The Defender's Window: AI and Cyber Defence Intelligence Report 2026
CYBER THREAT INTELLIGENCE
This structural assessment examines how frontier AI is reshaping cyber defence, who is being tiered in and out of the new access regimes, and what institutions should do during the window before it closes.
LRQA's specialist threat intelligence team has produced an urgent analysis of three concurrent dynamics: attacker capability uplift, analytical leverage for defenders, and tiered access governance. Giving your organisation the situational awareness and practical guidance needed to act now.
What's inside
- The Window explained: A structural assessment of the 12-18 month period opened by Anthropic's Project Glasswing and OpenAI's Trusted Access for Cyber (TAC). What it means, why it is finite, and why acting now changes your position when it closes.
- What Mythos, Glasswing, and TAC actually are: Plain-language profiles of the three new access tiers, who holds them, who does not, and why it matters to organisations not named in either programme's partner list.
- The capability measurement problem: A framework for evaluating any AI cyber capability claim, offensive or defensive, vendor or regulator, against what is actually being measured. Essential reading before your next procurement decision.
- Understanding versus pattern-matching: The four failure modes of current defensive AI, and how to translate them into procurement questions that distinguish genuine capability from marketing.
- Correlation tradecraft: The positive case for AI in defence. Why data quality is the deciding variable, what good looks like in a SOC, and why AI works best as a correlation engine rather than a verdict machine.
- Access governance: What Glasswing and TAC mean for your organisation's defensive posture, which tier you realistically qualify for, and why fundamentals matter more than access tier in practice.
- Intelligence collection and the commercial AI surface: Why commercial AI platforms have become an early-stage intelligence surface for adversary intent, and why that surface is narrowing faster than most defenders have noticed.
Threat ready where it matters most
Trusted by organisations worldwide to identify, manage and respond to cyber risk at scale.
Cyber vulnerabilities managed every year
Confirmed incidents handled annually
CREST accreditations - one of the only organisations worldwide with a full suite
Managed SOC Services and Incident Response teams
