Vulnerabilities are becoming more visible
Frontier AI refers to the most advanced AI models operating at the forefront of technological capabilities at a given point in time. The discussion about what these models can do has now changed, says Reerink. ‘It has become clear that Frontier AI is going to change cybersecurity significantly.’
‘But it is important for organisations to remain calm and keep things in perspective,’ adds Haddouti. ‘The fact that we are discovering more vulnerabilities with the new models does not mean they were not already there. They are simply more visible now and can therefore be exploited more quickly. At the same time, a risk emerges: cybercriminals can misuse this information for AI-driven attacks.’
Reerink cites Anthropic’s Mythos model as an example. It was trained to identify cybersecurity issues. ‘This spring, Mythos found more than ten thousand vulnerabilities across around fifty partners in a single month. That shows how capable these models can be. We are also seeing AI significantly increase the speed, scale and complexity of cyberattacks.’
According to Reerink, this development is already having an impact. ‘The number of patches released by software companies has increased by seventy per cent compared to last year. More patches also mean more work for employees and a larger backlog. This increases the risks.’
Cybersecurity needs to move faster
The growing number of vulnerabilities is putting existing security processes under pressure. Organisations have traditionally applied patches periodically, but this approach is becoming increasingly difficult to sustain.
‘Traditionally, companies would take a month or even a quarter to apply patches. That is no longer possible,’ says Haddouti. ‘The time between discovering a vulnerability and it being exploited is getting shorter and shorter. You therefore need continuous insight into your own vulnerabilities and you need to know how AI can help you respond to the volume and speed of attacks.’
In her view, it is a rat race. ‘You can also use the tools attackers deploy to defend yourself. But we still see cybercriminals moving faster.’
Reerink also expects that advantage to remain for the time being. ‘The tools you use to defend yourself need to be adapted to the new threats. Major IT vendors are working on this, but attacks continue in the meantime. That makes this a difficult period for companies.’
Organisations therefore need to look not only at new technology, but also at the way they work. ‘In the short term, companies need to ensure that all processes keep running. In the longer term, they need to consider fundamentally redesigning those processes,’ says Reerink.
Cybersecurity is a board-level issue
The acceleration of cyber threats also calls for different decisions at board level. On 7 July 2026, for example, the European Central Bank (ECB) called on the CEOs of significant banks in Europe not to wait, but to submit an action plan no later than 31 October 2026. They must set out the measures they are taking to strengthen their operational resilience against cyber threats associated with Frontier AI models.
‘With that letter, the regulator demonstrates that cybersecurity is truly a board-level issue,’ says Haddouti. This starts with understanding the risks and making a conscious assessment of what is acceptable for the organisation. ‘In the short term, you need to know where you are most vulnerable and how large the problem could be. You then need to determine which risks you are willing to accept and the associated consequences and impact. That discussion belongs at board level.’
The way the security organisation is structured also needs to change. ‘A fundamental redesign of your security operations centre (SOC) is needed to remain fit for the future. Simply adapting and supplementing existing processes will no longer be enough. You also need to ensure that your people have sufficient AI literacy. And you cannot do this alone: collaboration with partners and suppliers is essential.’
Get a clear picture of your critical processes
According to Reerink, an important starting point is for organisations to form a clear picture of their critical processes. ‘We see that many companies do not really know which processes are truly critical.’
Haddouti explains why this insight is needed. ‘Suppose a major incident occurs. Which processes must keep running to maintain your core activities and continue serving your customers? If you have a clear picture of your minimum viable company (MVC), you can prioritise and invest in a more targeted way.’
This does not mean that organisations only need to secure their most important processes. ‘You must always have the basics right. Think of access management and fixing vulnerabilities to keep your attack surface as small as possible. On top of that, you can take additional measures for the most critical processes.’
Outsourcing does not relieve organisations of their responsibility either. ‘Many companies have outsourced their cybersecurity to external parties. But that does not mean you are no longer responsible yourself. For example, you need to ensure that your suppliers have their security in order. Otherwise, attackers may still gain access through their software.’
Experimenting with AI-powered defence
AI not only expands the attackers’ capabilities. The same technology can also help organisations strengthen their defences. Haddouti stresses that organisations need to gain experience with the new possibilities. ‘You don't have years of experience to draw on so you need to explore this together and start working with it to build your capabilities. As an organisation, you need to have the courage to set up an AI lab, for example. There, you can investigate how AI agents can help strengthen your defences. You can also discover what agents can and cannot do and agree on how to use them.’
Clear boundaries are necessary, however, Reerink points out. ‘You need to establish guardrails and determine which decisions an AI agent may make autonomously. This allows you to maintain control over the technology and protect the continuity of your organisation.’
How quickly can your organisation respond?
Ultimately, what matters is that organisations know what to do when things go wrong. ‘Companies often ask: am I safe?’ says Reerink. ‘Of course, you can never be one hundred per cent safe. What matters is that, if something happens to your organisation, you can look yourself in the eye as a board member and say: I did everything I could.’
‘So, the question is not whether your organisation is completely secure, but whether you can act quickly enough when something goes wrong or a vulnerability is discovered. The shorter the time between discovery and action, the more opportunity you have to limit the impact of an attack.’
How vulnerable is your organisation?
Do the reality check!
