AI and the Escalating Threat of Nation-State Cyber Operations

We have previously written about the critical importance of public company boards maintaining focus on cybersecurity risk oversight, including in the face of burgeoning cybersecurity risks arising from the proliferation of advanced AI models and tools. An issue meriting immediate specific focus is the growing threat posed by nation state and state sponsored actors conducting malicious cyber operations, including espionage, theft, and sabotage of critical infrastructure.

Nation state and state sponsored cyber actors have inflicted substantial damage on companies and governments for more than a decade. Examples include operations attributed to North Korea (including the Lazarus Group, linked to the 2014 Sony Pictures hack and massive cryptocurrency thefts), Russia (including the SolarWinds supply chain compromise and the NotPetya malware attack), China (including cyber enabled IP theft and efforts to infiltrate critical U.S. infrastructure) and Iran (including attacks on U.S. water systems and, this year, a destructive wiper attack on a major U.S. medical device company). The nature of the threat can vary by industry, ranging from operational sabotage for infrastructure operators and IP theft for technology and life sciences companies, to financial theft for firms with digital asset exposure. As advanced AI tools become ever more capable, they are significantly enhancing these actors’ already powerful ability to find vulnerabilities, automate attacks, and operate at scale, increasing both the likelihood and potential severity of cyber incidents affecting public companies.

The time to prepare is now. Below are some recommendations for corporate boards and management to consider in guarding against these threats.

• Strengthen layered defenses with AI assisted tools. AI tools are already uncovering latent vulnerabilities in corporate systems, and their reach will only grow. The question is not whether AI will be used to probe a company’s systems, but whether the company’s own security function will have done so first and have undertaken timely remediation. Boards should oversee management’s framework for risk based use of AI assisted vulnerability assessment and other defensive tools, alongside established security controls, timely remediation, and appropriate human oversight and safeguards for sensitive information.
• Dedicate sufficient resources to prevention and cyber resilience. Defending against state sponsored and other sophisticated threats requires sustained, risk based investment in prevention, detection, response, and recovery. Boards should oversee management’s allocation of sufficient funds to support robust internal and external resources, appropriately tailored for the company’s industry, activities and applicable regulatory requirements. This may include periodically obtaining independent cyber assessments from qualified third party experts. Boards should consider seeking regular reporting on material weaknesses, remediation progress, and the testing of business continuity and recovery capabilities.
• Enhance transactional cyber due diligence. In the face of growing threats, cyber due diligence on acquisition targets (and self diligence by prospective targets) should go beyond a “check the box” exercise and be a key focus in many M&A transactions, as well as in material financings, drawing on specialized diligence providers where appropriate. Cyber due diligence may be tailored to the relevant cyber exposure and transaction risks, including prior incidents, unresolved vulnerabilities, remediation needs, and, in acquisitions, post closing integration risks.
• Evaluate and manage third party cyber risk. Boards should oversee management’s assessment, ongoing monitoring, and mitigation of the cybersecurity practices of key vendors, suppliers, and other third parties that support critical operations or have material access to the company’s systems or data. Weaknesses in a company’s ecosystem may present risks comparable to vulnerabilities within the company itself.
• Prepare and rehearse incident response plans. Nation state actors may maintain undetected access for months or years before acting. AI can accelerate reconnaissance, exploitation, and subsequent operations, making continuous monitoring and rapid response increasingly important. Accordingly, boards should oversee management’s framework for developing and periodically testing incident response and recovery plans. That may include clear internal authority and protocols for timely escalation to senior management and the board, materiality assessments, and required disclosures; preestablished relationships with external advisors, including incident response firms, outside counsel, and communications advisors; and procedures for prompt engagement with relevant law enforcement and government authorities. Suspected nation state intrusions implicate national security as well as corporate interests, and early government engagement can bring intelligence and assistance a company cannot obtain on its own.