The Internet is Under Attack. Critical Infrastructure Cannot Afford to Wait

The next major cybersecurity crisis may not be caused by a single sophisticated attack. It may emerge from thousands of vulnerabilities, exposed systems and outdated technologies that organisations have known about for years but have failed to fix.

The warning signs are already here. The question is whether security leaders will act before these weaknesses become a much bigger problem.

Recent developments suggest that the window between discovering a vulnerability and seeing it exploited is becoming increasingly difficult to manage. Artificial intelligence is accelerating the development of exploitation tools, lowering the technical barriers to cyberattacks and increasing the pressure on security teams that are already struggling to keep up.

A joint cybersecurity advisory released by the US National Security Agency, the Cybersecurity and Infrastructure Security Agency, the FBI and other government agencies on August 19, 2026, highlights the seriousness of this threat. The advisory warns of active targeting of Siemens S7 Series programmable logic controllers, commonly used to automate industrial processes.

According to the advisory, threat actors are using AI generated scripts disguised as legitimate monitoring tools to identify and access poorly protected industrial systems. The potential consequences include disrupted operations, damaged equipment, safety incidents and cascading effects across interconnected infrastructure.

These are not merely problems for IT departments. They are risks to the physical systems that support electricity, water treatment, manufacturing, agriculture and other essential services.

The full advisory is available here.
https://media.defense.gov/2026/Aug/18/2003983494/-1/-1/0/CSA_Active_Threat_to_Siemens_S7_Series_PLCs.PDF

The vulnerability tsunami

For years, organisations have accumulated technical debt in the form of legacy infrastructure, unsupported software, poorly configured devices and systems that cannot easily be taken offline for maintenance. Many have also struggled to maintain accurate inventories of the assets connected to their networks.

Now, the threat environment is changing.

AI is making it easier for attackers to research systems, develop scripts and adapt existing techniques. Meanwhile, security teams must identify vulnerabilities, assess their impact, test patches, obtain approvals and deploy fixes without disrupting essential services.

In critical infrastructure, this process is particularly difficult. A vulnerable office computer may be patched after working hours. An industrial controller responsible for a production line, power facility or water treatment process may require extensive testing and a carefully managed maintenance window before any change can be made.

This creates a dangerous mismatch. Attackers can develop and adapt their techniques rapidly, while defenders may need weeks or months to remediate vulnerable systems safely.

The result could be a growing backlog of exploitable weaknesses arriving faster than organisations can address them.

The vulnerability tsunami is not necessarily one catastrophic event arriving on a particular date. It is the possibility that the volume and speed of exploitation will overwhelm organisations that have not prepared their infrastructure to withstand sustained pressure.

Patching alone will not save us

Patching remains essential, but it cannot be the only line of defence.

Some systems cannot be patched immediately because of operational constraints, compatibility issues, vendor dependencies or the risk of interrupting critical services. Others may no longer receive security updates. Even well managed organisations can find themselves unable to eliminate every exposure within an acceptable timeframe.

This is why network isolation must become a priority.

Air gapping involves physically separating a system from other networks, particularly those connected to the internet or corporate IT environments. A properly implemented air gap can significantly reduce remote attack opportunities, although removable media, maintenance laptops and other operational pathways can still introduce risk.

Data diodes offer another option. These devices enforce one way communication, allowing information to flow out of a protected network without permitting a return flow through the same connection. When correctly designed and deployed, they can support monitoring and reporting while reducing the possibility of remote access into sensitive environments.

Neither solution is suitable for every system. Industrial operations have legitimate requirements for monitoring, maintenance and data exchange. Isolation must therefore be designed around operational needs, safety requirements and the consequences of losing connectivity.

However, where remote connectivity is not essential, it should not be accepted simply because it is convenient.

Where connectivity is necessary, organisations should implement strict network segmentation, tightly controlled remote access, multifactor authentication, dedicated engineering workstations and continuous monitoring.

The objective is straightforward. If a vulnerability cannot be fixed today, the system should not remain unnecessarily exposed while the organisation waits for a patch.

Security leaders must go to their boards now

This is where cybersecurity leadership becomes a business issue.

Security teams cannot solve a growing infrastructure security problem through technical expertise alone. They need executive authority, funding, operational cooperation and the ability to make decisions that may inconvenience other departments.

Security leaders should use the current threat environment to engage their boards and executive management teams. The conversation should not centre on purchasing the latest AI security product or launching another transformation initiative.

It should begin with the basics.

Do we know what is connected to our networks? Which systems are exposed to the internet? Which critical assets are running unsupported software? Can we isolate vulnerable equipment? Do third party vendors have unrestricted remote access? Have we tested our backups and recovery procedures? Can we detect unauthorised changes to industrial control systems?

These questions should be followed by a practical, funded remediation plan.

Boards must understand that delaying security investment does not eliminate costs. It transfers those costs into the future, where they may arrive in the form of operational disruption, emergency remediation, regulatory consequences, reputational damage or threats to human safety.

The current environment presents an opportunity to secure support for measures that may previously have been dismissed as too expensive or operationally inconvenient.

Security leaders should not waste it.

The next 18 months require a different mindset

Organisations should prepare for a prolonged period of heightened pressure rather than assume that the current wave of threats will quickly pass.

Over the next 18 months, a sensible priority is to strengthen the infrastructure that already exists before expanding the attack surface with additional technologies.

That means maintaining accurate asset inventories, removing unnecessary internet exposure, prioritising critical patches, isolating operational technology, strengthening identity and access management, monitoring network traffic and rehearsing incident response.

It also means reviewing supplier access, documenting recovery procedures and ensuring that security teams can work directly with engineering and operations personnel.

For industrial environments, changes must be tested and coordinated with safety and operational requirements. Isolation and patching should be implemented through controlled processes, not improvised in ways that introduce new hazards.

AI may eventually help organisations detect threats, prioritise vulnerabilities and automate parts of their response. But AI cannot compensate for an organisation that does not know what it owns, has left critical systems exposed or cannot recover when an incident occurs.

The fundamentals remain indispensable.

This warning applies beyond the United States

Although the recent advisory focuses on activity targeting Siemens controllers in US based installations, its implications extend beyond American borders. The agencies explicitly caution that PLC targeting is broader than Siemens alone and encourage operators of other applicable systems to adopt relevant mitigations.

For countries such as Ghana, protecting critical infrastructure must be part of the wider digital transformation agenda.

As organisations expand their use of connected technologies across telecommunications, energy, water, manufacturing and public services, cybersecurity must be built into infrastructure planning from the beginning. Legacy systems, third party connectivity and limited maintenance windows should be treated as operational realities requiring deliberate risk management.

The cost of prevention must be weighed against the consequences of an incident that disrupts essential services.

Digital transformation without adequate security creates dependencies that can become liabilities. The more connected our infrastructure becomes, the more important it is to ensure that critical systems can withstand attacks, operate safely and recover quickly.

Secure the basics before the window closes

The coming challenge is not simply that more vulnerabilities will be discovered. It is that the time available to respond to them may continue to shrink.

Organisations that rely exclusively on patching will struggle when remediation cannot keep pace with exploitation. Those that invest in layered defences, network isolation, controlled access, monitoring and recovery will be better positioned to manage that pressure.

Security leaders must act now, and they must make the case directly to the people who control organisational priorities and funding.

Do not wait for an incident to prove that the risk was real. Do not wait for a critical system to be compromised before requesting the resources needed to protect it. And do not allow the excitement surrounding AI to distract from the infrastructure that keeps essential services running.

The next 18 months should be treated as an opportunity to reduce exposure, strengthen resilience and close the gaps that have remained open for too long.

The vulnerability tsunami may not arrive as a single wave. It may come as a relentless sequence of attacks against weaknesses we already know exist. Our best defence is to make sure those weaknesses are no longer easy to exploit.