🤖 AI Accelerates Cyber Attacks: How Can Manufacturers Protect Themselves? 🛡️

[Semih Asil]

Cyberattacks on industrial operations are not new, but artificial intelligence (AI) is dramatically accelerating the speed at which attackers identify targets, find vulnerabilities, and exploit them.

Manufacturers, on the one hand, are leveraging the connectivity between IT and OT systems, adopting cloud-based tools, and enabling remote access to assets on the factory floor. However, this level of connectivity creates new avenues for hackers by providing access points to critical systems like PLCs, HMIs, drives, and other industrial control systems.

In April, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert that cyber actors are specifically targeting OT devices, including PLCs. Hackers are quickly attempting to exploit exposed controllers, poorly segmented networks, or insecure remote access tools.

As AI-powered threats become more automated and adaptive, manufacturers need to rethink how they secure their systems – especially controllers and drives – and maintain production. Understanding how AI elements are supercharging cybersecurity attacks and the steps manufacturers can take to mitigate their risks is critical as today’s threat landscape evolves.

🚀 AI Makes Cyberattacks Faster, Cheaper, and More Accessible​

AI is changing how easy it is to carry out cyberattacks – and not just for new vulnerabilities. Elements like internet-exposed PLCs, HMIs, and remote access gateways; flat OT networks with little segmentation; always-on vendor login access; and a lack of visibility into who is talking to controllers pose significant risks.

For example, attackers are now using AI across all phases of the MITRE ATT&CK lifecycle. The MITRE ATT&CK framework is essentially a hacker cheat code for carrying out an attack across various phases.

Traditionally, malicious actors spent significant time and resources researching and exploiting vulnerabilities. Today, AI and AI agents have streamlined this entire process, automatically executing tasks with minimal human intervention, accomplishing in just a few hours what a team of attackers would take weeks to do.

As AI and autonomous agent technologies continue to evolve, organizations need to prepare for threats that are increasingly automated, adaptive, and capable of moving faster than traditional defenses.

Here are six steps manufacturers can take to mitigate their risks as the OT threat landscape rapidly changes:

🎯 Align with the Right Cybersecurity Framework​

Organizations should start with a recognized cybersecurity framework that provides a structured, risk-based approach to protecting industrial operations.

The two most commonly recognized frameworks are the NIST Cybersecurity Framework (CSF) 2.0 and ISA/IEC 62443. These frameworks complement each other. The NIST CSF provides guidance to executives on establishing cybersecurity governance, while ISA/IEC 62443 specifically focuses on securing ICS and OT. This framework provides the roadmap that guides every future cybersecurity decision.

🔍 Gain Visibility into Your Assets​

Taking inventory of your assets is a critical part of a strong cybersecurity strategy. At a minimum, your organization should be able to answer these questions:

• What devices are on your network, and where are they located?
  
• Which devices are critical to your operations?
  
• Is your device firmware up to date?
  
• Do you have strong passwords for your devices, or are they still at default settings?
  
• Are you notified when new devices or machines are added to your network?
  
• Can you monitor and identify who is logging into your network or assets?
  
• Do you understand the flow of communication on your network and who or what your devices are talking to?
  

⚙️ Conduct an OT Cybersecurity Assessment​

Once you have a solid understanding of your assets and how they communicate on the factory floor, the next step is to assess your overall cybersecurity posture.

Review your network architecture and document the security measures you have in place, the communication protocols your devices use, and the ports. CISA’s recent alert highlighted specific device ports that organizations should pay attention to.

As AI and autonomous agent technologies continue to evolve, organizations need to prepare for threats that are increasingly automated, adaptive, and capable of moving faster than traditional defenses.

From there, evaluate potential risks or vulnerabilities that exist and determine which ones need to be prioritized and addressed first. If your organization doesn't have the in-house expertise to perform this step, a trusted partner can help.

🌐 Design and Implement a DMZ​

No single solution or product can protect every asset from cyber incidents. Instead, manufacturers need to adopt a “defense-in-depth” approach that incorporates layered controls and security measures.

This includes everything from physical security and access control solutions to firewalls, network segmentation, and endpoint protection. Designing and implementing a “DMZ” or buffer zone between your IT and OT networks is critical.

Whenever possible, manufacturers should use secure remote access and multi-factor authentication to control, manage, and verify who is accessing their networks. While many legacy machines may not have MFA capabilities, there are solutions organizations can use to add another layer of security to these devices.

These tools allow manufacturers to log who is accessing or remotely connecting to their machines, monitor what those users are doing, time-limit access, and disable it when necessary.

🔬 Use Microsegmentation on the Factory Floor​

Once an effective DMZ is in place, manufacturers should further strengthen their cybersecurity posture through microsegmentation on the factory floor.

Microsegmentation uses virtual local area networking to create logical cell/area zones within the factory floor network. This architecture reduces the attack surface by limiting lateral communication and containing potential cyber threats within a defined cell/zone.

Additionally, ensure your network switches are both configured and managed. This makes it more difficult for malicious actors to access your network and further restricts access to devices if your network is compromised.

👨‍🏫 Conduct Regular Training for Personnel​

Proper training is vital to preventing cyberattacks and mitigating the consequences if an incident occurs. Employees should be aware of potential threat vectors like “phishing,” “vishing,” and “smishing” and how to recognize them.

They should also know what to do and who to alert if they receive suspicious emails, links, calls, or texts. Much of this training may already be implemented on the IT side of the organization.

While the goal is always to prevent an attack from happening in the first place, employees should know what to do if a cyber incident occurs. At a minimum, clear backup and disaster recovery policies and processes should be in place. Any cyber assessment and plant health check should ensure proper training is in place.

💪 Ensuring a Strong Cybersecurity Posture​

Remote locations, varying degrees of readiness, and different maturity needs require a multifaceted approach to securing OT networks.

The goal is to reduce exposure, control access, increase visibility into potential vulnerabilities, and recover quickly if an incident occurs.

While no cybersecurity plan is perfect, a partner can help you fill in the gaps and implement the steps.