FEATURE Industrial AI
AI’s ROLE IN ATTACK AND DEFENCE
security. The faster organisations move, the less time they have to spot and correct these issues before attackers exploit them. For automation-dependent environments adopting AI tooling rapidly, the attack surface isn’t just larger - it’s changing in ways that periodic pentest assessments were never designed to track.
Chris Wallis, CEO and Founder, Intruder, says AI is breaking cybersecurity - but it’s the only way to fix it
T
he connected systems driving modern industrial operations have entered a new era. Software is being developed and shipped at
breakneck speed, accelerated by AI-powered coding tools. But more software means a greater attack surface and more risk. In fact, the number of published common vulnerabilities and exposures (CVEs) - the publicly known security flaws in software, hardware, or systems - grew by a massive 263% between 2020 and 2025. This surge is a combination of more vulnerable software and better detection and looks set to escalate further with AI models such as Mythos autonomously discovering thousands of zero-day vulnerabilities. Cybercriminals can move faster, exploiting new vulnerabilities within hours and even minutes. Powered by AI, they can automate the reconnaissance and exploitation steps that once required significant time and skill and compress the window from disclosure to active attack. This is a growing risk for organisations
relying on complex, connected infrastructure. The traditional security model of periodic scanning, annual penetration testing, and patching was designed for an environment where attackers moved more slowly, and attack surfaces changed less frequently. However, the threat landscape has changed and the measures that could be relied on in the past no longer offer the same
30 June 2026 | Automation
protection. Organisations must adapt the way they find and address issues if they are to have a chance of keeping up. The idea that organisations once stayed on top of vulnerabilities through diligent patching has always been more myth than reality. Even before the current surge in CVE volumes, security teams were making hard choices; critical and high-severity issues got attention, while low and medium-severity issues accumulated in the backlog. The problem now is that even that
targeted approach is breaking down. The volume of high and critical severity vulnerabilities is rising, and teams that once had a manageable queue of serious issues to work through are finding it increasingly difficult to keep up with just the top tier. Cybersecurity has always been an arms race but in the AI era the pace has been supercharged. Everyone is moving faster, the arms are becoming more powerful, and the margins for error are shrinking. Attackers can use AI to identify targets, develop exploits, and launch campaigns at scale, while defenders are under pressure to detect, assess, and remediate threats just as quickly.
At the same time AI is creating an explosion on software creation, and enabling teams to spin up integrations, and deploy new services. However, more software means more chance of vulnerabilities and greater risk – especially as many software developers are prioritising speed over
The traditional security toolkit offers two options at opposite ends of the spectrum: vulnerability scanners that cover broad ground continuously but lack context, and penetration tests that deliver investigative depth but are expensive and point-in-time. Neither is sufficient on its own - but AI is opening up a third path. A third way forward is continuous pentesting. The barriers to pentesting have always been time and expertise. AI has broken those barriers down. In the medium term, we will move to a world where a pentest isn’t a single annual engagement, but a series of targeted tests triggered automatically in response to change signals in the environment - a new feature being shipped, a port opening, a configuration changing.
Instead of one big pentest a year, you’re
running dozens of smaller tests and investigations continuously. This is the promise for continuous pentesting: making security validation something that happens as an ongoing process not just at fixed points in time. Eventually, this will become a mainstream approach. The response to all of this isn’t more scanning or a larger pentesting budget - it’s a different operating model. Exposure management is built around what is actually exploitable, in context, right now, combining attack surface discovery, contextual prioritisation, validation of real exploitability, and a clear path to remediation. Instead of drowning in vulnerability queues, teams know exactly where their real risk lies. And that visibility will only become
more important as the attacker side of the equation advances. As AI tooling improves, threat actors will move faster still, and the organisations that can’t match that pace with equally intelligent defences will fall further behind.
Intruder
www.intruder.io
automationmagazine.co.uk
Page 1 |
Page 2 |
Page 3 |
Page 4 |
Page 5 |
Page 6 |
Page 7 |
Page 8 |
Page 9 |
Page 10 |
Page 11 |
Page 12 |
Page 13 |
Page 14 |
Page 15 |
Page 16 |
Page 17 |
Page 18 |
Page 19 |
Page 20 |
Page 21 |
Page 22 |
Page 23 |
Page 24 |
Page 25 |
Page 26 |
Page 27 |
Page 28 |
Page 29 |
Page 30 |
Page 31 |
Page 32 |
Page 33 |
Page 34 |
Page 35 |
Page 36 |
Page 37 |
Page 38 |
Page 39 |
Page 40
