Cyprus urged to strengthen cyber defences as AI threats accelerate

DCO warns governments to act before faster cyber threats strikeCyprus already has a relatively demanding framework for reporting cyber incidents, with a 6-hour early warning deadline and a fuller notification requirement within 72 hours, but the country must ensure its institutions can respond effectively as artificial intelligence accelerates cyber threats, according to a new report by the Digital Cooperation Organisation (DCO). The findings appear in the organisation’s September 2026 edition of DCO Policy Watch, titled ‘Resilience at Machine Speed: National Cyber Defense in the Age of AI‘, which examines how governments can strengthen their defences against increasingly automated attacks and prepare for the eventual transition to quantum-resistant cryptography. The report places Cyprus among jurisdictions with a defined incident-reporting interval in force, noting that its Article 35B requirements establish a tighter initial reporting timeframe than the default under the European Union’s NIS2 Directive. However, it cautions that having a deadline does not automatically mean a country can respond effectively, with the resources, staffing and operational capabilities behind the rules ultimately determining their value. For Cyprus, the broader lesson is that existing reporting requirements should form part of a comprehensive national strategy that connects early warnings to effective incident response, investment in defensive artificial intelligence and preparation for future cryptographic risks. The report argues that cyber resilience is not simply a level of protection a government purchases, but the ability to detect an intrusion, contain it, maintain essential services and recover afterwards. That capacity must be built, staffed and tested before an attack occurs. The urgency is increasing. CrowdStrike’s observations of financially motivated cybercrime in 2025 found that the average time taken by an intruder to move from an initially compromised machine to a second machine had fallen to 29 minutes, while the fastest observed case took just 27 seconds. In July 2026, autonomous AI agents operated by OpenAI conducted a four-and-a-half-day campaign that included an intrusion into the production infrastructure of Hugging Face, the largest public repository of open-source AI models. The agents were given objectives, tools and permission to act across multiple steps without a person directing each individual action, illustrating how attacks can unfold with little or no immediate human intervention. The report warns that the time available for people to make decisions during an incident is shrinking, making advance preparation increasingly important. The financial consequences of inadequate preparation are illustrated by Costa Rica, where a ransomware campaign in 2022 prompted a response across 10 institutions that the country’s Comptroller General assessed at roughly 14 times the institutions’ combined cybersecurity spending in the preceding year. Costa Rica had a national strategy, a designated ministry, a response team and an audit that had identified the ministry that subsequently failed. What it lacked, according to the report, was sufficient funding, an operational plan and an enforceable reporting obligation. The DCO identifies three pillars of national cyber resilience that governments, including Cyprus, should prioritise. The first is establishing the institutional foundations needed to respond to incidents, including a published national strategy, a designated authority, clear reporting requirements and deadlines, and a trained workforce. The report says these components are complementary rather than interchangeable, warning that a reporting duty has limited value if the receiving team lacks the capacity to act. Although incident-reporting obligations exist across almost all DCO member states, measurable deadlines are less consistently established. It recommends that governments attach clearly defined reporting intervals to existing legal obligations, taking account of the severity of incidents and the information reasonably available, while ensuring the receiving institutions have the resources to respond. Ghana provides one example, requiring incidents to be reported to the relevant sectoral or national team within 24 hours of detection. The second pillar concerns artificial intelligence and the changing balance between attackers and defenders. The report distinguishes between human attackers using AI to discover vulnerabilities more quickly, autonomous AI agents acting without continuous human direction, and defensive applications of AI that help security teams identify weaknesses, assess incidents and test systems. It says public evidence is not yet sufficient to establish whether AI overall favours attackers or defenders, but stresses that offensive tools are becoming more accessible. DCO member states A campaign against government systems reported in August 2026 was assembled using open-source agent frameworks, illustrating that sophisticated capabilities are not necessarily restricted to the companies developing the most advanced AI models. The report therefore recommends stronger basic security controls, greater use of AI for defensive purposes and coordinated governance of advanced AI systems. It also urges governments to record the degree of automation involved in cyber incidents, rather than relying exclusively on classifications of attack techniques. Such reporting should allow an incident to be marked as “unknown” when the available evidence cannot establish whether actions were automated or directed by a person. Singapore’s June 2026 guidance on securing agentic AI provides an example of how governments can identify vulnerabilities in automated workflows and apply appropriate safeguards. For Cyprus, the findings point to the importance of ensuring that existing cyber security procedures account for attacks involving autonomous systems, while testing whether defensive AI tools can perform useful work under real incident conditions. The report notes that, during the July 2026 Hugging Face incident, commercial AI models initially used by responders refused much of the forensic work because their safeguards could not distinguish between someone investigating an attack and someone conducting one. An open-weight model running on the platform’s own hardware subsequently helped responders decode staged payloads, demonstrating the value of testing alternative tools before an emergency arises. The third pillar is preparing for quantum computing, which could eventually undermine some of the public-key cryptographic systems currently used to protect data and authenticate communications. The report warns of the “harvest now, decrypt later” risk, in which attackers collect encrypted information today in the expectation that future computing capabilities will allow them to decipher it. Because replacing vulnerable cryptography across government systems can take years, preparation should begin before quantum computers capable of breaking existing protections become available. The first step is to establish an inventory of the cryptographic algorithms used to protect information in transit and at rest, as well as those used to verify identities. The report says this can begin without specialised quantum expertise or new procurement. It recommends introducing inventory requirements through existing regulatory instruments, updating national cryptographic standards to include quantum-resistant algorithms and amending rules governing public key infrastructure, including electronic signatures and trust services. Governments should then develop funded migration plans that identify responsible institutions, prioritise systems according to risk and establish testing and completion milestones. The United States has estimated that migrating prioritised federal systems, excluding national security systems, will cost €6.25 billion ($7.10 billion), illustrating the scale of the investment involved. The report also highlights how long cryptographic transitions can take, citing 22 years between the publication of the Advanced Encryption Standard and the National Institute of Standards and Technology’s cutoff for applying new protection with Triple DES, and 25 years between the first theoretical attack on SHA-1 and its planned retirement in 2030. The DCO’s proposed roadmap divides action into three stages, beginning with foundational measures that allow governments to understand their own systems, progressing to operational capabilities, and culminating in advanced capabilities that member states can develop more effectively through cooperation. Alongside reporting deadlines and cryptographic inventories, it recommends identifying essential services that should receive priority protection, ensuring cyber response teams are staffed around the clock and testing defensive AI tools before they are needed. The report concludes that much of the initial work involves improving existing laws, procedures and administrative systems rather than developing new technology. However, sustained funding is still required to maintain specialist teams, train and retain staff and complete cryptographic migration. For Cyprus, the priority is to build on its existing reporting framework by ensuring that warnings lead to effective action, while starting the long-term work of mapping and upgrading vulnerable cryptographic systems. The report argues that governments can make substantial progress using authorities and resources they already possess, while regional cooperation can help share the cost of capabilities that would be difficult for individual countries to maintain. Its central message is that the time available for institutional preparation remains, even as the time available to intervene during an attack continues to shrink.