The Dutch government has issued a Government Warning for businesses due to the rapidly increasing cyber threat posed by artificial intelligence (AI). The AIVD, MIVD, the NCSC, the NCTV, the Public Prosecution Service, the Chief Information Officer of the Central Government, and the National Police jointly call upon executives and management to prioritize cybersecurity now.

The reason for this exceptional joint warning is clear: AI makes it possible to to carry out cyberattacks faster, easier, and on a much larger scale. It is not only professional cybercriminals who benefit from this. State actors and less experienced attackers can also deploy AI to find vulnerabilities, improve phishing attacks, and automate parts of a cyberattack.

The seven organizations jointly published the statement regarding this on September 24, 2026. AI is accelerating the threat: acting now is necessary..

Seven government organizations warn jointly

What is special about this warning is that various organizations responsible for national security, cybersecurity, investigation, and intelligence are jointly issuing the same message. It concerns the:

The fact that these organizations are speaking out jointly underscores the urgency. AI is changing the cyber threat landscape at a rapid pace. Existing vulnerabilities do not disappear; instead, AI allows them to be detected more quickly and exploited more efficiently.

Why does AI make cyberattacks more dangerous?

Traditionally, carrying out advanced cyberattacks required extensive technical knowledge. AI lowers part of that barrier.

Malicious actors can use AI to analyze large amounts of information, identify vulnerabilities, generate programming code, make phishing messages more convincing, and automate parts of attacks.

As a result, experienced attackers become more efficient, while at the same time less specialized criminals gain access to techniques that previously required significantly more knowledge.

The NCSC describes this development in detail in the analysis. Artificial Intelligence in the Cyber Kill ChAIn.

Weeks become days and days become hours

One of the most important changes is speed.

As soon as a vulnerability in widely used software becomes known and a security update becomes available, a race ensues between defenders and attackers. Companies must fix the vulnerability before it is exploited.

“After all, weeks turn into days, and those days turn into hours when it comes to updating.”

With the help of automation and AI, attackers can investigate which systems are vulnerable much faster. This means that organizations that install critical security updates weeks later face an increasingly greater risk.

Good patch management thereby becomes an essential part of business continuity.

AI makes phishing much more convincing.

The danger is not limited to technical vulnerabilities. Generative AI can produce texts that are barely distinguishable from messages actually written by an employee, supplier, or director.

Moreover, an attacker can collect public information about an organization, employees, and business relationships and use that information to personalize phishing and social engineering.

For example, an employee might receive a persuasive email that appears to come from a director, colleague, or regular supplier. AI makes it possible to personalize such messages quickly and on a large scale.

The development of synthetic voices, images, and video also makes traditional indicators less reliable. Therefore, simply warning employees about spelling errors in phishing emails is no longer sufficient.

State actors also pose a cyber threat.

The digital threat does not come exclusively from cybercriminals. Dutch security services have long been warning about digital activities by state actors.

This may include, among other things, digital espionage, obtaining commercially sensitive information, intellectual property, or access to organizations that are part of major Dutch supply chains.

For companies, this means they must look beyond just the risk of ransomware or financial fraud. Personal data, research information, technical knowledge, business processes, and access to customers or suppliers can also be of interest to attackers.

Cybersecurity is a matter for the executive and board.

An important part of the government warning is that cybersecurity is not solely the responsibility of the IT department.

Digital security has now become an issue of business continuity, risk management, and governance responsibility.

Executives and boards of directors should therefore know, among other things, which systems are critical to their organization, which data must be absolutely protected, how quickly critical security updates are implemented, and which systems are accessible from the internet.

In addition, it must be clear whether outdated systems are being used, whether multifactor authentication is configured, how backups are protected and tested, and who within the organization makes decisions when an actual cyber incident occurs.

What should companies do now?

At its core, the joint message of the seven organizations revolves around three measures.

1. Ensure the digital foundation is in order.
Reduce the attack surface, replace outdated systems, install security updates in a timely manner, and ensure that employees are aware of current digital risks.

2. Reassess whether the current security is still sufficient.
A security policy that was adequate a few years ago may no longer align with the current threat level. Pay particular attention to patch management, access security, monitoring, backups, and incident response.

3. Prepare the organization for a real cyberattack.
Do not wait until an incident occurs. Ensure in advance that responsibilities are clear, procedures are tested, and technical experts are involved in new risks.

The Cybersecurity Act and NIS2 make cybersecurity even more important.

Moreover, the warning comes at an important moment. On The Dutch Cybersecurity Act entered into force on August 15, 2026.. With this, the European NIS2 Directive has been implemented in the Netherlands.

For organizations subject to the Cybersecurity Act, specific obligations apply regarding digital resilience, risk management, governance, and the reporting of specific cyber incidents.

More information about this is available via Digital Government and the National Cyber Security Center.

However, companies that do not fall directly under the law can also be affected. Organizations are imposing increasingly high cybersecurity requirements on suppliers and supply chain partners. After all, an attacker can attempt to gain access to a larger organization through a relatively small supplier.

Start with the basics, not with expensive AI security.

The warning does not mean that every company must immediately purchase new and expensive AI security software.

On the contrary. A large part of digital resilience still starts with the basics: up-to-date software, good patch management, multifactor authentication, secure backups, limited access rights, monitoring, good procedures, and employees who recognize and report suspicious situations.

AI primarily changes the speed at which vulnerabilities can be found and exploited.

A vulnerability that becomes known today can be automatically tested at large numbers of organizations within a short time. Therefore, it is not only important or a company performs security updates, but especially how quickly the company is able to remedy critical vulnerabilities.

Don't wait for the first cyber incident

The joint warning from the AIVD, MIVD, NCSC, NCTV, Public Prosecution Service, Chief Information Officer of the Central Government, and the National Police shows that the development of AI has consequences for virtually every organization that depends on digital systems.

Directors must know what digital risks their organization faces, what measures have been taken against them, and what happens if those measures are breached.

Cybersecurity is therefore not a technical subject that can be left solely to IT. It touches directly upon business continuity, reputation, financial risks and managerial responsibility.

AI gives attackers one important advantage in doing so: speed.

The most important question for executives is therefore not whether AI changes the cyber threat, but whether their organization changes quickly enough to keep up with that new threat.

Government warning
SHARE ONLINE:
ABOUT THIS ARTICLE: