Critical Infrastructure Security Unspecified actors making AI-assisted attacks on critical infrastructure August 20, 2026 Share By Steve Zurier (Adobe Stock) Five major agencies of the federal government released a cybersecurity advisory Aug. 19 that unspecified threat actors are mounting AI-assisted attacks on Siemens S7 Series programmable logic controllers (PLCs) at critical infrastructure facilities nationwide. At a time when the government warned last month that Iran-backed actors are suspected of cyberattacks on municipal water systems, the agencies urged organizations to treat the potential for attacks on PLCs with urgency. “Depending on the specific circumstances, exploitation of poorly protected PLCs could lead to disruption of critical industrial processes, safety incidents, downtime or equipment damage, compromise of sensitive data, compliance violations, and cascading impacts across interconnected systems,” the advisory said. The sectors most at risk include manufacturing, energy, water and wastewater, chemicals, food and agriculture, and commercial facilities. This latest advisory was made by the National Security Agency (NSA), the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), Department of Energy (DOE), and the Environmental Protection Agency (EPA). “Expecting a small municipal utility or local water district to defend itself against automated, AI-driven attacks on its own simply isn't a fair fight,” said Gary Barlet, Public Sector CTO at Illumio. “They don't have the budget, staffing, or operational capabilities to keep pace with that level of automation.” Barlet added that advisories and warning bulletins are helpful, but we can't patch our way out of a real-time attack. The federal government has to play a more active role in helping these communities build resilience, said Barlet. “The focus can't just be on preventing every intrusion,” said Barlet. “It has to be on helping local teams contain breaches when an adversary inevitably gets in and ensuring critical public services remain operational." John Watters, chief executive officer at iCounter said every advisory like this reads the same way for a 900-employee water utility in the Midwest: patch immediately, segment your network, deploy ICS-aware monitoring. “Good advice, but that utility doesn't have an OT security team, it has one IT person covering everything from email to the PLCs running the treatment plant,” said Watters. “The advisory itself says these actors are using AI to generate exploitation scripts and disguise them as legitimate monitoring tools, scanning services like Censys and ZoomEye to find exposed devices, that's a low-cost, scalable operation on the attacker side, and it's landing hardest on the targets with the least capacity to respond: small utilities, small manufacturers, municipal systems that were never built with a security budget in mind.” Watters said the problem will not fix itself with yet another advisory. “What's actually needed is direct resourcing, shared detection tooling, and regional coordination that doesn't require every small utility to build its own OT security program from scratch, because most of them can't and won't,” said Watters. John Gallagher, vice president at Viakoo, said Siemens PLCs are being targeted because they are ubiquitous in OT and are often internet-exposed: a sign of poor security around them. “AI also makes it much easier to compromise them,” said Gallagher. “Many PLCs are running outdated firmware and have weak credentials, making them targets as well. Because PLCs directly govern physical machinery and industrial processes, unauthorized read/write access can lead to severe operational and physical consequences. Think physical equipment damage (exploding pipes), life safety hazards, regulatory violations, and other real-world impacts. John Strand, owner at Black Hills Information Security, said malicious attackers have been suspected for some time of using AI to help break into organizations, and added that he’s glad to see CISA and the NSA sounding the alarm. “When the NSA says something like this publicly, it gets mainstream attention, and that matters,” said Strand. Strand said the country needs an “all-hands-on-deck” response: “If you work in cybersecurity and live in a community with a municipality, county government, hospital, utility, or other critical infrastructure, start building those relationships now. Reach out. Make sure the people responsible for those systems know who you are and how to contact you. This is also where local InfraGard chapters can play an important role by bringing people together before there’s a crisis. We cannot treat this as something government is going to solve by itself. It has to be government, industry, and private citizens with the skills and willingness to help their communities. Because right now, I don’t think we’re ready for what’s coming.” Steve Zurier Related Government security CISA explores single contract for cybersecurity software purchases SC Staff August 19, 2026 CISA is currently acquiring these tools through the Continuous Diagnostics and Mitigation program and its Capacity Building arm. Ransomware CISA confirms 2025 Windows Task Host flaw exploited by ransomware groups Steve Zurier August 18, 2026 Experts say teams should make this a priority, noting that the patch has been available since last November. Incident Response What the Iran cyberattacks can teach boards about cyber warfare James Turgal August 18, 2026 Here’s a 5-step plan for developing a defense plan that understands kinetic and cyber warfare are one-in-the-same today. Related Events Webcast Public sector security: Achieving resilience in the AI age Tue Sep 8 Cybercast From code to cloud: Stopping attacks in the software supply chain On-Demand Event Virtual Conference Securing the Backbone: Strategies to Counter Cyber Threats to Critical Infrastructure in the Public Sector On-Demand Event Get daily email updates SC Media's daily must-read of the most current and pressing daily news Business Email By clicking the Subscribe button below, you agree to SC Media Terms of Use and Privacy Policy . Subscribe You can skip this ad in 5 seconds