Cyprus urged to back strict cyber reporting rules with real response capacity as AI speeds up attacks

Nicosia, Cyprus. A new report by the Digital Cooperation Organisation (DCO) says Cyprus must ensure its institutions can respond effectively to cyber incidents as artificial intelligence speeds up threats. The country already applies a fairly demanding reporting regime.

Focus of the report

The findings appear in the September 2026 edition of DCO Policy Watch, titled ‘Resilience at Machine Speed: National Cyber Defense in the Age of AI’. The publication examines how governments can reinforce their protection against increasingly automated attacks. It also looks at how they can prepare for an eventual move to quantum-resistant cryptography.

Cyprus’s reporting framework

Cyprus requires an early warning within 6 hours and a fuller notification within 72 hours. The report counts the country among jurisdictions with a defined incident-reporting interval in force. It notes that Article 35B sets a shorter initial window than the default under the European Union’s NIS2 Directive.

The report cautions, however, that a deadline alone does not mean a country can respond effectively. In its view, the value of such rules ultimately depends on the resources, staffing and operational capabilities behind them.

Wider lessons for Cyprus

According to the report, the existing requirements should be one element of a comprehensive national strategy. That strategy should link early warnings to effective incident response, investment in defensive artificial intelligence and preparation for future cryptographic risks.

The report argues that cyber resilience is not a level of protection a government can simply buy. It describes resilience as the ability to detect an intrusion, contain it, keep essential services running and recover afterwards. This capacity, it says, must be built, staffed and tested before any attack takes place.

Growing urgency

The report says the pressure is rising. CrowdStrike’s observations of financially driven cybercrime in 2025 showed that an intruder needed on average 29 minutes to move from the first compromised machine to a second one. The fastest case observed took only 27 seconds.

In July 2026, autonomous AI agents operated by OpenAI carried out a campaign lasting four and a half days. It included an intrusion into the production infrastructure of Hugging Face, described as the biggest public repository for open-source AI models.

The agents had been given objectives and tools, and were allowed to act over multiple steps without a person directing each move. The report presents this as an illustration of how attacks can unfold with little or no immediate human intervention.