The Compliance Clock
Just Got Faster.

On Monday night, the heads of the Five Eyes cyber security agencies did something they almost never do. They put their names to a single page together — Australia's ACSC, the United States' CISA and NSA, and their British, Canadian and New Zealand counterparts — and told boards, not IT departments, that the assumptions underpinning their cyber risk are about to expire.

Their message was deliberately plain. Frontier AI models are expected to outpace what the industry currently expects of them, and they will reshape both attack and defence. The agencies framed the timeline not in years but in months. They said AI lowers the barrier for malicious actors and shrinks the window between a vulnerability being discovered and being exploited. And they were explicit that breaches should now be assumed rather than feared — preparedness, not prevention, is the measure that matters.¹

If that sounds abstract, the same week supplied the worked example.

FortiBleed was not a clever zero-day. It was an exposure problem wearing a brand name: management interfaces that should never have been reachable from the public internet, credentials that had already leaked and were never rotated, and old firmware quietly storing passwords in a format built to be cracked offline. Automation — scan the internet, test known passwords, turn each compromised device into a listening post to harvest more — did the rest. This is exactly the kind of work AI makes cheaper, faster and more relentless. And it is exactly the kind of weakness no internal security tool was ever positioned to see.

The ProblemPoint-in-time assurance was built for a slower world

Australian organisations don't lack frameworks. They are measured against the Essential Eight, the ACSC Information Security Manual, the Protective Security Policy Framework, the Australian Privacy Principles and the Notifiable Data Breaches scheme, ISO 27001, the NIST Cybersecurity Framework, and — for regulated entities — APRA CPS 234 and the operational-resilience standard CPS 230.

Every one of those instruments shares a quiet assumption: that a control assessed today still describes reality tomorrow. The annual audit, the point-in-time penetration test, the once-a-year attestation — all of it presumes the ground moves slowly enough that a snapshot remains true for a useful length of time.

When the exploitation window shrinks from years to months, a point-in-time assessment doesn't just age. It expires before the audit committee has finished reading it.

This is the real compliance story buried inside the Five Eyes warning. The frameworks aren't wrong — but the cadence they assume is being overtaken. "We patch on a quarterly cycle" was once a defensible control statement. Against an adversary who can weaponise a disclosure in weeks, it is now a description of a gap. The board question is no longer "do we have the control?" The agencies were blunt about this: it is no longer enough to have controls in place; leaders must be confident those controls will hold during a real incident.¹

The ContrastEurope is writing the obligation down. Australia is being warned.

The difference in how Europe and Australia are responding is instructive — and it tells you which way the regulatory wind is blowing.

The European Union already has a codified answer. The EU AI Act (Regulation 2024/1689) entered into force in 2024 as the world's first comprehensive AI law, classifying systems by risk and attaching cybersecurity, documentation and risk-management duties to the high-risk tier. Under May 2026's "Digital Omnibus" agreement, the heaviest obligations were deferred — to December 2027 for stand-alone high-risk systems and August 2028 for AI embedded in regulated products — but the architecture, and the penalties, remain.⁵ Sitting alongside it are ENISA's AI Threat Landscape and its Framework for AI Cybersecurity Practices, layered on top of the existing NIS2 and DORA regimes.⁶

Australia has no equivalent binding AI statute. What it has instead is the Privacy Act reform program, sector regulators like APRA tightening operational-resilience expectations, and — this week — a rare direct instruction from its signals directorate. For an Australian board, that absence is the point: you cannot wait for a law to tell you the standard has moved. The Five Eyes statement is the signal.

If your organisation procures, deploys or builds AI that reaches into Europe, the EU regime already applies to you regardless of where you're headquartered. If it doesn't, the direction of travel is still clear: principles harden into obligations, and the warning issued today becomes the audit finding tomorrow.

The MarketEveryone is selling you an AI defender. Are you keeping up?

The same week the spy chiefs urged leaders to use AI in their own defence, the market is already crowded with vendors who will sell them exactly that. This is not a criticism — the agencies were right that defenders must adopt these tools. But it is worth being clear-eyed about what each of them actually secures, because the marketing language ("AI-powered", "autonomous", "agentic") flattens some very different jobs.

And here is the genuinely sharp edge of this market: the tools are dual-use. The same frontier models being sold as defenders are the ones the Five Eyes named as offensive accelerants. Researchers have already demonstrated prompt-injection and data-leakage weaknesses in the leading consumer models themselves.⁷ The vendor you buy to find your flaws is built on the same capability your adversary is renting to find them faster. Buying more tools is not the same as being harder to reach.

The Blind SpotThe breaches don't beat the inside. They walk around it.

The major Australian breaches of the last four years share one thing, and it isn't a clever new attack. None of them defeated anyone's endpoint detection. Each walked in through the external edge — an exposed service, a credential already circulating, a trusted vendor — the one surface the expensive internal platform was never built to watch. The global data says the same.

Which raises the uncomfortable question for a board: do the platforms you pay most for actually watch that edge? Several now sell an outside-in add-on — Microsoft's Defender EASM, CrowdStrike's Falcon Surface, Palo Alto's Cortex Xpanse — but every one was bought, not built (RiskIQ, Reposify, Expanse), and funded like an afterthought. The quarter CrowdStrike acquired its external module, it added under US$1 million of net new recurring revenue, against US$198 million on the core platform.⁸ The budget follows the revenue, and the revenue lives inside the perimeter.

That edge is the soft layer — credentials in a public dump, the SaaS instance signed up without telling IT, the forgotten subdomain, the management interface left exposed. None of it needs a breach to find. It is sitting in public right now, and AI only makes finding it faster and cheaper.

The Five Eyes put "reduce your attack surface" at the top of their list for a reason. You cannot reduce an attack surface you have never measured from the outside.

The PositionExposure you can see. Governance you can evidence.

This is the whole of what BlackFlag Advisory does — the entire craft, run with full attention, and vendor-neutral, so the answer doesn't require you to buy and live inside anyone's platform first. We assess what your organisation looks like from the outside using only publicly available sources — no system access, no credentials, no disruption. Passive OSINT. The attacker's first move, run for your benefit instead of theirs.

But a list of exposed assets is not, on its own, a board-ready answer. The harder and more valuable step is the second one: translating those technical findings into the language your obligations are written in. An exposed admin panel is a finding. An exposed admin panel mapped to Essential Eight maturity, to your APP 11 security obligations, and to the breach-notification clock under the NDB scheme — that is a governance position a board, an auditor or a regulator can act on.

Getting the basics right and moving quickly, the agencies said, will matter more than buying the most tools. We agree — and we'd add one line to it. Before you can get the basics right, you have to be able to see them. From the outside. The way the people targeting you already do.