Dutch security and law enforcement institutions said artificial intelligence has significantly changed the cyber threat landscape and called on organisations to strengthen their preparations for potential attacks.
In a joint statement issued by the General Intelligence and Security Service (AIVD), the Military Intelligence and Security Service, the National Cyber Security Centre (NCSC), the National Coordinator for Security and Counterterrorism (NCTV), the Public Prosecution Service, the Government CIO and the National Police, the institutions said artificial intelligence allows vulnerabilities in systems to be identified and exploited more quickly.
The statement said long-known weaknesses had become a greater threat through the impact of artificial intelligence, while attackers were using the technology to identify and exploit vulnerabilities before defence teams could detect them.
The statement stressed the need for immediate action against AI-supported attacks, warning that inadequate defences could lead to prolonged disruptions in critical systems and affect large numbers of people. It also warned that cyberattacks could expose large amounts of names, addresses and citizen service numbers, potentially causing serious privacy and financial consequences.
Artificial intelligence facilitates attacks and disinformation
The joint statement said artificial intelligence enables attackers to carry out cyberattacks more quickly, develop malware more easily and create more convincing phishing emails. It added that the technology can also be used to personalise disinformation on a large scale.
It said the most advanced artificial intelligence models were not needed for these attacks, adding that existing and easily accessible models could also be used.
Institutions urged to replace outdated systems
The statement called on managers to fully implement basic security measures, reduce the attack surface and replace outdated systems that no longer receive security updates.
It said attacks caused by updates not being installed or being installed late could not be defended, and stressed that organisations should prepare on the assumption that an attacker could gain access to their systems. It also called for warning signs related to artificial intelligence to be taken seriously.
NCSC Director-General Matthijs van Amelsfort said artificial intelligence was automating the attack chain, from finding vulnerabilities to exploiting them. Van Amelsfort said fully implementing basic security measures was more important than ever.
The statement said cybersecurity was not merely a technical issue but one with institutional, managerial and societal dimensions. It added that the most important step in cybersecurity involved organisational culture and awareness, alongside technical measures.
The statement also said that the weakest link in the cybersecurity chain was often not the technical infrastructure but the awareness of managers and employees regarding cyber threats.