The other side of the AI coin: why security has to be at the heart of every digital experience

The week AI took websites offline 

This week, organisations across the UK and Europe did something no digital team ever wants to do: they switched their own websites off. Oxford City Council, the City of Edinburgh Council and the Office for Budget Responsibility were among them, alongside government services in Finland, the Netherlands and France, and some of Wikipedia's supporting systems. 

The cause was a pair of critical flaws in PHP, the programming language behind almost 70% of the web. The National Cyber Security Centre told organisations to update immediately, or consider taking their sites down if they couldn't.

The flaw was found using AI. A security researcher uncovered it in August with an advanced OpenAI model, and a fix was being prepared quietly. Then details leaked, and experts warned that AI tools could reverse-engineer the bug with little effort. The same technology that found the problem could help attackers exploit it within hours. 

The side of AI we don't talk about enough 

Across our industry, the AI conversation is overwhelmingly positive, and rightly so. We talk about how it can personalise journeys, speed up content production, streamline processes and help teams do more with less. We have those conversations with clients every week. 

But we spend far less time on the flip side. If AI can be in someone's hands for good, it can just as easily be in someone's hands for bad. Even OpenAI called this week's incident one of the most impactful security issues in recent memory, and acknowledged that the tools helping defenders find weaknesses can help attackers too. 

What's changed is speed and scale. Finding and exploiting a weakness used to take skill, time and patience. AI compresses all three. The gap between a fix being published and a fix being applied used to offer weeks of relative safety. Now it can be measured in hours. 

Trust takes years to build and minutes to lose 

We talk a lot about how poor digital experiences erode trust: slow pages, broken journeys, confusing navigation. Each one chips away at how customers feel about a brand. 

A security incident doesn't chip away. It obliterates. A site that's offline can't sell, inform or serve. A site that's been compromised is worse: customer data exposed, payment details at risk, and your brand in the headlines. Former NCSC head Ciaran Martin warned this week that flaws like this could open the door to stolen card details, footholds for ransomware gangs and a surge in fraud and impersonation scams. 

Customers rarely distinguish between "we were hacked" and "we were careless". Either way, the brand carries the damage, and winning that trust back is far harder than earning it in the first place. 

Security belongs at the centre, not the edge 

The organisations that handled this week calmly weren't lucky. They knew what their platforms ran on, had a process to patch fast, and had people ready to act when the warning landed. Reports noted the greatest risk sat with smaller sites on shared hosting, run by teams with limited technical resources. 

That's the lesson for every digital leader. A robust, future-thinking security setup means: 

• Security designed in from day one. Architecture, hosting, access controls and dependencies chosen with resilience in mind, not bolted on after launch. 

• Knowing your estate. A clear, current picture of every platform, framework, plugin and integration you rely on, so you know within minutes whether a new vulnerability affects you. 

• Support that matches your ambition. If your strategy says security is a priority, your support and maintenance arrangement has to deliver it: proactive monitoring, rapid patching and clear escalation, not a ticket that waits until Monday. 

• Regular testing and review. Penetration testing, dependency audits and upgrade roadmaps that keep platforms on supported versions. 

Too often, organisations invest heavily in the build, then underinvest in what keeps it safe. In an AI-accelerated threat landscape, that gap is exactly where the risk lives. 

How MSQ DX keeps brands ahead 

At MSQ DX, we build websites and apps with security at the centre. Across Optimizely, Sitecore, Umbraco, Kentico, Storyblok and Contentful, our teams make security part of the architecture from the first conversation, not an afterthought at go-live. 

And we don't walk away at launch. Our support and maintenance packages are built to be both thorough and rapid: proactive monitoring and patching, upgrade planning that keeps you on supported versions, and a team that moves fast when a critical vulnerability lands. So when the next warning comes, our clients aren't scrambling. They're already covered. 

AI will keep making businesses better. It will also keep making attackers faster. The brands that come out on top will be the ones that plan for both. 

Want a clear view of how secure your digital estate really is, or support that matches your security ambition? Get in touch with the MSQ DX team.