National Cyber Security Centre interviews

“The decision not to is a senior-level risk decision, and should be considered in the wider context of organisational risk management policy and practice.”

“In the real world, great technology and technical capabilities may still not make for a great response if the right people, with appropriate skills are not in place.”

“If updating to the latest version of the affected software doesn’t fix the reported vulnerability or misconfiguration, or there isn’t an update to address the issue yet, you will need a process to triage and prioritise.”

“The time between disclosure and exploitation has shrunk to days and AI will almost certainly reduce this further.”

“The most significant AI cyber development will highly likely come from AI-assisted vulnerability research and exploit development (VRED)”

“Skilled cyber actors will need to remain in the loop.”