On LinkedIn
Sounds like vendor fear marketing: 95% of critical infrastructure leaders are worried that AI means more attacks.
Then you read that 60% of them had a significant breach last year. They are not paranoid. They are right.
Same survey, 1,607 leaders, paid for by Palo Alto Networks:
29% of vulnerabilities exploited this year were exploited within 24 hours. The industry average to deploy a patch is 55 days, says Palo Alto’s own VP.
AI makes the first number smaller. Nothing makes the second one smaller.
Only 15% can contain an incident in minutes.
42% name unpatchable legacy OT as their single biggest risk.
Legacy OT, again. Stop waiting for OT to grow up. It will never be neatly patchable. OT is an industry of affordable sensors and buttons, because industrial processes run on data. The demand for the cheapest meter that scales fast will not shrink. We need thousands of them, not 3!
So look past the Purdue model and see OT for what it is: business-critical control in processes that can’t keep their own security pants up. That part is on us, with zero trust.
Vulnerable and staying vulnerable is not the problem. Even where we can patch, we lack the speed. So protect it.
A flow meter may be read by a PLC, and by nobody else. Systems that belong together sit in one Protect Surface. We don’t wedge ourselves in between the OT, we isolate it. Whoever needs to get at that process comes in authorized, validated, from an approved and secure source. The rest of the world doesn’t.
We have all the room for that once we stop pushing patching and upgradability as the answer.
Name one device type that will still be vulnerable in five years. Who is it allowed to talk to?
The source: the survey was commissioned by Palo Alto Networks and run by Sapio Research among 1,607 cybersecurity leaders responsible for critical infrastructure, reported by Security Boulevard.
The 55 days is Qiang Huang’s number, Palo Alto’s VP of product for cloud-delivered security services, quoted in the same article. It does not say when the clock starts on the 29%, so read that one as a direction, not a benchmark.
The patching side of this: the post by Nicholai Piagentini.
Start small: pick one OT system, write down the one or two things that may talk to it, and drop the rest. The flow meter will not complain.