For Irish businesses, the right response is not alarm. It is action.
Waiting to see what happens is not a strategy. This post sets out what the letter says, why it matters for businesses here, and what practical preparation looks like for organisations without a large security team.
The letter, titled "A call for collective action on cyber defense", was published by OpenAI on 27 August 2026 and urges businesses, governments and technology companies to act together. It opens with a plain statement: "We have a limited window to strengthen cyber defenses."
It launched with more than 100 signatories from AI, technology, cybersecurity and finance. These include Anthropic, Amazon Web Services, Cisco, Cloudflare, CrowdStrike, Google, IBM, Microsoft, Oracle, Palo Alto Networks, Shopify, Visa and Zurich Insurance Company. More organisations have signed since. You can read the full letter and the list of signatories on OpenAI's website.
Its central warning is that AI-enabled attacks are likely to become far more widespread and sophisticated in the coming months. It sets out three principles:
For individual organisations, the ask is direct: make cyber defence a leadership priority, fix the highest-risk weaknesses, confirm the fixes work without disrupting essential services, and raise security expectations for the systems you buy, build and use.
It is worth being clear about what the letter is. It is a set of recommendations, not a report of a specific attack, and it does not bind anyone to act. Its value is in the direction it sets.
Most Irish businesses are not being singled out. They are being caught in wider attacks on common weaknesses, and that makes preparation relevant to everyone, not just large or high-profile organisations.
As The Irish Times reported, research from Gallagher and the Centre for Economics and Business Research found that around two-thirds of Irish businesses had been hit by at least one cyberattack in the past year. Security consultant Brian Honan noted that attacks are rarely targeted. More often, companies are victims of larger campaigns aimed at a software weakness.
The recent SuperValu incident shows how quickly the effects can spread. According to the same report, refrigeration units in 13 stores showed abnormal temperatures, and some stores had to dump stock because they could not guarantee it had been stored safely. The monitoring system worked and staff acted fast, but empty shelves still followed.
AI is changing the speed of the problem more than its nature. Honan said he had not yet seen an attack where AI was the key element, but attackers are using it to write more convincing phishing emails and to move faster once a software patch is published. That shortens the time businesses have to update their systems.
The report also makes the point that how you respond matters as much as the attack itself. As PwC's Stephen O'Keeffe put it, organisations increasingly accept that they cannot prevent every incident, so the focus is shifting to detection, containment and keeping the business running.
Preparation does not mean a large budget or a new security team. The letter's advice for individual organisations translates into four priorities that any business can start on.
Frameworks give you a structure for the priorities above, so you are not working from a blank page.
ISO 27001 is the international standard for an information security management system. It asks you to assess your risks, choose and implement controls, plan for incidents, and review the whole system regularly. Independent certification also gives customers and partners evidence that your approach has been checked.
NIS2 is the EU directive that raises the baseline for cyber risk management and incident reporting across many sectors. Depending on your size and sector, you may be directly in scope. Even if you are not, you may be asked NIS2-style questions by larger customers who need assurance about their supply chain.
The two work well together. Preparing for one puts you most of the way towards the other, because both rest on the same fundamentals: knowing your risks, assigning responsibility, controlling access, managing suppliers and being ready to respond.
You can make real progress in a few weeks with these five steps, none of which needs specialist tools.
The best time to prepare was before an incident, and the next best time is now. The organisations behind the August letter are not predicting that every business will be attacked tomorrow. They are saying that the gap between attackers and unprepared defenders is widening, and that closing it takes time.
At CG Business Consulting, we help businesses turn that into a clear, manageable plan through ISO 27001, NIS2 readiness and practical gap analysis. If you would like to know where your business stands, get in touch for a short, no-pressure call.
💬 Contact us now to begin your journey