Summary
- Australia, Canada, New Zealand, the UK, and US say hostile states increasingly use cyber operations, proxies, infrastructure targeting, and supply-chain exploitation.
- Ministers committed to deeper cooperation involving governments, civil society, technology providers, media, academia, and communities.
- The group also plans closer work with AI companies, including timely access to frontier models to strengthen cyber security.
The UK and four close intelligence partners have placed malicious cyber activity, critical-infrastructure targeting, supply-chain exploitation, and artificial intelligence inside a wider state-threat programme intended to deepen cooperation between governments and industry.
The Five Country Ministerial brought together home affairs, interior, and security ministers from Australia, Canada, New Zealand, the United Kingdom, and the United States in Sydney on 25 and 26 August.
The resulting communiqué says state threat actors are becoming more hostile and are increasingly using proxies, malicious cyber activity, critical-infrastructure targeting, harmful foreign investment, and exploitation of vendors and supply chains.
Artificial intelligence runs through that assessment as both an emerging source of capability for hostile actors and a technology the five governments want to use more extensively for security.
The countries committed to a whole-of-society approach involving governments, civil society, technology providers, media, academia, and communities. In cyber security, that reflects the extent to which national resilience depends on privately operated infrastructure and services.
Telecommunications providers, cloud companies, software vendors, financial institutions, and other technology suppliers can hold both the infrastructure through which hostile activity moves and evidence needed to identify it. Governments increasingly rely on those organisations during investigation and disruption while the companies themselves remain subject to privacy, contractual, and cross-border obligations.
Supply chains and vendors are explicitly included in the communiqué’s state-threat section. That places third-party exposure inside a wider national-security framework rather than treating it solely as an enterprise procurement problem.
A company does not need to be an adversary’s ultimate intelligence target to become operationally useful. A software supplier, contractor, service provider, or infrastructure operator may offer access to several downstream organisations or hold data and credentials that support a broader campaign.
The Five Countries also committed to deeper collaboration with industry on artificial intelligence, including enabling timely access to frontier models to support secure innovation and strengthen cyber security.
Ministers said they had discussed characteristics of AI systems that may warrant additional government scrutiny and exchanged lessons from national AI tabletop exercises.
That developing relationship between national-security agencies and frontier-model providers raises practical questions around access, governance, and control. Powerful systems may assist vulnerability analysis, intelligence processing, defensive automation, and other security tasks, while the same capabilities can be repurposed by hostile actors.
The resulting policy problem is not limited to whether AI is defensive or offensive. It concerns which organisations and users can access high-capability systems, what technical controls surround them, how activity is monitored, and how governments obtain access without undermining the security or commercial interests of providers and customers.
The communiqué also links cyber resilience with the protection of major international events. Ministers argue that security planning now needs to address not only venues and physical threats but critical infrastructure, cyber resilience, intelligence coordination, and cross-border disruption.
No new regulatory duties are created by the document. It is a ministerial statement of shared priorities rather than legislation, and the practical consequences will depend on subsequent national policies and operational agreements.
Its framing nevertheless shows how cyber security is becoming integrated with economic security, counter-espionage, critical technology, foreign interference, and supply-chain policy across the five countries.
The next test will be implementation: how governments share threat information with industry, what access they seek to commercial infrastructure and AI systems, what they expect from suppliers, and whether the programme produces concrete changes to procurement, incident coordination, or national-security oversight.
