A global industry call puts identity, patching, monitoring and verified controls ahead of security theatre.
Introduction
More than one hundred technology, finance, security and industrial organizations have backed a call for a global surge in cyber defense. The signatories include OpenAI, Anthropic, Google, Microsoft, AWS, Cisco, SAP, Visa and many others. Their message is blunt: increasingly capable AI will make attacks faster, cheaper and more sophisticated, while many organizations still carry weaknesses accumulated over years. For a growing business, this is not a reason to panic or buy every product carrying an AI label. It is a reason to treat cyber resilience as an operating discipline, owned by leadership and measured like any other business-critical process.
What happened
The open letter argues that organizations have a limited window in which defenders can use the same AI advances to improve protection before attackers scale their use. It asks every organization to raise security standards, fix the highest-risk weaknesses, apply least privilege, strengthen access controls and verify that fixes work. Technology partners are asked to provide continuous testing, practical deployment help and shared playbooks. Governments are urged to improve threat sharing and support under-resourced essential services. Frontier AI companies are asked to improve observability, trace agent identities and support defenders. This is a joint position from the signatories, not an independent forecast with a guaranteed timetable, but its recommended controls are sensible today.
Why it matters for growing businesses
SMEs are exposed through cloud accounts, email, remote access, suppliers, customer portals and increasingly through AI-generated code or automated workflows. They often have fewer specialists, so one compromised administrator account or unpatched internet-facing service can have an outsized impact. AI changes the economics of reconnaissance and social engineering: an attacker can personalize messages, test more variations and operate continuously. The answer is not an equally autonomous black box. Smaller firms gain more from reducing attack surface, making identities harder to steal, keeping reliable backups and ensuring someone notices abnormal activity quickly. Security maturity begins with knowing what the business depends on and who can access it.
A practical 30-day checklist
Start with an inventory of critical systems, administrators, external integrations and data stores. Enforce phishing-resistant multi-factor authentication where available, remove dormant accounts and separate daily work from privileged administration. Patch internet-facing systems first, then confirm externally that the vulnerable version or service is no longer exposed. Review email authentication, endpoint protection, backup isolation and restore tests. Identify AI tools that can execute actions, access shared drives, read mail or call business APIs; give each a dedicated identity and the minimum permissions required. Centralize logs for sign-ins, privilege changes and sensitive exports. Finally, run a tabletop exercise covering ransomware, supplier compromise and an AI workflow taking an unintended action. Record decisions, owners and recovery times rather than admiring the slide deck.
How to use AI defensively without creating a new risk
AI can help summarize alerts, classify suspicious messages, review configurations and draft remediation steps. Keep it inside a controlled workflow. Sensitive logs should go only to approved services. High-impact changes need human approval, and generated scripts should be tested in a non-production environment. Measure false positives, time to triage and the percentage of critical assets actually covered. Require an audit trail showing what the model saw, what it proposed and what a person approved. If a tool cannot explain its permissions, data handling and rollback path, it is not ready for production. Automation should shorten response time, not erase accountability.
How VDS Consultoria can help
VDS Consultoria can translate this broad industry warning into a proportionate security roadmap for a growing organization. That includes mapping systems and privileged access, reviewing Odoo and cloud integrations, establishing backup and recovery evidence, defining safe AI-agent permissions and selecting practical monitoring controls. We can also connect the work to business continuity, supplier governance and staff procedures so security does not live in a separate binder. The goal is a small set of verified controls that reduce real exposure, with clear owners and a review rhythm leadership can sustain.
What leadership should measure
A security program becomes credible when management can see whether exposure is shrinking. Track the percentage of privileged accounts protected by strong multi-factor authentication, critical patches completed within the agreed window, inactive accounts removed, backups restored successfully and security alerts investigated on time. Add supplier and AI metrics: integrations reviewed, service identities with excessive access, generated code that passed review and agent actions blocked by policy. Report exceptions with an owner and due date. Avoid a single vanity score that hides the underlying evidence. A short monthly review of trends, overdue risks and recent incidents is more useful than an annual dashboard assembled just before an audit. The board or owner should also know the maximum tolerable outage for core sales, finance and operations systems, and whether the latest recovery exercise met it.
Source
A call for collective action on cyber defense, OpenAI, 2026-08-28.