AI has 'potential' to turn script kiddies into sophisticated infrastructure attackers

The potential for AI to transform amateur hackers into sophisticated attackers targeting critical infrastructure like power grids and water systems exists, according to operational technology security experts. Steve Swick, former CISO at American Electric Power, noted that the knowledge required to exploit such systems is becoming increasingly unnecessary due to AI advancements.

Paul Shaver, head of OT at Armadin, explained that AI enables quick reconnaissance of automation controllers and the discovery of vulnerabilities, allowing attackers to exploit insecure design features.

AI accelerates the process of gaining access to utilities and manufacturing plants, as well as performing reconnaissance on OT systems. Armadin, led by former Mandiant global OT practice leader Kevin Mandia, is leveraging AI to simulate real-world cyberattacks. Shaver highlighted how AI can help quickly build tools that would typically take months to develop, although he refrained from labeling script kiddies as sophisticated attackers.

Harry Thomas, CTO and co-founder of Frenos, emphasized that AI's ability to lower technical barriers accelerates the timeline for potential attacks, potentially increasing the number of incidents. The Frenos report tested AI models on various tasks related to planning attacks on industrial systems, finding that the top three frontier models succeeded in approximately 90 percent of planning attempts.

However, these models were inconsistent, with varying success rates in repeated tests. The most successful open weight model achieved a 36.2 percent overall success rate, outperforming US models with lower success rates.

Despite AI's efficiency in accelerating tooling and knowledge transfer, it remains prone to errors and hallucinations, underscoring the importance of human judgment in guiding AI-assisted attacks. Frenos recommends a layered defense approach for OT defenders, including network segmentation, limiting remote access and user permissions, and testing recovery plans.