Five Eyes just told your board: AI cyber risk is your problem now, not IT's.

Five Eyes cyber agencies issued a joint statement yesterday.

The timeline for AI transforming cyber attacks is not years.
It is months.

Six intelligence agency heads signed it: CISA, NSA, UK NCSC, Australia ACSC, Canada Cyber Centre, New Zealand NCSC-NZ.

This is not guidance.
This is the closest thing to a global alarm that intelligence agencies issue.

The key line:
"Cyber risk can no longer be treated as a purely technical issue. This is a core business risk and leadership responsibility."

What changed in the last 72 hours:

CISA cut vulnerability patching deadlines to 3 days for government systems.
Citing AI threats specifically.

This cascades to every enterprise vendor, contractor, and supplier in the federal supply chain.
If you sell to government, your patching SLA just collapsed.

The Five Eyes listed 5 actions.
Reduce attack surface.
Accelerate patching.
Address legacy systems.
Strengthen identity controls.
Prepare for breaches.

None of these are new.

What's new is the enforcement clock.
AI compresses the window between vulnerability discovery and exploitation.
A patch that waited 30 days last year now has 3 days.

Your CISO needs a board-level conversation this week.

Not next quarter.
Not after the audit.

This week.

SOURCE: https://www.ncsc.gov.uk/sites/default/files/2026-06/Five-Eyes-cyber-security-agencies-statement-ai-shift.pdf
VERIFIED: Reuters, NCSC official PDF, Bratby Law legal analysis
SIGNAL: Intelligence agencies rarely issue joint public statements. When they do, it means the private chatter has already shifted to operational planning. Your board's liability just changed.