A collective cyber-defense call: why AI alone cannot secure essential systems

An open letter published this week calls for coordinated cyber defense. TheWrap's August 28 coverage dates its release to Thursday, August 27. OpenAI and technology and security companies are urging practical support for defenders, especially teams protecting essential services with limited resources. This is a call for collective action, rather than an announcement of a single confirmed breach.

What the letter asks for

The signatories warn about increasingly capable AI-enabled attacks and call for prioritizing weaknesses, verified repairs and practical assistance. This is a warning about risk, not a count of incidents that have already happened.

Security starts before software procurement

CISA's August 2024 Secure by Demand guide recommends considering product security during selection, contracting and follow-up after purchase. It suggests questions about security updates, MFA support, security logs and vulnerability reporting. This guidance predates the letter; it is not a new requirement announced this week.

In our assessment, that procurement perspective is useful for smaller organizations too. A team buying an employee application should ask more than how many features it offers. Who owns the repair of a vulnerability? How will the customer know what changed? What evidence will be available if something goes wrong? Turning those questions into clear criteria makes security part of the purchase decision itself.

Software development is part of defense

A CISA and FBI alert published in February 2025 addresses preventing buffer overflow vulnerabilities, including the use of memory-safe languages where appropriate. The broader point is that reducing exposure involves product design and code development as well as tools that observe attacks.

Our suggested starting point is a bounded piece of work that a team can complete: inventory its systems, assign an owner to each, and define how a repair will be verified. An important finding should become an actionable task that somebody can follow through, rather than another notification in a growing queue.

Consider an organizational example. If a problem is found in an internal application, who reviews it, who approves the change, and how does the team establish that the repair has not broken the required workflow? These are proposed response-management questions, not a description of a test we conducted or a local incident we observed.

AI may become part of that process. A more useful success measure is the risk reduced and the effectiveness of the repair, rather than the number of generated answers or alerts. The collective-defense argument becomes meaningful when it leads to a completed, checked improvement in the systems people rely on.

Sources

• OpenAI — A call for collective action on cyber defense
• CISA — Secure by Demand guide, August 2024
• CISA and FBI — buffer overflow alert, February 2025
• TheWrap — August 28 report on the Thursday letter