More than two-thirds (68%) of surveyed critical infrastructure organizations lack complete, real-time visibility into the assets connected to their operational technology (OT) networks, complicating protection against cyberattacks, according to a new report commissioned by Palo Alto Networks and conducted by Sapio Research.
The report, based on a survey of more than 1,600 leaders across 11 countries, found that 60% of organizations experienced a security incident affecting operations in the past year. Respondents represented manufacturing, healthcare and life sciences, energy and utilities, transportation, and government and public-sector organizations. OT includes systems that monitor or control physical equipment and processes.
“Visibility matters because it supports decisions about protecting the operation,” explained Harry Thomas, CTO and co-founder of Frenos, an OT security testing firm in Fulton, Md.
“Knowing a device exists is a starting point,” he told TechNewsWorld. “Teams also need to understand what it controls, what depends on it, who can access it, and what would happen if it became unavailable or its settings changed.”
“That context helps defenders prioritize risks and determine how to respond without creating a larger operational problem,” he added.
Legacy Systems Complicate Asset Visibility
Anup Kumar, CEO of Optiv Consulting, a cybersecurity advisory firm in Ashburn, Va., explained that OT visibility is challenging because environments often combine legacy equipment, proprietary protocols, and systems designed for reliability, not routine scanning.
“What works in IT can create risk in OT,” he told TechNewsWorld. “Without visibility, organizations cannot identify exposed assets, detect abnormal activity, or respond quickly to threats. Safe, continuous visibility is the foundation of operational resilience.”
One of the challenges to protecting critical infrastructure is that it’s constrained by assets that cannot be taken offline long enough to patch, while geopolitical tensions and expanding connectivity increase pressure on providers already working with limited resources, noted Jacob Krell, senior director for secure AI solutions and cybersecurity at Suzu Labs, a provider of AI-powered cybersecurity services in Las Vegas.
“Palo Alto’s report connects that pressure to real operational consequences, including safety concerns, unplanned downtime, production disruption and financial losses,” he told TechNewsWorld.
“The common thread is incomplete visibility across legacy systems, unmanaged devices, private 5G networks and other connected assets,” he said. “Separate IT and OT security teams, along with multiple disconnected tools, make the response slower and harder to coordinate.”
“The burden is heavier for utilities, hospitals, manufacturers, transport operators and government agencies because they cannot treat cybersecurity as a normal software-maintenance exercise,” he added. “A security team may know that a programmable logic controller is vulnerable, but still lack a reliable answer to the question that matters operationally: which pump, production step or safety process does it control?”
Security Tool Sprawl Slows Response
Surveyed organizations use an average of seven separate security systems and tools. Fifty-nine percent said multiple systems create operational complexity, 56% reported higher operating costs, and 41% cited delayed incident response.
The report found that 51% of organizations still rely on vulnerability severity scores or manual alert review for prioritization.
“Every additional tool is another console, another data model and another team that has to be in the room during an incident,” observed Gil Hecht, CEO and founder of Core6, an enterprise data infrastructure security company in Tel Aviv, Israel.
“With an average of seven security systems, alerts cannot be correlated, teams cannot prioritize, and half of organizations fall back to manual review, as the report shows,” he told TechNewsWorld.
“During an incident, time is lost reconciling what each tool says before anyone can act,” he said. “Resilience is a function of how fast you can understand and recover, and complexity slows both.”
AI-generated software could add another layer of complexity. “What worries me even more is the coming age of AI, where people can create applications and SaaS services incredibly quickly without necessarily knowing how to code,” said John Strand, owner of Black Hills Information Security, a penetration testing, red teaming, and threat hunting company in Spearfish, S.D.
“I believe the technical complexity of these environments is going to increase, not decrease,” he told TechNewsWorld. “And complexity is the enemy of computer security.”
Concern About AI Attacks
The report also highlighted widespread concern about attacks powered by frontier AI, meaning the most advanced AI models, alongside expectations that AI could strengthen defenses.
Ninety-five percent of respondents expressed at least some concern about such attacks targeting critical infrastructure, while 91% expected AI-powered cybersecurity solutions to help defend against them. Only 19% reported deploying AI across four or more operational areas of their businesses.
“AI can help illuminate parts of OT environments that have historically been difficult to see and analyze,” said Louis Eichenbaum, federal CTO of ColorTokens, a provider of zero trust microsegmentation solutions in San Jose, Calif.
“That includes undocumented assets, legacy software dependencies, insecure configurations, unusual communications between IT and OT, and attack paths spanning multiple systems,” he continued.
“It can also analyze large volumes of network telemetry, configuration files, engineering documentation, and vulnerability data much faster than a human team,” he added.
AI Erodes Security by Obscurity
Richard Springer, senior director of OT solutions at Fortinet, a provider of firewalls, intrusion prevention systems, endpoint security and antivirus programs in Sunnyvale, Calif., explained that historically, specialized OT devices and protocols created barriers for attackers, providing some protection through “security by obscurity.”
“AI is changing that dynamic by making it easier to identify OT devices, interpret industrial protocols, and provide guidance that previously required specialized expertise,” he told TechNewsWorld. “This could enable more threat actors to target OT environments, with potentially significant consequences given society’s dependence on critical infrastructure.”
“The speed of AI-driven attacks has brought the time to exploitation down to a couple of days at most,” added John Gallagher, vice president of Viakoo, an enterprise IoT security company in Mountain View, Calif.
“Due to AI, we are now at a point where 29% of vulnerabilities are exploited within 24 hours, while time to patch averages 55 days,” he told TechNewsWorld.
The comparison illustrates the narrow window defenders face, especially in OT environments where updates require careful testing and scheduled downtime.
According to Viakoo, OT and IoT environments use more than 150,000 distinct operating systems. Gallagher argued that AI weakens the protection those specialized systems have historically gained from “security by obscurity.”
“Frontier AI models can automate vulnerability discovery, reverse-engineer industrial logic and rapidly generate tailored attack scripts for specialized operational environments, allowing threat actors to scale targeted campaigns with unprecedented efficiency,” he explained.
Discovery Outpaces Remediation
AI could widen the gap between discovering vulnerabilities and fixing them in both IT and OT environments. “The fundamental challenge is that defenders are already struggling to keep pace with vulnerability volume,” said Ramy Rahman, senior principal solutions engineer at ArmorCode, a unified vulnerability management company in Palo Alto, Calif.
“AI accelerates discovery, analysis, and potentially exploitation without necessarily accelerating the operational processes required to fix those issues,” he told TechNewsWorld. “For critical infrastructure, where remediation may require maintenance windows, vendor coordination or extensive testing, that imbalance becomes particularly concerning.”
“AI doesn’t necessarily introduce entirely new attack techniques,” he continued. “It makes existing techniques faster, more accessible, and easier to scale. Both small and large security teams will feel that pressure.”
“AI can help defenders correlate information and identify meaningful attack paths, but it can also dramatically increase the volume of vulnerabilities and potential exposures that need attention,” he explained.
“Ultimately, resilience isn’t about eliminating every vulnerability,” he added. “It’s about understanding which risks matter most, identifying feasible mitigations and ensuring that security improvements don’t introduce the very operational disruptions we’re trying to prevent.”
