Five steps to build cyber resilience in a frontier AI era

As the latest generation of highly capable, fast-evolving AI systems — often called frontier AI — begin to reshape how cyber threats are identified and exploited, organizations face a step change in both scale and speed.

Organizations experienced an average of 1,968 cyber attacks per week in 2025,¹ rising to 2,270 by 2026.² What once required skilled human operators is increasingly automated, enabling attackers to discover vulnerabilities faster, move across connected systems easily and exploit weaknesses before many can respond.

This doesn’t redefine what good cybersecurity looks like. But it does raise the bar. Effective cyber resilience must now be continuous, integrated and able to operate and adapt at machine speed.

Here are five practical priorities for leaders

1. Identify all assets in real time to remove blind spots

You can’t defend what you can’t see.

A recent EY study found that 70% of cybersecurity leaders believe their greatest risks sit in blind spots — overlooked assets such as routers, VPN gateways and edge appliances.

Frontier AI increases the risk because weaknesses can now be discovered and exploited faster than ever and combined into attack paths before teams can respond. More than one-third of organizational assets now sit in "vulnerability zone," with below-average visibility. In this environment, a static or periodic view of assets quickly becomes outdated, leaving leaders with limited visibility over a growing attack surface.

What to do:

• Continuously discover all assets, identities and connections across your environment.
• Replace static asset inventories with automated, real-time visibility.
• Build a single, integrated, live view of your attack surface.

Outcome: A complete, current picture of your environment so risks can be identified and prioritized before they are exploited.

2. Reduce exposure instead of chasing every vulnerability

Eliminating every cyber risk has never been realistic ­­­— and in a frontier AI environment, it becomes impossible.

When vulnerabilities can be discovered at speed and scale, organizations must shift focus from fixing everything to reducing the “blast radius” of any single breach. That means looking beyond vulnerabilities and understanding which weaknesses create exposure to critical systems, data and business operations.

What to do:

• Identify the attack paths that create the greatest exposure.
• Prioritize high-risk assets, including legacy and operational technology systems.
• Segment networks to limit how far attackers can move.
• Design security architectures that assume vulnerabilities exist. 

Outcome: Even if attackers gain access, potential damage can be contained.

3. Automate detection and response to match machine-speed attacks

Frontier AI compresses the timelines between vulnerability detection and exploitation – potentially from days to hours. In some cases, attackers have moved from initial compromise to breakout in as little as 27 seconds.³ This creates a gap that human-led processes cannot close.

As attack timelines compress, cyber resilience must evolve from a manual human-speed response to machine-speed detection, prioritization and containment.

What to do:

• Use AI to prioritize and remediate the most critical exposures.
• Automate detection, response and containment wherever possible.
• Embed policies and guardrails, so routine actions happen without manual intervention.
• Adapt reporting processes to meet faster regulatory timelines.
• Track ownership, control coverage and remediation status for critical assets.

Outcome: Faster, more consistent responses — reducing the window of opportunity for attackers.

4. Manage third-party risk as a continuous exposure

Cyber resilience no longer stops at your organizational boundary.

A weakness outside the enterprise can become part of an attack path to critical operations, applications or data. Suppliers, partners and vendors are now part of your attack surface — and frontier AI can accelerate the speed at which their vulnerabilities affect your organization.

What to do:

• Continuously monitor third-party access to your systems.
• Limit access to what is strictly necessary.
• Verify that partners maintain appropriate security controls.
• Treat third-party risk as an ongoing process, not a periodic check.

Outcome: Reduced risk from external dependencies that are harder to control directly.

5. Embed cyber resilience into core business decision-making

Cybersecurity is no longer a technical function but a core component of business resilience. Cyber incidents now affect operations, reputation, cost and compliance at an enterprise level. As cyber risk becomes more interconnected with business operations, resilience depends on shared accountability across leadership teams, not solely within the cybersecurity function.

What to do:

• Define critical services, assets and dependencies that support business continuity.
• Continuously monitor resilience across the organization.
• Regularly test the speed and effectiveness of response and recovery.
• Integrate cyber risk into strategic planning and executive decisions.
• Provide clear, current measures of exposure, control coverage and recovery readiness.

Outcome: Cyber resilience becomes a business capability, not just a security function.

Build adaptive cyber resilience for whatever comes next

Frontier AI is one cyber inflection point, but it won’t be the last. Advances in AI, quantum computing and other emerging technologies will continue to reshape the landscape.

The most resilient organizations are not those that respond best to a single threat, but those that can anticipate, adapt and recover continuously — even as risks accelerate. Resilience increasingly depends on continuous visibility, adaptive controls and shared accountability across the enterprise.

This article was developed in accordance with EY editorial guidelines. GenAI was used to develop an iteration of this article; the end product was reviewed and edited by EY professionals before publication.