Your Old Vulnerabilities, at AI Speed. What Critical Infrastructure Leaders Need to Know Now

Earlier this week, Axios  reported that Iran-backed hackers knocked a U.K. power plant offline for four days, and that AI-generated exploitation scripts are now showing up in attacks against water systems and other critical infrastructure across the U.S. — some of which triggered precautionary boil-water advisories. U.S. officials and researchers at CISA and Nozomi Networks are watching the same pattern:

 

 

The detail worth sitting with isn’t the incident count. It’s what Diana Kelley, CISO at Noma Security, told Axios: “AI is lowering the time, cost, and expertise needed to take advantage of weaknesses that already exist.” Margaret Cunningham of Darktrace put the other half of it plainly: “AI gives attackers more speed and reach, but it doesn’t erase problems critical infrastructure organizations have been dealing with for years.”

That’s the whole story in two sentences. AI isn’t inventing new ways into your environment. It’s removing the last excuses — time, cost, specialized skill — that used to buy defenders a little breathing room while a known weakness sat unpatched. For organizations running converged IT/OT environments, that shift changes the math on three things: how often you’re validating your OT attack surface, whether your own AI deployments are a new door in, and how fast your governance function can actually move.

 

 

Most ICS and SCADA environments carry vulnerabilities that have been documented for years — flat networks, unpatched legacy protocols, remote access paths added for a vendor and never closed. Under the old cost structure, an attacker needed real OT expertise and patience to find and weaponize those gaps, and that scarcity was doing quiet, uncredited work as a control. Cunningham’s point in the Axios piece is that AI doesn’t need to find a new flaw in your environment — it just makes the well-known ones faster and cheaper to exploit, at scale, by attackers who no longer need to be OT specialists themselves.

The organizations best positioned right now are the ones that have stopped treating OT risk assessment as a once-every-few-years compliance exercise and started treating it as a living inventory. InfoSight’s ICS, SCADA & OT vulnerability and risk assessments map exactly the kind of legacy exposure this trend is now targeting first — segmentation gaps, unmanaged remote access, unpatched protocol stacks — and prioritize remediation by what’s actually reachable from an attacker’s likely entry point, not just by CVSS score.

 

 

There’s a second layer to this that the coverage of the U.K. and U.S. incidents doesn’t fully address: it isn’t only attacker-side AI that changes your risk profile. If your organization has deployed copilots, AI-assisted operations tools, or automation layered onto OT or IT systems, those deployments are new, largely untested attack surface of their own — prompt injection, model manipulation, and agentic tools with more system access than anyone scoped for at rollout.

 

Traditional penetration testing wasn’t built to probe those paths. InfoSight’s penetration testing practice extends standard methodology to cover AI-specific attack vectors — testing how an AI tool or agent responds to adversarial input, where its access exceeds its actual job, and whether it could be turned into a pivot point into the systems around it. Pair that with an AI governance and exposure review, and you get a real answer to the question boards are starting to ask: not just “are we exposed to AI-accelerated attacks,” but “is our own AI adoption creating exposure we haven’t tested yet.”

 

Ready to see where AI has changed your actual risk picture?

 

 

The line in the Axios piece most worth forwarding to your leadership team is from John Gallagher at Viakoo: “Adversaries will always have an upper hand because of speed when cyber defense relies on bureaucratic budget cycles.” That’s not a knock on any one security team — it’s a structural problem. Attackers using AI can compress a discovery-to-exploit timeline from weeks to hours. Most mid-market governance functions are still built around quarterly risk reviews and annual budget cycles, because that’s what a single in-house CISO or a part-time compliance lead has bandwidth for.

Closing that gap doesn’t require a bigger headcount line — it requires governance that’s resourced to move at the same speed as the threat, without waiting for the next planning cycle to reprioritize. That’s the problem InfoSight’s Virtual Security & GRC Leadership Services (VSGRC) are built to solve: five tiers of virtual leadership — vCISO, vISO, vISE, and vGRCe — that plug in at the level of urgency and budget you actually have, and can reprioritize the roadmap the week a report like this one comes out, not the quarter after.

 

 

None of this means the sky is falling — Cunningham and Gallagher are both clear that AI is accelerating known problems, not creating unprecedented ones. But “known problem, moving faster” is exactly the kind of risk that gets missed when assessment cycles, penetration testing scope, and governance cadence are all still set to pre-AI speed. The fix isn’t a single new tool. It’s validating your OT environment, your AI deployments, and your governance function against the same question: if this moved at AI speed, would we catch it in time?

 

InfoSight helps critical infrastructure, manufacturing, energy, and regulated organizations answer that question — with OT/ICS risk assessments, penetration testing that covers AI-specific attack paths, and virtual security & GRC leadership that keeps pace with how fast the threat is actually moving. AI-accelerated attacks call for an AI-accelerated, expert-validated defense.