Attackers target the path of least resistance. This often means exploiting legacy operational technologies like HVAC, elevators, and water filtration systems, which are less secure than medical devices. These "cyber physical systems" can be hijacked to directly harm patients or render a hospital inoperable.

AI will find vulnerabilities at an unprecedented rate. The real crisis will be the organizational inability to patch them, especially in critical infrastructure with long update cycles and unsupported software where original developers are long gone. The problem shifts from finding flaws to fixing them at scale.

Recent cyberattacks on US water facilities succeeded not through advanced hacking techniques, but by exploiting simple security flaws like poor passwords and improper internet connections. The core threat is the systemic underfunding and fragmentation of local utilities, which prevents basic cybersecurity hygiene.

AI enables attackers to launch scalable, rapid attacks, overwhelming defenders who are left to manually monitor, validate, and patch vulnerabilities. This dramatically shifts the balance of power, creating a significant strategic disadvantage for cybersecurity teams in a way not seen before.

Unlike modern IT systems, Operational Technology (OT) assets like power grids and factory floors are old, difficult to update without operational downtime, and often run on legacy hardware that cannot handle modern security patches. This makes them a highly vulnerable and critical target for AI-driven attacks.

An AI attacker doesn't sleep and can execute thousands of actions in minutes. By the time a human analyst is paged and logs in, the network is already compromised. The only viable defense is deploying AI-powered systems that can detect and respond at machine speed, making AI a required defensive tool.

Cybersecurity expert Gili Raanan highlights a critical risk: threat actors can adopt new AI tools much faster than large, slow-moving enterprises. This creates an asymmetric battlefield where defenders are outpaced, putting AI's power in the hands of bad actors first.

Large enterprises often have secure, licensed AI tools. Mid-market employees, lacking these resources, are more likely to use free consumer-grade AI, inadvertently feeding it proprietary company data and creating significant security vulnerabilities.

While large firms use AI for defense, the same tools lower the cost and barrier to entry for attackers. This creates an explosion in the volume of cyber threats, making small and mid-sized businesses, which can't afford elite AI security, the most vulnerable targets.