Introduction
Is artificial intelligence (AI) shaping both sides of the cybersecurity battlefield?
There’s no denying that AI has become the powerhouse behind many innovations that have transformed the industrial landscape. This includes predictive maintenance in manufacturing and smarter power grids, but recently, a study conducted by IDS-INDATA found a dramatic rise of 50% in supply chain attacks.
They say, ‘With great power comes…’ Well, you know the rest. While AI is making all these great changes, such as boosting productivity and efficiency and automating many processes, it’s also empowering cybercriminals with new tools that make yesterday’s defences feel obsolete.
These attacks are real and evolving, and they are already impacting industrial control systems (ICS) in sectors such as energy, transportation, water treatment, and manufacturing.
The scary part is that these systems were never built with cybersecurity in mind, as who could have imagined that technology would get so advanced that such attacks would start to occur.
Let’s dive into this new era of AI-powered cyber threats and see what we can do about it.
What is an AI-Powered Cyber Attack?
An AI-powered attack is an attack that uses machine learning and data science techniques to mimic, adapt and automate different stages of a cyberattack. That could mean:
- Automated reconnaissance: AI tools scan and analyse industrial networks faster than any human could, identifying vulnerabilities and optimal paths for exploitation.
- Adaptive evasion: Malicious software evolves its tactics in real time to bypass intrusion detection systems (IDS) and firewalls.
- Deepfake deception: Generative AI can now replicate the voices or behaviours of real employees to bypass access controls or trick human operators.
- Persistent exploitation: Once inside, AI can automate lateral movement across OT systems, all while hiding its tracks better than traditional malware ever could.
These are not theoretical, they’re being actively tested and deployed as we speak!
According to Stanham (2025), we’re entering an era where threat actors can “run entire campaigns with minimal human input.” It’s like a self-driving cyberattack.
Sound scary? Well, there’s more coming…
Why Industrial Systems Are Especially Vulnerable
Let’s get one thing straight: most industrial environments weren’t built for today’s digital age.
They run on legacy systems, often decades old, that prioritise reliability over security. In fact, many ICS platforms were designed under the assumption they’d never be connected to the Internet. Fast-forward to today, these same systems are now tied into smart grids, cloud interfaces, and remote access points, making them perfect targets for sophisticated cyber attacks.
And here’s the kicker: Industrial systems run critical infrastructure. So when something goes wrong, it’s not just a system outage; it could be a national security incident. Things just got deep!
Imagine this:
- AI malware infiltrates a smart grid system and triggers a cascading failure.
- A water treatment facility’s chemical levels are altered using a compromised control panel.
- A transportation network is thrown into chaos by manipulating automated signals.
We’re not in the realm of imagination here. Similar incidents have occurred…
In 2021, hackers accessed the control systems of a water treatment plant in Florida and tried to poison the water supply. The only reason the disaster was averted was that a human operator noticed the sudden changes on the screen and acted quickly. Imagine if AI had been used to make those changes gradually without triggering suspicion.
AI Is Playing Both Sides of the Game
Here’s the paradox: the same AI that’s empowering attackers is also becoming a defender’s best friend. How ironic?
Advanced security platforms now use AI and machine learning to monitor behaviour in real-time, flag anomalies, and even respond automatically to emerging threats. Companies like Darktrace and Palo Alto Networks have built AI into their core offerings to protect industrial networks through predictive analytics, automated threat hunting, and real-time response.
What’s working:
- Behavioural analytics – Understanding what “normal” looks like for a system, so any unusual behaviour stands out instantly.
- Threat correlation – Using AI to connect the dots across multiple seemingly minor alerts.
- Proactive defence – AI models are now capable of simulating potential attack paths before they happen, almost like a cybersecurity crystal ball.
But there’s a growing need for cooperation between IT and OT teams, which traditionally work in silos. Cybersecurity can no longer be “someone else’s problem.” AI demands a unified, strategic approach across the board.
Global Reactions: Who’s Taking This Seriously?
Governments and institutions are starting to realise the potential devastation from AI-powered threats.
- In the UK, the government’s National Cyber Strategy now includes dedicated AI security research under the new Laboratory for AI Security Research (LASR).
- The European Union is ramping up efforts to regulate AI and improve OT security standards under NIS2 (Cybersecurity Standard Framework).
- In the U.S., CISA (Cybersecurity and Infrastructure Security Agency) is collaborating with energy, water, and transport sectors to identify and address AI-related vulnerabilities.
Still, regulation alone won’t stop the threat. It’s a race, and the attackers are agile, decentralised, and evolving fast.
So, What Can Industrial Leaders Do Right Now?
-
Conduct an AI Threat Readiness Assessment
Think of this as a stress test for your digital defences. You need to understand how your systems hold up against AI-enhanced attacks, which behave differently from traditional threats.
Bring in third-party experts to simulate AI-driven penetration testing and red-team exercises. These simulations should include scenarios like autonomous lateral movement, data manipulation, and behaviour-mimicking intrusion. The goal is to expose weak points before attackers do.
2. Shift to Behaviour-Based Threat Detection
Traditional security tools look for known “signatures”, basically, they catch threats that have been seen before. But AI-powered malware often evolves too fast for this to be effective.
Instead, invest in solutions that focus on behavioural analytics. These platforms use machine learning to understand what’s normal in your environment, and then flag anything suspicious, even if it’s never been seen before. Tools like Darktrace, Vectra, and Palo Alto Cortex are leading the charge here.
3. Segment Your Networks Like Your Business Depends on It
Industrial cyber incidents start in IT and then quietly move into OT systems, where the real damage happens.
To stop this lateral movement, you need strict network segmentation. That means isolating OT from IT, using firewalls, secure gateways, and zero trust architecture, where no user or device is trusted by default. This way, even if attackers breach one system, they can’t freely roam across your entire infrastructure.
4. Train Your People — They’re Still Your First Line of Defence
Here’s the thing: AI can mimic voices, forge emails, and generate video or audio deepfakes. It’s not just a tech battle, it’s psychological too.
Educate every employee, from plant operators to the C-suite, on modern phishing, social engineering, and suspicious behaviour patterns. Regular simulated phishing campaigns and awareness sessions go a long way toward building a more resilient culture.
5. Build a Real Cyber Resilience Plan (Not Just a PDF Sitting in a Folder)
Let’s face it, no system is 100% secure. So you need to plan not just for prevention, but for containment and recovery.
A good resilience plan should cover:
- Real-time threat detection and automated response
- Clear incident response protocols
- Communication playbooks for internal teams and external stakeholders
- Backup and restore procedures that include industrial data and control systems
Ensure it’s updated regularly, tested through live drills, and tailored to AI-era threats, not just yesterday’s malware. It’s all about optimisation!
Final Thoughts…
The cybersecurity landscape is complex, and AI makes it even more so. But you’re not alone.
There are consortia, partnerships, and public-private initiatives forming globally to tackle this head-on. Tapping into expert networks, joining industry-specific ISACs (Information Sharing and Analysis Centres), and staying connected with regulatory bodies like CISA or ENISA can be game-changing.
Remember, your industrial systems don’t just support your business. They support your people, your communities, and in many cases, entire nations. Now’s the time to protect them like it.
The reality is that AI isn’t good or bad on its own; it’s a tool. And like any tool, its impact depends on who’s holding it. While attackers are already exploring AI to do more damage with less effort, defenders have a choice to respond with equal sophistication.
The good news? AI is a double-edged sword, and when used right, it can be the ultimate guardian of the systems that keep our world running.
So the next time someone tells you “AI is the future,” remember, it’s already here. And how we prepare today will determine whether that future is secure or shattered.
References:
Gregory, J. (2024, June 27). Proactive cybersecurity policy: smart and essential. Ibm.com. https://www.ibm.com/think/news/proactive-cybersecurity-policy-smart-essential
Hacker tries to poison water supply of Florida city. (2021, February 8). BBC News. https://www.bbc.co.uk/news/world-us-canada-55989843
Office, C. (2024, November 25). UK and its allies must stay one step ahead in new AI arms race. GOV.UK. https://www.gov.uk/government/news/uk-and-its-allies-must-stay-one-step-ahead-in-new-ai-arms-race
Ribeiro, A., Gordon, J., Sego, T., Toussaint, M., McPhee, A., & Ribeiro, Jonathon, A. (2025, April 13). Addressing role of network segmentation, perimeter strategies in OT cybersecurity to reinforce industrial defenses. Industrial Cyber. https://industrialcyber.co/features/addressing-role-of-network-segmentation-perimeter-strategies-in-ot-cybersecurity-to-reinforce-industrial-defenses/
Salmon, K. (2025, January 14). UK manufacturing faces surge in AI-driven cyber threats. SecurityBrief UK. https://securitybrief.co.uk/story/uk-manufacturing-faces-surge-in-ai-driven-cyber-threats
Stanham, L. (2025, January 16). Most Common AI-Powered Cyberattacks | CrowdStrike. Crowdstrike.com. https://www.crowdstrike.com/en-us/cybersecurity-101/cyberattacks/ai-powered-cyberattacks/
Internal:
Fortifi. (2024, June 22). Services | Fortifi. Fortifi. https://www.forti.fi/services/