A new report from the Business Software Alliance (BSA), BSA’s 2027 Global Cyber Agenda for an AI World, argues that frontier AI has changed cybersecurity. Governments, it says, can no longer rely on rules written for an era that was slower and more human-driven.
The new threat picture
The report points to advanced AI security systems, including models such as GPT-6 Astra and Mythos. These tools can find software flaws on their own, combine exploits and carry out attacks at high speed and scale.
The risk is that they lower the skill needed for an effective attack and shorten the gap between finding a flaw and exploiting it. The report treats this as a structural shift in cyber risk, in which attacks spread faster and cause greater operational, financial, and reputational damage.
The same tools also help defenders. They can spot weaknesses, sharpen threat detection and catch bugs during software development, before attackers do.
What still works
The report does not call for starting over. It says the basics still matter: leadership from the C-suite, public-private cooperation, risk-based frameworks, global standards and cross-border teamwork. These principles were built to adapt to new technology, and the report argues they matter even more now. The task is to separate what still holds, what needs strengthening and where new effort is needed.
Eight priorities for governments
Use AI for defence. Adoption is uneven across sectors. Policymakers should incentivise AI-enabled tools, including those that give visibility into AI systems at runtime and control over data.
Put defenders first. Developers of advanced AI security tools already give trusted defenders early access. The report calls for a transparent, globally aligned system that determines who gets the most powerful tools and on what terms.
Fix vulnerability management. Governments should invest in systems that collect, score, and publish vulnerability data, support back patching (including for open-source software), and encourage “virtual patches” as stopgaps.
Modernise legacy systems. Old government systems that cannot be patched are now high-risk weak points. Procurement should favour secure, updatable technology.
Build resilience. Organisations need to keep running during attacks and recover quickly. The report points to clear recovery goals, immutable storage and regularly tested restoration.
Align regulations. Overlapping rules, especially on incident reporting, push teams toward compliance checklists and away from real security. The report asks for streamlined requirements across sectors and borders.
Prepare for quantum threats. The arrival of powerful quantum computers is uncertain, but “harvest now, decrypt later” attacks are already happening. Organisations should inventory their cryptographic assets and begin moving to NIST-standardised post-quantum cryptography, starting with high-value systems.
Measure outcomes. Track mean time to detect, mean time to respond, and how quickly vulnerabilities are fixed, so spending leads to real improvement.
Why it matters
The report’s message is that speed now decides who wins. Defenders must adopt AI quickly, patch faster and recover sooner, while governments cut red tape and share access to the best tools fairly. That is the strategic test the agenda sets out.
Readers should keep in mind that BSA is an industry group, and many of its recommendations reflect the interests of software companies. Even so, the agenda gives security leaders a useful checklist as AI-driven attacks become more common.
