AI and Cybersecurity: Why Collective Defense Matters

On August 27, 2026, OpenAI published an open letter called “A Call for Collective Action on Cyber Defense,” co-signed by more than 100 organizations including Microsoft, Google, Amazon, and much of the cybersecurity industry. The message is direct: AI-enabled cyberattacks are about to get faster and more sophisticated, and no single company, vendor, or technology platform can defend against that alone.

What the Letter Actually Says

The letter’s core argument is straightforward. Cybercriminals are already using automation and AI to improve the speed, scale, and sophistication of their attacks. As AI capabilities keep advancing, attackers gain new ways to find weaknesses, write convincing phishing messages, automate reconnaissance, and adjust their tactics quickly.

That does not call for panic. It calls for urgency. The traditional approach to cybersecurity, waiting for something to go wrong and responding after the fact, was already falling behind before AI entered the picture. AI is raising the stakes on problems that were already there.

The Weaknesses AI Attackers Actually Exploit

Many organizations are still running on the same longstanding gaps: unpatched systems, excessive user permissions, misconfigured cloud services, weak or inconsistent authentication, legacy systems carrying years of technical debt, thin security staffing, incomplete incident response plans, and employees using technology without much training or guidance.

None of these are new problems. AI just makes them more expensive to ignore.

AI Can Help Defenders Too

The letter’s other point gets less attention: AI is a real opportunity for the people defending against these attacks, not only the people attacking. Used responsibly, AI can help identify vulnerabilities, analyze large volumes of security information, speed up threat detection and response, accelerate investigation and documentation, support security awareness training, help maintain security procedures, and make specialized security knowledge more accessible to teams without a dedicated security hire.

AI does not replace an experienced security professional’s judgment, and it does not replace organizational accountability for what happens next. It can make the people already doing that work faster and more consistent.

What This Means for Business Leaders

The letter is a reminder that cybersecurity belongs on the leadership agenda, rather than something filed under IT problems and handed off. No organization needs to solve every risk at once. What matters is knowing which weaknesses create the most exposure and having an actual plan to close them.

That starts with a specific set of questions: which systems and information matter most to your organization, where your highest-risk vulnerabilities actually are, who has access to sensitive systems and data, whether your authentication and access controls are strong enough, whether your backups are protected and actually tested, whether employees know how to recognize and report something suspicious, whether you could respond effectively if a real incident happened, whether a vendor or technology partner is quietly adding risk, how employees are actually using AI tools day to day, and whether your security policies still reflect how your organization actually works today.

AI Adoption Brings Its Own New Risks

None of this exists separately from AI governance. Adopting AI responsibly and defending against AI-enabled attacks are the same conversation, not two different projects.

AI adoption raises its own questions: data privacy, confidential information, identity and access, shadow AI use, third-party platforms, AI-generated code, human review, automated decision-making, agent and workflow permissions, and who is actually accountable for the records AI touches.

Buying a license for ChatGPT, Microsoft Copilot, or Google Gemini does not make an organization AI-enabled. What actually matters is deciding how those tools get used, what information they can access, and how people are trained to use them well. Our AI services page covers how we approach that piece specifically.

Where to Actually Start

Collective action, the kind the letter is calling for, starts with practical steps at the individual organization level: identify and fix the highest-risk weaknesses first, strengthen authentication and access controls, keep systems and devices patched, protect and actually test backups, put clear security policies and procedures in writing, train employees regularly rather than once a year, review vendor and third-party risk, build and test an incident response plan, set responsible AI-use guidelines, and work with a technology partner you actually trust.

The right starting point looks different for a rural hospital than it does for a financial institution, a manufacturer, a nonprofit, or a local government office, different systems, different regulations, different budgets. What matters is moving from knowing about the risk to actually doing something about it.

Cybersecurity Is a Shared Responsibility

No organization can eliminate cyber risk completely. Every organization can improve its readiness, close preventable gaps, and build better habits around security over time.

Technology partners have a role in making cybersecurity practical and affordable rather than overwhelming. AI companies have a role in building secure tools and supporting responsible use. Governments have a role in helping coordinate funding and information sharing. Business leaders have a role in treating cybersecurity as part of running the organization well, not as a side project.

At First Call, we treat cybersecurity and AI as connected parts of the same job: helping organizations understand their risk, strengthen their environment, and build real discipline around security, while also helping them adopt and govern AI responsibly rather than bolting it on and hoping for the best.

Frequently Asked Questions

What is OpenAI’s “Call for Collective Action on Cyber Defense”?
It is an open letter published by OpenAI on August 27, 2026, co-signed by more than 100 organizations including Microsoft, Google, Amazon, and much of the cybersecurity industry, calling on organizations, technology providers, governments, and AI companies to strengthen cyber defenses together as AI-enabled attacks become more capable.

Does this mean AI is making cybersecurity worse?
It means AI is raising the stakes on weaknesses that already existed, unpatched systems, weak authentication, thin security staffing. AI can also help defenders close those same gaps faster, which is the other half of the letter’s argument.

What should a small or mid-sized organization actually do first?
Start by identifying your highest-risk weaknesses rather than trying to fix everything at once. A structured assessment, like our SecurityStack Challenge, gives you a clear, specific starting point instead of a generic checklist.

Does buying an AI tool like Copilot or ChatGPT make an organization AI-enabled?
No. The tool itself is just a license. What actually matters is deciding how it is used, what information it can access, and how employees are trained to use it responsibly.

Is this relevant to organizations outside of tech and finance?
Yes. The letter specifically names hospitals, water treatment plants, and the infrastructure that powers the internet as being at risk. This applies to healthcare, government, manufacturing, and nonprofit organizations just as much as it does to banks and tech companies.