On 22 June 2026, the Five Eyes intelligence agencies issued a joint warning that AI models capable of serious cyberattacks on businesses are “months, not years” away, and told leaders to act now. The most important word in that statement is not “AI.” It is leaders. The agencies were explicit: cyber risk can no longer be treated as a technical issue parked with the IT department. It is a core business risk and a board responsibility.
For any CFO — and for anyone running or backing a portfolio company — that reframing has immediate, practical consequences. This article sets aside the geopolitics and deals only with what it means for the finance function, the boardroom, and the deal table.
Cyber is now a line on the risk register, not the IT budget
If your business still treats cyber as a cost centre owned by IT, the Five Eyes warning is your prompt to change that. The questions a board should be able to answer are financial and operational, not technical:
- What is our quantified exposure — revenue at risk, downtime cost per day, regulatory and contractual liability — if our primary systems are compromised?
- Who is the named executive accountable for cyber risk, and do they sit at or report directly to the board?
- When did we last test our incident-response plan, as opposed to merely owning one?
- What is our cyber-insurance position, and do we understand its exclusions — particularly around social engineering and authorised-push-payment fraud?
If those questions draw blank looks, the gap is a governance gap, and governance gaps are the CFO’s territory.
The fraud vector that lands directly on the finance team
Most coverage of AI cyber risk focuses on malware and system breaches. The exposure that should worry a CFO most is quieter and more immediate: impersonation fraud. AI has made convincing voice and video deepfakes cheap and fast. The “CEO” calling to authorise an urgent wire transfer, the “supplier” emailing updated bank details, the “auditor” requesting access — these are no longer crude attempts. They are polished, contextual, and increasingly real-time.
This is a finance-function problem before it is an IT problem, because the point of failure is a payment. The defences are process, not technology:
- Mandatory multi-person authorisation for payments above a defined threshold, with no exceptions for “urgent” requests.
- Out-of-band verification for any change to supplier bank details — a call back on a known number, never the one on the email.
- A standing rule that no payment is ever released on the basis of a voice or video instruction alone, regardless of who appears to be giving it.
- Staff training that treats these scenarios as live risks, not awareness-week theatre.
Authorised-push-payment fraud already costs UK businesses heavily; AI lowers the skill required to execute it and raises the success rate. This is the single most cost-effective control most finance teams can tighten this quarter.
What this means for private equity and M&A
For PE investors and anyone running a buy-and-build, the warning reshapes diligence. Cyber resilience is now a value-and-risk factor that belongs in the data room, not a post-completion IT integration afterthought:
- Diligence: assess the target’s patching discipline, identity controls, legacy-system exposure and incident history before completion. A target running unsupported core systems is carrying an unpriced liability.
- Portfolio standards: apply a consistent cyber-risk baseline across portfolio companies. Attackers increasingly target the smaller, softer business to reach the group.
- Value protection: a breach mid-hold damages both earnings and exit multiple. Resilience is now part of the equity story, not a compliance box.
- Warranty and insurance: expect cyber representations and W&I scrutiny to sharpen. Understand what is actually covered.
The upside the warning underplays
The Five Eyes statement is almost entirely about threat. For a CFO, the opportunity deserves equal weight — and the lowest-risk, highest-return AI use cases sit inside finance and risk:
- Continuous controls monitoring and anomaly detection across transactions, rather than periodic sampling.
- Faster, deeper due diligence and contract review.
- Reconciliation, exception reporting and close-process acceleration.
- AI-assisted security operations that let a lean team punch well above its weight.
The same technology driving the threat is the one that lets a finance function defend more and spend less. Adoption is itself a form of resilience.
The practical takeaway
The Five Eyes warning is not a reason to panic; it is a reason to govern. The fundamentals have not changed — most breaches still come through unpatched systems, weak identity and human error. What has changed is the speed and scale at which those weaknesses can be exploited, and the seniority at which responsibility now sits.
For the CFO, three actions this quarter: put cyber on the board risk register with a named owner and a tested response plan; harden payment-authorisation and supplier-verification controls against AI-enabled impersonation; and bring cyber resilience into your diligence and portfolio standards. None of these require new technology. They require treating cyber as what the intelligence agencies have now confirmed it to be — a core business risk, and a leadership responsibility.