Dutch intelligence, security and judicial agencies warned that artificial intelligence is significantly changing the nature of cyber threats. The General Intelligence and Security Service (AIVD), the Dutch Military Intelligence and Security Service, the National Cyber Security Centre (NCSC), the National Coordinator for Security and Counterterrorism (NCTV), the Public Prosecution Service, the Government Chief Information Office (CIO Rijk) and the National Police issued a joint statement.
The agencies said that vulnerabilities in systems could be identified and exploited more quickly through the use of artificial intelligence. They noted that the technology magnified the impact of previously known weaknesses, while attackers could discover and exploit vulnerabilities before defense teams became aware of them.
The agencies said immediate preparations were needed against AI-assisted cyberattacks. They warned that attacks that overwhelm defenses could cause prolonged disruptions to vital systems and harm large numbers of people.
The joint statement warned that attacks could result in the theft of large quantities of names, addresses and citizen service numbers. The agencies said such a data loss could have serious privacy and financial consequences.
Artificial intelligence personalizes disinformation
The agencies said artificial intelligence enabled attackers to conduct cyber operations more quickly, develop malware more easily and prepare more convincing phishing emails. They added that the technology also made it easier to personalize disinformation on a large scale.
The statement emphasized that attackers did not need the most advanced artificial intelligence models to carry out such attacks. The agencies said existing and easily accessible models could also be used in attacks.
Agencies urged to strengthen defenses
The agencies called on managers to first implement basic security measures fully and urged them to reduce the attack surface. They also said that outdated systems no longer receiving security updates needed to be replaced.
The agencies said attacks resulting from the failure to install or delays in applying updates could not be defended. They urged organizations to prepare on the assumption that an attacker could gain access to their systems and to take warning signs related to artificial intelligence seriously.
NCSC Director-General Matthijs van Amelsfort said artificial intelligence was automating the attack chain, from identifying vulnerabilities to exploiting them. Van Amelsfort said fully implementing basic security measures was now more important than ever.
The joint statement said that the decisive factor in cybersecurity was not only technical capacity; organizational culture and awareness were also important. It described cybersecurity as an institutional, managerial and societal issue that extends beyond information technology.
The statement said the weakest link in the cybersecurity chain was often not the technical infrastructure but the awareness of managers and employees regarding cyber threats.