Five Eyes gives boards months to adapt. The only hard numbers come from the vendor selling the fix.

The Five Eyes cybersecurity agencies - CISA, the UK's NCSC, Australia's ACSC, Canada's CCCS and New Zealand's NCSC-NZ - issued a joint statement to boards and executives saying AI is rewriting the rules of cyber risk, that the window between vulnerability and exploitation is shrinking, and that organizations have a matter of months to adapt ^[1]. Black Hat 2026 came weeks later ^[6], and that statement is now the opening frame for vendor marketing, which means operators have to separate what the agencies asserted from what any single supplier can demonstrate.

Start with the government text, because it is the most load-bearing thing here. The agencies argue that as AI lowers the barrier to attack, cyber risk stops being a technical problem and becomes a core business risk and a leadership responsibility ^[2]. The guidance asks leaders to get the basics right, act quickly, and treat cyber resilience as core to continuity and trust ^[3]. Its sharpest line is also its most useful for procurement: having controls is one thing, and having confidence those controls will perform during a real incident is another ^[4]. The agencies also say cyber leaders need help with the resourcing problem ^[5].

Now the evidence supporting the urgency, as relayed by Arctic Wolf. Its blog says the warning followed two groundbreaking autonomous, AI-driven cyber attacks in as many weeks, plus acceleration of the threat landscape by frontier AI models over recent months ^[7]. Neither incident is named or dated in the material. The headline statistic is that 70% of security leaders believe an undetected threat has already resulted in a successful attack in their organization ^[8], which is a survey of belief in the vendor's own 2026 report, not a count of confirmed breaches. The one third-party number in the piece points the other way: in the 2026 SANS AI in Cybersecurity Survey, nearly two-thirds of practitioners reported receiving AI-generated guidance they later determined was incorrect ^[9].

Adoption evidence is volume, not result. Arctic Wolf says its Aurora Superintelligence Platform processes more than 10 trillion security events every week ^[10], which works out to roughly 16.5 million events per second ^[1], and that its Aurora Agentic SOC has resolved over three million cases this year ^[11]. Those are self-reported throughput figures. The material offers no independent audit of them and no comparison of detection or containment outcomes against anything else.

The commercial shape of the argument is visible. Arctic Wolf argues most AI security tools are priced by consumption, so every extra event and investigation adds another line to the bill exactly when defenses need to scale ^[12], and positions its own predictable pricing, unlimited ingestion and unlimited investigations against that ^[13]. It says the product deploys in about 10 days and costs roughly 12 times less than building the same capability in-house ^[14]. The material does not state what the in-house baseline includes. Its trust claim is that agents escalate rather than guess at the edge of their confidence, validated by something called the AI Trust Engine ^[15].

Operating consequence: treat the Five Eyes statement as the requirement and the vendor numbers as untested vendor numbers. The pressures the piece describes - alert fatigue, staffing shortages, rising token costs ^[16] - are real budget constraints, and predictable pricing is a legitimate answer to them, but it is a billing structure, not proof of detection quality.

What to watch: whether any supplier publishes an escalation rate and an incorrect-guidance rate that can be set against the SANS two-thirds figure ^[9], what the 12x saving is measured against ^[14], and whether the named autonomous attacks ^[7] surface with enough detail to check. Until then, apply the agencies' own test and ask for evidence the controls perform in a real incident ^[4].