AI Cyberattacks Outpacing Energy Sector Defenses

Energy infrastructure has always attracted cyberattackers. What’s changed is how little skill is now required for attackers to achieve their objectives, since AI increasingly supplies the expertise that attackers lack.

The capability acceleration is clear: In 2025, AI-generated social engineering allowed a Russia-aligned hacking group to target critical infrastructure throughout the UK. Last month, attackers used AI-assisted scripting to target programmable logic controllers (PLCs) used across the US energy sector.

The above campaigns didn’t require years of specialized experience in power systems engineering — only an attacker who knew how to efficiently deploy an AI model. 

How AI Accelerates the Attack Chain

AI can lower technical barriers at every stage of a breach, from initial access to internal execution.

• Reconnaissance & access: Threat actors leverage AI in the earliest stages to map victim networks and generate highly targeted, adaptive social engineering campaigns that bypass standard perimeter defenses.
  
• Internal execution & evasion: Once inside, AI helps attackers identify hidden vulnerabilities and abuse the very software operators rely on — making malicious commands look like legitimate system operations and blending seamlessly into operational technology (OT) traffic.

Use of AI can easily compress attack timelines, allowing threat actors to maneuver through environments before defenders realize that a perimeter has been breached.

Typical OT defenders take more than a month to detect a breach and an average of 7 months to comprehensively remediate the underlying vulnerability.

Key Factors Driving an Organization's Exposure

Key factors affecting an organization's level of vulnerability include:

• Smaller size. In the US, providers outside the largest 100 or so are generally considered the weakest links in the sector, since they lack the resources to scale defenses at the pace that major operators can.
• Legacy equipment. Older systems were never built with programmable security controls in mind, making equipment age a stronger predictor of cybersecurity maturity than budget size.
• Renewable installations. Many connect directly to the internet behind a single layer of control and smaller developers rarely have the budget to justify redundant firewalls, honeypots, or sophisticated monitoring.
• Operational scale. Larger utilities carry more substations, more interconnection points, and a large digital footprint, which can widen the attack surface even where resources are greater.

Only 46% of cybersecurity practitioners say that their own organization has adequate protection across its OT environment.

How Energy Entities Are Responding

For any energy sector entity, enhancing cybersecurity starts with fundamentals: a full asset inventory to catalog exposure, layered monitoring and detection, and disciplined patch validation before any update reaches production systems, at minimum.

The SANS Five ICS Cybersecurity Critical Controls have emerged as a reliable, achievable standard — favored over more complex frameworks — and focus on:

1. Dedicated incident response
2. Defensible network architecture
3. Continuous passive monitoring
4. Secure remote access
5. Risk-based vulnerability mitigation

While these fundamentals reduce overall exposure, prevention alone cannot account for live threats. Securing complex energy infrastructure ultimately requires continuous, real-time visibility into active network behavior.

What That Means for Security Teams

When adversaries use AI to move at machine speed, defenders cannot afford to spend days correlating logs or analyzing isolated alerts. Security teams need immediate, real-time context across the entire network to support their own defenses, helping them quickly spot unauthorized protocol behavior and lateral movement before disruption occurs.

AI-driven threats demand real-time network intelligence to counter attackers’ speed advantage and expose unauthorized protocol activity across IT and OT environments.

With the rapid convergence of IT and OT networks, network observability becomes even more critical.ExtraHop equips security teams with unalterable network telemetry — giving automated SOC tools and human analysts the real-time context needed to detect malicious behavior on the network and isolate internal threats in minutes, rather than months.