Agent-based AI is making cyberattacks faster and more scalable. For operators of industrial facilities and critical infrastructure, identifying security risks early and taking targeted action is becoming increasingly important. These 15 action points highlight what matters most.
Agent-Based AI Is Accelerating Cyberattacks
AI agents can independently analyze technical information, identify vulnerabilities, and investigate potential attack paths. Tasks that previously required extensive manual research and specialized expertise can increasingly be automated.
The capabilities of these systems were demonstrated in an OpenAI security test, in which an AI agent bypassed security boundaries and compromised systems at Hugging Face. We examined the incident in our asvin Labs Advisory on autonomous AI attacks.
The fundamental change, however, is not the emergence of entirely new attack methods. Agent-based AI enables attackers to use existing techniques faster, at lower cost, and on a much larger scale.
This reduces the time organizations have to identify vulnerabilities, assess risks, and implement appropriate countermeasures.
Even without agent-based AI, the time available to respond to newly disclosed vulnerabilities has already decreased significantly.
Time-to-Exploit (TTE) trends: The time between the disclosure of a CVE and its confirmed exploitation has decreased significantly since 2018. The chart shows the 10% trimmed mean, median TTE, and number of available exploits. Source: Zero Day Clock.
Why OT Systems Face Particular Challenges
Industrial facilities and critical infrastructure have specific cybersecurity requirements. Many systems remain operational for decades. Security updates must be carefully planned because changes to production environments can affect availability.
At the same time, complex legacy networks, external maintenance access, and incomplete asset inventories make it harder to assess security risks.
Cyberattacks targeting connected refrigeration systems in French supermarkets recently demonstrated how digital attacks can disrupt physical operations. At Intermarché, manipulation of refrigeration technology led to operational disruptions.
The incident highlights a fundamental challenge:
In OT environments, security measures must reduce technical risks while protecting the availability of critical processes.
This requires visibility into systems and a risk assessment approach that connects technical vulnerabilities with their potential operational impact.
15 Action Points for Stronger IT/OT Security
Many effective cybersecurity measures have been established for years. As attacks become increasingly automated, organizations need to implement these measures consistently and assess security risks more quickly.
The whitepaper groups 15 action points into five areas.
1. Transparency and Risk Awareness
You cannot reliably protect systems and dependencies you do not know about.
A comprehensive overview of IT and OT assets, software versions, and external dependencies provides the foundation for effective risk assessment. The key is to evaluate vulnerabilities in the context of their potential impact on operations rather than in isolation.
The action points:
2. Reducing the Attack Surface and Securing Systems
Fewer unnecessary components mean fewer opportunities for attackers.
Outdated applications, unused services, and inadequately secured interfaces increase the attack surface. Regular reviews, system hardening, and multiple independent layers of protection help reduce these risks.
The action points:
3. Controlling Identities and Access
Access must remain controlled, and critical decisions must remain accountable.
Zero Trust principles and time-limited permissions reduce the risks associated with compromised credentials. For security-critical changes to production systems, deliberate human approval remains an important safeguard.
The action points:
4. Detecting and Limiting the Spread of Attacks
Not every attack can be prevented. Its impact, however, can be contained.
Segmentation of IT and OT networks makes it harder for attacks to spread. Monitoring, logging, and targeted security analysis help detect unusual activity early and reconstruct security incidents.
The action points:
5. Cybersecurity in the Age of Agent-Based AI
Automated attacks require faster, more targeted defense.
AI-supported analysis can help security teams evaluate threat intelligence and prioritize relevant risks. At the same time, organizations must secure the AI agents they deploy. Incident response plans and recovery processes help maintain operations even when attacks succeed.
The action points:
Effective Security Starts with the Right Priorities
The increasing automation of cyberattacks places greater demands on security management. Organizations must assess vulnerabilities and threat intelligence more quickly without overwhelming their available resources.
Not every vulnerability poses the same level of risk to every organization.
Only by connecting threat intelligence with their own systems, dependencies, and operational processes can organizations establish meaningful priorities.
For IT and OT security leaders, three questions are essential:
What is affected? Which systems, components, and dependencies are relevant?
How critical is the risk? What would be the operational impact of a successful attack?
What needs to be done now? Which measures will reduce the risk most effectively?
Organizations that can answer these questions reliably are better positioned to make faster, more informed security decisions.
Conclusion: Established Security Measures Matter More Than Ever
Agent-based AI does not fundamentally change the core responsibilities of cybersecurity. Above all, it increases the speed and scalability of existing attack methods.
For organizations, this means improving visibility, prioritizing risks, reducing attack surfaces, and strengthening their ability to respond.
Especially in IT/OT environments, cybersecurity and operational availability must be considered together.
