\u201cDefending critical infrastructure requires a comparable automated response and human teams cannot secure this environment alone,\u201d Villadiego observed. \u201cAdopting AI-driven network security remains the only practical way to manage this massive influx of automated risks.\u201d<\/p>\n
He argues that AI-driven attacks on critical infrastructure are becoming faster and more effective, making AI-powered defense essential to match the speed and scale of emerging threats. \u201cAttackers use AI to move much faster than human teams can deploy patches. Because of this speed advantage, one in six successful data breaches now involves<\/a> attacker-driven AI. Given this threat, 87% of organizations identify<\/a> AI-related vulnerabilities as the fastest-growing cyber risk.\u201d<\/p>\n Villadiego said that one may assume that AI means speed, but that is not always the case. \u201cAdversaries often use this technology to prioritize stealth over immediate destruction. Recent threat intelligence shows<\/a> defence evasion is the most dominant attack tactic today. Cybercriminals deploy stealthy campaigns that avoid triggering alarms by moving quietly over long periods \u2013 meaning that when they attack, they cause maximum impact.\u201d<\/p>\n He noted that \u201cDefending critical infrastructure requires a comparable automated response and human teams cannot secure this environment alone. Adopting AI-driven network security remains the only practical way to manage this massive influx of automated risks.\u201d<\/p>\n Recognizing that modern critical infrastructure facilities rely on unmanaged physical devices, he noted that security teams cannot install traditional software agents on these internet-connected digital switches, medical equipment, water valves, or many other physical assets. This leaves an undefended attack surface for attackers to exploit.<\/p>\n Villadiego said that hardware limitations further complicate this defence strategy. Utility companies often cannot install advanced AI defences on even their traditional endpoints. Industrial equipment has a notoriously long lifespan and, consequently, much of this operational infrastructure still runs on outdated systems like Windows 95, NT, or Windows XP.<\/p>\n \u201cThe network provides the only viable answer. Cyber resilience across an OT landscape requires continuous monitoring at the network layer,\u201d he pointed out. \u201cThe network sees every connection, so AI applied to network traffic catches the evasive behaviors that local endpoint tools completely miss. AI can instantly read millions of data points and analyse traffic patterns across both digital and physical landscapes, rapidly recognizing malicious anomalies. It then severs harmful connections before an advanced threat jumps into physical control systems.\u201d<\/p>\n Critical infrastructure is becoming heavily digitalized, Villadiego said, adding that facilities now rely on a variety of sensors and smart meters and use internet-connected programmable logic controllers (PLCs), which act as a digital brain to control and automate physical machinery. \u201cThis massive scale of infrastructure networks makes manual monitoring impossible.\u201d<\/p>\n He added that ransomware gangs are aware of this and heavily target this digital-physical infrastructure. \u201cRecent data confirms<\/a> this trend with telecommunications and education currently topping global targets, accounting for 24.8% and 23.4% of attacks, respectively.\u201d<\/p>\n Citing IBM\u2019s Cost of a Data Breach Report 2025, Villadiego pointed out<\/a> that \u201c76% of organizations take more than 100 days to fully recover from an incident. We are already seeing these devastating impacts in the real world.\u201d\u00a0<\/p>\n He also highlighted<\/a> that recent attacks on the U.S. water and wastewater sector prove this vulnerability. \u201cIn late 2023, Iranian state-sponsored hackers successfully targeted<\/a> Israeli-made PLCs at municipal water facilities in the US. They exploited<\/a> internet-connected devices and locked facility operators out of the systems. The affected water authorities had to immediately take systems offline and switch to manual operations.\u201d<\/p>\n Villadiego also highlighted the future of automated defense for critical infrastructure providers, as severe cyber talent shortages continue to leave state and local security teams heavily overburdened. \u201cAI bridges this dangerous gap by acting as a vital force multiplier. The technology automates labour-intensive tasks like alert triage and log analysis. As AI brings accurate network intelligence to the surface at machine speed, human experts gain the freedom to confidently guide final operational decisions.\u201d<\/p>\n \u201cThe attack surface continues to expand across digital and physical environments. AI-driven network defence provides the only scalable answer to this threat,\u201d he explained. \u201cOrganizations can no longer rely on partial visibility provided from endpoints, so the network remains the only absolute truth in a compromised environment.\u201d<\/p>\n Moreover, deploying AI in network defences is not just about stopping hackers; it is about building digital trust. \u201cThis trust is necessary to safely embrace the current industrial modernizations and ensure the uninterrupted delivery of vital services.\u201d<\/p>\n Earlier this month, the U.S. Cybersecurity and Infrastructure Security Agency (CISA), alongside the Australian Cyber Security Centre and other international partners, published<\/a> guidance on the secure adoption of agentic artificial intelligence (agentic AI), outlining cybersecurity risks tied to deploying these systems. The document comes as critical infrastructure and defense sectors increasingly adopt agentic AI to support mission-critical operations and drive automation. As agentic AI systems play a growing <\/a>operational role, defenders must implement security controls to protect national security and critical infrastructure from agentic AI-specific risks.<\/p>\n \t\t
![\"\"](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/04\/Anna-Ribeiro-min-96x96.jpg\"\/)
<\/p>\n
\n\t\t\t\t\tAnna Ribeiro\t\t\t\t<\/p>\n
\n\t\t\t\t\tIndustrial Cyber News Editor. Anna Ribeiro is a freelance journalist with over 14 years of experience in the areas of security, data storage, virtualization and IoT.\t\t\t\t<\/p>\n