When the Five Eyes speak, programs treat it as the standard of care.
Joint guidance from the US, UK, Canada, Australia, and New Zealand carries the weight of the entire alliance. Contractors align to it, auditors reference it, and "we followed the guidance" becomes the definition of due diligence. Which is exactly why its gaps matter so much.
Aligning to a standard is not the same as being secure.
Multi-nation guidance moves at the speed of consensus.
Agreement across five governments is slow by design. The threat landscape for AI agents is not. The gap between them is where risk lives.
Programs mistake the floor for the ceiling.
Guidance is a minimum bar. Treated as the complete list, it caps a program's security at exactly the coverage the guidance happened to include.
Adversaries read the same guidance you do.
What a public standard doesn't require is a map of where defenders are unlikely to be looking. The omissions are the plan.
Ten controls the alliance guidance leaves to chance.
A representative view of the gap analysis. Each maps to an adversary technique against AI agents that the baseline guidance does not require you to address.
If your program's AI security ends where the Five Eyes guidance ends, you have ten known gaps — and so does your adversary.
Find the gaps in your program before an adversary does.
Three ways in, built for federal and DoD program timelines.
The 10-control brief
The full gap analysis with adversary mapping. Download and brief your program.
Get the brief →Framework mapping session
We map the ten controls against your current program baseline and flag exposure.
Book a session →Program gap assessment
A scoped assessment of your AI program against controls the guidance omits.
Scope the assessment →