- On June 22, 2026, the Five Eyes alliance warned that AI is accelerating cyber threats and organisations have months, not years, to act.
- Because attackers are increasingly leveraging AI to target identities & credentials, the alliance now views access control as a governance issue, requiring board-level oversight.
- Boards should expect evidence, not claims, that access controls will hold under AI-accelerated conditions.
- In the next 90 days, boards should assess visibility into SaaS & AI usage, validate access controls, and establish reporting that demonstrates controls are working effectively.
- LastPass gives your team AI app discovery, authentication controls, and audit-ready access logs to align with the Five Eyes advisory.
TL; DR: What the board will ask
If you’re preparing to address the new Five Eyes guidance with your board, expect these six questions:
- Why is Five Eyes commenting on access security?
- How has AI changed the credential threat landscape?
- How can you prove your controls work?
- Why does SaaS sprawl and shadow AI make this harder?
- As a CISO, what should you tell your board?
- What does an actionable 90-day response plan look like?
This post is written to help you answer each one.
Why is Five Eyes commenting on access security?
Five Eyes is commenting on access security because AI has accelerated attacks, particularly the speed and scale of credential-based attacks.
As a result, the alliance now views access control as a board-level responsibility.
On June 22, 2026, Five Eyes issued a joint statement that, with AI supercharging the threat landscape, the timeline to act is months, not years.
The statement explicitly places responsibility on organisational leadership, noting:
"Cyber risk can no longer be treated as a purely technical issue. This is a core business risk and leadership responsibility."
While Five Eyes isn’t a regulatory framework, its guidance reinforces expectations already reflected in major regulations across the UK, US, Australia, Canada, and New Zealand (see box below).
The common requirement is consistent: Organisations must govern identity and credential risk and demonstrate that access controls are effective.
What is AI access governance?
AI access governance is the ability to:
- See every app and access point in your organisation.
- Apply appropriate authentication controls to every user and app.
- Produce evidence that controls are functioning as intended.
Visibility, control, and evidence form the framework for evaluating access governance under the Five Eyes guidance.
The guidance reinforces existing regulations and governance frameworks:
Australia
Privacy Act 1988 (with 2024 amendments)
United Kingdom
NCSC Cyber Assessment Framework
UK Cyber Governance Code of Practice
United States
NIST Cybersecurity Framework (CSF 2.0)
SEC Cybersecurity Disclosure Rules
CISA Secure by Design principles
Canada
Cyber Security Readiness Goals
New Zealand
NZISM (New Zealand Information Security Manual)
How has AI changed the credential threat landscape?
AI has dramatically lowered the barrier for attackers. What previously required skills, money, and sustained effort now takes just a capable model and credential database.
Both are affordable and increasingly commoditised.
The practical effects are:
Speed. Mandiant's M-Trends 2026 report says mean time to exploit (TTE) is now about -7 days. In other words, attackers are operating faster than organisations can patch or remediate.
The report also warns that the time between an attacker gaining initial access and a secondary actor launching operations is now just 22 seconds.
Previously, attackers had a window of time to respond before the second threat actor could act. But at 22 seconds, that window has collapsed.
Scale. AI lets attackers process credential datasets, generate phishing scams, and test access pathways at volumes that were previously impractical.
Evasion. AI-generated phishing content increasingly resembles legitimate communications, making credential-based attacks harder for traditional tools to detect.
This is the operational context for the Five Eyes guidance. AI has supercharged what attackers can do and shrunk the time defenders have to detect and respond.
How can you prove your controls work?
You can prove your controls work by demonstrating visibility, enforcement, and evidence of governance.
Why this is critical
- Having MFA deployed doesn’t mean you can demonstrate MFA is enforced for every user, app, and login.
- Having a password policy doesn’t mean the policy is functioning as intended.
- Having a security framework doesn’t mean you can answer where your enforcement gaps are.
Boards, auditors, insurers, and regulators expect evidence rather than claims.
In practice, your organisation should be able to answer three questions on demand:
- What access points exist across your environment?
- What authentication controls protect them?
- What evidence demonstrates those controls are working effectively?
If any of those questions can’t be answered quickly and confidently, you likely have an exposure that requires attention.
Why does SaaS sprawl and Shadow AI make this harder?
SaaS sprawl and shadow AI create unmanaged access pathways that are difficult to monitor.
Most teams have reasonably strong controls over their core, IT-managed app stack. The gap is in SaaS.
The average organisation now uses significantly more SaaS apps than IT can track.
Those apps are often accessed with weak, reused, or compromised credentials. They may also be outside your SSO.
And under the Five Eyes threat model, they are exactly the entry points AI-accelerated attacks are designed to find and exploit.
As a CISO or security leader, what should you tell your board?
You should explain current exposure, demonstrate controls are effective, and present a plan for closing identified gaps.
The June 22, 2026, Five Eyes statement emphasizes control effectiveness and leadership accountability.
The most important board discussions will focus on:
- Visibility into SaaS & AI usage (or the lack thereof)
- Whether critical authentication controls exist or are missing
- Progress toward remediation
- A concrete plan for measuring improvement over time
The goal is to demonstrate that you understand the risks, can measure them, and have a credible roadmap for improvement.
What does an actionable 90-day response plan look like?
In the next 90 days, work to identify access blind spots, validate the effectiveness of controls, and establish board-level reporting.
The practical path to AI access governance begins with visibility.
For most organisations, that means starting with the full app surface, not just the managed stack.
90-day AI access governance action plan
First 30 days
- Identify AI apps in use across your org.
- Inventory SaaS apps outside managed SSO.
- Review authentication coverage for workforce identities.
Days 30–60
- Assess credential policy enforcement.
- Identify unmanaged or orphaned accounts.
- Establish ownership for critical SaaS and AI apps.
- Review governance and audit-reporting capabilities.
- Define board-level metrics.
Days 60–90
- Produce an access governance assessment.
- Document visibility gaps.
- Prioritize remediation activities.
- Brief leadership and the board on findings and planned actions.
How does LastPass support board-level AI access governance?
LastPass supports AI access governance by helping you strengthen your identity and access controls.
The Five Eyes advisory emphasizes board-level accountability, secure-by-design, and defence-in-depth.
With its new secure-by-design architecture, LastPass is purpose-built to help you reduce identity-related risk while supporting board-level oversight as part of a broader defence-in-depth strategy.
Three LastPass capabilities are particularly relevant if you’re preparing for a board-level discussion:
- SaaS Monitoring lets you see the full access environment by identifying SaaS and AI usage.
- SaaS Protect lets you act on that visibility with real-time usage rules and policy enforcement.
- Access logs and reports help you demonstrate how access is protected and whether key controls are working as intended.
See how your organisation can produce board-ready evidence today. Speak to our team to assess your governance readiness or start your free LastPass Business trial.
Sources
Reuters: 'Five Eyes' intelligence alliance warns that new AI models pose urgent cyber risk
