Key Takeaways
- AI is reshaping cybersecurity from a technical issue to a strategic, multidisciplinary challenge that touches law, governance, supply chains, and public trust.
- Türkiye’s National Intelligence Academy calls for a unified risk language, strong coordination, and legally predictable frameworks to manage AI‑driven threats.
- Short‑term actions include inventorying AI systems, setting baseline security for large language models, and enforcing data‑access controls.
- Medium‑term steps focus on standardized procurement, incident reporting, supply‑chain security, and resilience testing for critical infrastructure.
- Long‑term goals aim for digital sovereignty through domestic testing capabilities, reduced external dependencies, and a collaborative public‑private‑academic ecosystem anchored in oversight and human‑centric decision‑making.
Introduction
Professor Talha Kose, head of Türkiye’s National Intelligence Academy in Ankara, introduces the academy’s report “Cybersecurity in the Age of Artificial Intelligence and Türkiye’s Strategic Priorities.” The study treats artificial intelligence not merely as a new technology category but as “a strategic force multiplier that simultaneously reshapes the scale of attacks, the speed of defense, decision‑making processes, supply chains, and regulatory frameworks.” This framing sets the stage for understanding how AI expands both offensive and defensive dimensions of cyber conflict.
Evolving Cyber Threat Landscape in the Age of AI
The report notes that “the most significant impact of AI on the cyber domain is that it transforms the nature and scale of threats at once.” Traditional cybersecurity focused on protecting devices, applications, and databases, yet AI‑powered systems broaden the attack surface to include datasets, models, training processes, prompts, plugins, agent‑based applications, cloud infrastructures, and decision‑support mechanisms. Consequently, security concerns spill over into law, governance, oversight, procurement, human resources, and strategic planning, demanding a holistic approach beyond technical teams.
AI‑Enabled Attack Surfaces and Multi‑Domain Risks
Because AI touches every layer of modern infrastructure, defending it requires safeguarding not only code but also the data that fuels models and the processes that govern their use. The report highlights that “intelligent phishing, deepfake audio and video, synthetic identities, fraudulent executive communications, and automated reconnaissance are all expanding the capabilities of threat actors.” These tactics make attacks faster, cheaper, and more convincing, eroding individuals’ and societies’ sense of reality and undermining trust in institutions—a destabilizing effect that ripples from personal users to national defense supply chains and energy grids.
Trust Erosion and Societal Impact
As AI‑driven deception becomes more persuasive, “individuals’ and societies’ sense of reality – and their trust in states, institutions, and even one another – can erode in deeply destabilizing ways.” The report warns that this erosion amplifies vulnerabilities across individual, social, and institutional levels, turning cybersecurity into a matter of social legitimacy as much as technical defense. Protecting critical infrastructure now hinges on preserving public confidence in the authenticity of information and the reliability of services.
Risks Posed by Large Language Models and Agent‑Based AI
Large language models (LLMs) and agent‑based AI systems promise efficiency gains for public services and private enterprises, yet they introduce new governance challenges. The report cautions that “if it remains unclear which data enters the model, which outputs inform institutional decisions, which systems connect to external cloud services, and which operations run without human oversight, efficiency gains can quickly become governance gaps.” Specific threats include prompt injection, sensitive information disclosure, data poisoning, model inference attacks, excessive permissions, and over‑reliance on model outputs—each constituting not just a technical flaw but a failure of accountability and decision quality.
Governance Gaps and Ethical Uncertainty
Beyond immediate technical risks, the ethical foundations of AI models remain contested. The values and assumptions embedded in training data are difficult to anticipate, especially in sensitive contexts such as defense or healthcare. This uncertainty complicates risk assessment and underscores the need for transparent model auditing, clear data provenance, and robust human‑in‑the‑loop controls to prevent automated decisions from undermining institutional integrity.
Strong Coordination and Legal Predictability for Türkiye
For Türkiye, the report argues that the main priority is “consolidating fragmented practices across AI and cybersecurity under a common risk language, shared standards, and robust coordination mechanisms.” Such coordination is not about imposing sweeping oversight but about clarifying responsibilities, incident‑sharing protocols, audit expectations, and response procedures in an increasingly complex threat environment. When designed in keeping with the rule of law, strong coordination yields a durable security capacity grounded in proportionality, accountability, clearly defined authorities, and effective oversight.
Balanced Cybersecurity Architecture
Türkiye needs “a balanced cybersecurity architecture – one that protects critical infrastructure, ensures the continuity of public services, and safeguards citizen data, while supporting private sector innovation and upholding fundamental rights.” Strengthening state capacity in the AI era does not mean exercising discretion over the digital domain; rather, it demands a legal framework that defines mandates, bolsters oversight, sets boundaries on data processing, and anchors intervention authorities in law. This approach reinforces legal predictability and public trust, avoiding the false dichotomy of liberty versus security.
Trust‑Based Collaboration Across Sectors
Resilience is achievable only when the threat ecosystem operates on shared standards and aligned procedures. The report calls for “a foundation of trust‑based collaboration must be built across public institutions, private sector, academia, and civil society.” Critical infrastructure operators, technical providers, financial institutions, and public digital services all face the same AI‑amplified threats; coordinated response capacity, joint exercises, and transparent information sharing are essential to turn fragmented defenses into a unified shield.
Strategic Priorities: Short‑Term Actions
In the short term, Türkiye should conduct an AI inventory across public institutions and critical sectors to gain visibility into which systems run on what data, what external dependencies they carry, and how they affect decision‑making. Minimum security requirements must be set for large language models and agent‑based systems, with data classification, access controls, logging, and human oversight mechanisms prioritized. These steps create a baseline understanding and immediate risk reduction.
Strategic Priorities: Medium‑Term Institutionalization
Over the medium term, the report recommends institutionalizing public procurement standards, incident‑reporting requirements, supply‑chain security, model auditing, third‑party dependency management, and sector‑wide resilience testing. Cyber incident response capacity should be strengthened, and threat‑sharing made faster, more secure, and more measurable. For critical infrastructure, the focus should shift from pure attack prevention to a resilience approach that guarantees service continuity even when breaches occur.
Strategic Priorities: Long‑Term Vision and Digital Sovereignty
Looking ahead, Türkiye must build strategic capacity to manage external technological dependencies, develop domestic testing and certification capabilities, and deepen its cybersecurity ecosystem through public‑private‑academic collaboration. In the age of AI, digital sovereignty cannot be reduced to merely producing domestic software; it also entails control over data, the ability to audit model reliability, ensuring continuity in critical services, and mitigating risks posed by external dependencies during crises. A strategy lacking public ownership and support will falter; instead, Türkiye should cultivate a cybersecurity ecosystem that anticipates risks, strengthens institutional capacity, places human oversight at its core, and rests on solid legal foundations and public trust.
Conclusion: The Path Forward
Ultimately, the report concludes that “strong state capacity only realizes its full meaning when underpinned by clearly defined legal authorities, institutional coordination, accountability, and strategic autonomy.” By aligning AI‑driven cybersecurity measures with legal predictability, transparent governance, and broad societal engagement, Türkiye can protect its critical functions while fostering innovation and preserving the democratic values that underpin its national security.
https://www.aa.com.tr/en/opinion/opinion-a-safe-future-in-the-age-of-artificial-intelligence/3926365