it’s not just critical infrastructure that’s in the crosshairs. Attackers go where defences are weakest. What’s important to recognise here is that this is a dual responsibility. The government has been clear that it wants industry to lean in as it shapes regulation. It doesn’t want rules that stifle innovation, but it does need them to be agile and adaptive. That means businesses can’t sit on the sidelines. The government is actively asking for intel from organisations, and those conversations matter.
There’s also a very direct economic argument here. When we saw the major supply chain breaches of last year, attacks that were made more sophisticated and more damaging because of AI, the impact didn’t stay with the businesses affected. It rippled out. Rachel Reeves herself cited the JLR breach during the May statement as having a measurable drag on business growth and GDP. When you look at the scale of some of these breaches, and we’re talking figures in the billions, and then factor in the bailouts and recovery costs that follow, that burden ultimately falls on the taxpayer. So yes, the government has a role in holding businesses to account, but the framework has to be flexible enough for businesses to remain productive, effective and innovative, because a growing economy is what funds everything else. This only works if both sides show up.
That’s something I actively try to do as a business leader – act as a bridge between government and industry. The reality is that expertise lies within the verticals themselves. The people who truly understand the cyber risk facing financial services, healthcare, or critical infrastructure are the ones operating in those sectors every day. The government can set the direction, but it needs that ground-level intelligence to get regulation right. That collaboration isn’t just a nice-to-have but central to whether any of this actually works.”
Muhammad Yahya Patel, vCISO and cybersecurity advisor for EMEA at Huntress, added, “Today’s open letter from the Secretary of State and Security Minister is not routine government communication. It is an alarm bell, and business leaders would be wise to hear it. The detail that should stop every leader in their tracks is this: the UK’s AI Security Institute now assesses that frontier AI capabilities in cyber offence are doubling every four months. That’s twice the pace recorded just months ago. The window businesses have to get their defences in order is closing faster than anyone anticipated.
What makes this moment different is not just the speed, but the democratisation of threat. Attacks that once required specialist criminal expertise can now be replicated by virtually anyone with access to an advanced AI model. The barrier to launching a damaging cyberattack and cybercriminal operation has collapsed. That changes the calculus for every business, in every sector, of every size.
The Government’s recommended steps are: 1. board-level accountability; 2. get basic cyber hygiene in place and achieve Cyber Essentials certification; 3. Follow NCSC guidance and sign up for the Early Warning Service. Here’s the uncomfortable truth: these aren’t new recommendations. The reason they’re being repeated at a ministerial level, urgently, in an open letter, is because too many businesses still aren’t doing them.
Cyber feels complex, technical, and someone else’s problem. But it isn’t. Not anymore. It is a business continuity problem, a reputational problem, and increasingly, an existential one. The letter makes this point well: attackers go where defences are weakest. The time for treating cybersecurity as an optional extra is over. And if today’s letter isn’t enough to prompt that conversation in the boardroom, I genuinely don’t know what will be.”
