OT experts warn AI could lower barrier for critical infrastructure attacks
Security leaders say artificial intelligence accelerates reconnaissance of utility systems, though it has not yet replaced state-level capabilities.
Key points
- Operational technology experts state the potential exists for AI to enhance lower-skilled attackers targeting critical infrastructure.
- AI tools can rapidly parse technical documentation to identify design flaws in automation controllers and utility systems.
- Former American Electric Power CISO Steve Swick notes that security by obscurity is becoming less effective against AI-assisted reconnaissance.
Operational technology security experts warn that artificial intelligence possesses the potential to transform less sophisticated attackers into significant threats against critical infrastructure. While AI does not currently turn casual hackers into nation-state adversaries, industry leaders say the capability is emerging rapidly. This assessment comes from a media panel held before the release of Frenos' State of AI in Security report, where specialists discussed the evolving threat landscape.
Steve Swick, former chief information security officer at American Electric Power, stated that the utility sector has historically relied on security by obscurity. He noted during the panel that the specialized knowledge previously required to execute certain attacks is becoming less necessary. According to Swick, AI reduces the barrier to entry for understanding complex industrial systems, thereby increasing the risk of successful intrusions into power grids and water systems.
Accelerated Reconnaissance and Exploitation
Paul Shaver, head of operational technology at Armadin, explained that AI significantly speeds up the reconnaissance phase of an attack. He said that with basic access, attackers can use AI to quickly distill through documentation to find critical design features of a facility. Shaver noted that he can download manuals for automation controllers and use AI to parse them rapidly, identifying ways to exploit features that were not secure by design.
Armadin is a security startup founded by Kevin Mandia that uses swarms of autonomous AI agents to simulate real-world cyberattacks. Shaver, who previously led the global OT practice at Mandiant for six years, emphasized that these tools allow for faster information access. He stated that with AI assistance, he can build tools in days that would normally take months, highlighting the dramatic shift in development speed.
Industry Perspective on Threat Evolution
Shaver cautioned against excessive fear, stating he wants to avoid the narrative that every script kiddie is now a sophisticated nation-state adversary. However, he acknowledged that the potential for such escalation exists because the tools are improving and access to information is much quicker. He referenced his time at Mandiant, which Google acquired in 2022, to provide context on the industry's long-term view of these threats.
The consensus among the panelists is that while the immediate threat of casual hackers shutting down infrastructure is not yet reality, the trajectory is concerning. The ability to rapidly analyze technical documentation and identify vulnerabilities means that defenders can no longer rely on the complexity of their systems as a primary defense mechanism. This shift requires a reevaluation of how critical infrastructure is protected against automated analysis.
What should you do?
Organizations managing operational technology should review their external documentation exposure to ensure sensitive design details are not easily accessible. Security teams should monitor for unusual reconnaissance activity that might indicate automated analysis of system manuals or technical specifications. Defenders should prepare for faster attack cycles by enhancing detection capabilities for rapid system enumeration.
What to do and how to stay safe: Armadin
- Audit public-facing technical documentation to remove detailed system architecture or controller manuals that could aid attacker reconnaissance.
- Implement strict access controls for internal documentation repositories to prevent unauthorized extraction of design features.
- Monitor network traffic for rapid, automated parsing activities that may indicate AI-driven analysis of system configurations.
- Review incident response plans to account for the accelerated timeline of AI-assisted attacks on operational technology systems.
Step-by-step guide: Social Engineering Warning Signs and How to Respond
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does AI currently allow script kiddies to shut down power grids?
No, experts state that AI does not yet turn casual hackers into sophisticated nation-state attackers capable of such large-scale disruptions.
How does AI help attackers target critical infrastructure?
AI allows attackers to quickly parse technical documentation and manuals to identify design flaws and exploit features in automation controllers.
Who provided these insights on AI and OT security?
The insights came from Steve Swick, former CISO at American Electric Power, and Paul Shaver, head of OT at Armadin, during a media panel.
