Who has the authority to pull the plug?

AI is discovering cyber vulnerabilities at an unprecedented rate. Boards should decide now who can authorise the shutdown of a critical digital service, and how the organisation will continue operating when that decision becomes necessary.

On Friday the 9th of October a critical vulnerability in Citrix NetScaler was announced. It was a vulnerability that was already under exploitation by malicious actors. NetScaler is the gateway through which many organisations, critical infrastructure operators and government departments among them, let staff work remotely. 

For government departments, this was not a normal weekend -  it was Budget weekend, which is one of the civil service’s busiest and most high-pressure periods as the details of the State’s €125Bn annual financial package are finalised.  Over that weekend, departments faced a hard choice. They could keep a system that might be exploited online or take it offline while patches were prepared thereby cutting off remote working for all their staff that relied on it, including people abroad and at home with no other way to reach their devices.

Within three weeks a similar choice arrived on a far larger scale. Critical flaws in PHP, the software behind up to 70% of the world's websites, became public before a fix was ready. News organisations, government websites and some key services, in Ireland and elsewhere, went offline while they waited for the patches to come in.

At the NCSC we see these decisions taken up close, and they are becoming more frequent. Technical and cybersecurity teams can advise on the cyber risk of exploitation or the technology impact of a service going offline, but they are often not best equipped to make the ultimate call on whether to switch off. They are hard business decisions about what an organisation can do without, and for how long. Boards need to ensure their organisation is ready for them.

Why it keeps happening

The volume of published software vulnerabilities has increased dramatically. In September 2026 almost 15,000 vulnerabilities were published, against about 4,300 a year earlier. Since July the monthly figure has been running at roughly three times last year's level, and by late October the year's total had passed 84,000, against about 48,000 in the whole of 2025.

                             Source: NIST NVD CVE API 2.0, Up to September 2026.

The main reason is artificial intelligence. Since the spring, particularly since the launch of powerful cyber capable frontier models such as Claude Mythos, Software vendors, security researchers and threat intelligence teams are increasingly using advanced AI models both to analyse source code and to probe live systems for weaknesses at scale. As a result, far more vulnerabilities are being identified than would previously have been possible through manual analysis alone.

In the long run that is good news, because a flaw the maker finds and fixes is one an attacker cannot use. However, In the short term, every fix has to be installed by someone, and every published fix demonstrates to attackers where there is a potential hole to exploit before it is patched or mitigated.

Just to clarify - most of the new flaws will never be used in an attack. However, the number that are has risen, from about ten a month in 2025 to about 18 a month this year, according to Google's threat intelligence team. My own observation is that attackers are now moving faster once a flaw is public, and therefore organisations have to respond in hours to problems they previously would have had weeks to fix.
The decision on the Friday evening (critical vulnerabilities always seem to be announced at the weekend!)

A planned shutdown is generally easier to manage than a cyber compromise, but neither its duration nor its cost is always fully known in advance. Cutting off remote access for a weekend may be disruptive and unpopular. The alternative, however, may be an attacker gaining access to systems, data or services, leading to significantly greater operational, financial and reputational impacts. 

Where a serious vulnerability is actively being exploited and effective mitigations are not available, organisations may need to restrict or suspend services. The decision should be treated as a business risk decision informed by technical expertise, with executives and boards prepared to support it when necessary. Not every vulnerability warrants it. The urgent cases are systems that are exposed to the internet, flaws that attackers are known to be using and are particularly easy to exploit. Triaging those urgent vulnerabilities from the thousands of others is now a core skill.

Such decisions rarely wait for a scheduled governance meeting. Depending on organisational structures, authority may rest with a business owner, an executive, an incident management team or, in some cases, a CISO or security function that has been specifically empowered to act. What matters is who not precisely holding the authority, but that it has been clearly defined in advance. The executive team and board should understand who can make the decision, under what circumstances, who deputises, and how staff, customers and regulators will be informed.

The board's longer view

The board of directors has a different job. It will rarely make the call on the night, but it shapes how hard that call is. There are a few related issues that deserve time on its agenda.

The first is dependence. A board should know which systems the organisation cannot function without, and whether it could keep going if any one of them were switched off for a few hours, or a few days. That discussion starts with understanding critical business services and the digital assets that support them. Organisations should classify systems according to their operational importance and defined recovery objectives that reflect the impact of disruption. Directors do not need to understand every technical detail, but they should understand which systems are business-critical and how long the organisation can tolerate their loss.

The second is legacy technology. Software or hardware that no longer receives updates creates an ongoing and mounting technical debt for the business. With the explosion of vulnerabilities being discovered, the bill for years of deferred upgrades is arriving now. Boards should ask questions around how executives plan to address legacy technology and interrogate the funding plans.

The third and potentially most important issue is people. This pace we are currently experiencing with AI discovered vulnerabilities is not going away, and teams cannot run on goodwill and weekend heroics in the long term. A board that demands faster patching from executives should also ask whether the operational team has the capacity and the authority to deliver it.

As with all cyber risk issues the board deal with a lot of the conversation comes down to risk appetite. The board should be clear on how much disruption the organisation will accept to stay safe, and revisit that as the pace changes. Under the NIS2 Directive, which the upcoming National Cyber Security Bill will bring into Irish law, that oversight is now an explicit legal duty of the management body of every essential and important entity.

We are at the start of a long clear-out of flaws buried in decades of code, and the volume is likely to rise further before it falls. There will be more weekends like the one before the Budget. The organisations that come through them best will be those that decided in advance who switches things off and built themselves to keep working when they do.

Note: The views expressed here are the author’s own and do not necessarily represent NCSC-IE, the Government of Ireland, or IoD Ireland’s policy or position.

About the Author

Joseph Stephens is Director of Resilience at the Ireland's National Cyber Security Centre (NCSC‑IE), where he leads functions spanning strategic threat assessment, critical infrastructure compliance, and national cyber capacity development. 

He previously served as an officer in the Irish Defence Forces, including a specialist role within the Army Ranger Wing. He represents Ireland on several international cybersecurity forums, including the EU NIS Cooperation Group and the International Counter Ransomware Initiative, and sits on the board of the European Cyber Security Competence Centre. 

He holds an MSc in Forensic Computing and Cybercrime Investigation from University College Dublin and was a Fulbright Cybersecurity Scholar and visiting researcher at Boston College.