A collective call for cyber defence: plenty of signatures, no obligations, nothing to measure

On Thursday 27 August 2026 an open letter titled “A call for collective action on cyber defense” was published on OpenAI's website. The document gathers a mixed front of organisations: the exact head count varies depending on who is counting, from the 116 tallied by CNBC to the nearly 130 reported by SecurityWeek. The signatories include AI companies such as OpenAI, Anthropic and Google, infrastructure and security providers (Microsoft, AWS, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks), firms from other sectors such as Visa, Mastercard and General Motors, and European groups including SAP and Deutsche Telekom. The initiative arrives at a moment of intense regulatory attention, a few weeks after the European AI Act's rules on systemic-risk models entered into application on 2 August 2026.

The text rests on three guiding principles. The first notes that current defences are not enough, weighed down by the technical debt of legacy systems, misconfigurations and unpatched software. The other two call for putting AI tools in defenders' hands and for mobilising a coordinated response. Organisations are asked to treat defence as a leadership priority, to fix the highest-risk vulnerabilities first and to apply compensating controls where patching would break essential services. Security vendors are asked to test their own systems against frontier models; governments are asked to fund essential infrastructure that has no resources of its own. In the same context OpenAI announced three commitments of its own, among them subsidised access to its Daybreak Cyber model line for public bodies, non-profits, open source software maintainers and critical infrastructure operators, alongside authorised testing programmes for private vulnerability disclosure.

“We have a limited window to strengthen cyber defences,” the document reads. Yet the letter goes no further than sketching intentions that are strictly voluntary. There are no operational deadlines in the text, no formal budget allocations and no reproducible metrics for judging whether the resources handed out actually work. The stance of the AI companies has drawn criticism: security expert John Gallagher summed up the ambiguity of the vendors' role by calling them “an arsonist selling fire extinguishers”. The contradiction the comparison points to is documented: the very companies signing the letter sell commercial models that make attacking cheaper.

Acknowledging that traditional systems are no longer enough is a necessary starting point; recommending measures without setting a timetable or audit criteria risks reducing a structural problem to a statement of intent. Whether the initiative is of any real use will only be measurable once data on its operational impact is made public and open to verification. — Olya