AI has 'potential' to turn script kiddies into sophisticated infrastructure attackers

When it comes to cyberattacks that shut down power grids, drinking-water systems, and other critical infrastructure, AI doesn’t – yet – turn script kiddies into sophisticated, nation-state attackers.

But “the potential is there,” according to operational technology (OT) security experts.

"One thing that we've relied on for years is security by obscurity when it comes to utilities," said Steve Swick, former chief information security officer at American Electric Power.

" The knowledge needed to do some of that stuff is getting less likely to be necessary," Swick added during a media panel ahead of the publication of Frenos' State of AI in Security report.

AI makes it easier and faster for human attackers to target critical infrastructure , gain access to utilities and manufacturing plants, and perform OT system reconnaissance.

“Basic access can recon documentation, and distill through that documentation very quickly to find out critical design features of your plant and facility,” said Paul Shaver, head of OT at Armadin, during the panel.

“I can download the manual for almost any automation controller, parse through that very quickly, and come up with ways that I can exploit a dedicated feature of something that was not secure by design.” Armadin is Kevin Mandia’s new security startup that uses swarms of autonomous AI agents to simulate real-world cyberattacks .

Prior to joining Armadin, Shaver spent six years as the global OT practice leader at Mandia’s earlier company, Mandiant, which Google acquired in 2022.

“I will fly my Mandiant flag for a second and try to steer away from the fear, uncertainty, and death of the world is coming to an end, and every script kiddie is now a very sophisticated nation-state adversary.

But I’m not going to say the potential is not there, because the tools are improving such that the access to information is so much quicker.” At Armadin, and with an AI assist, “I'm very quickly building tools in days that would normally have taken me months,” Shaver said.

“If it can do that for me, it's doing something similar for the folks that have a very basic skill set.

I wouldn't go so far as to script kiddies yet, but as the models improve, that becomes more of a possibility in this space.” Plus, as AI lowers the technical barriers to would-be OT hackers, “it advances the timeline,” said Harry Thomas, chief technology officer and co-founder of Frenos, a security company that does AI pentesting for OT environments.

“If a better-than-average script kiddie can now perform attacks,” Thomas said, “You have more threat actors out there.