Cybersecurity has always been a race between attackers finding weaknesses and defenders closing them. AI is changing how quickly that race unfolds.

Tasks that once required significant time and specialized expertise can increasingly be automated, giving attackers new ways to identify opportunities, adapt exploits and move through environments faster.

For security teams, that acceleration raises an important challenge: An assessment reflects the environment at a specific point in time, but both the environment and the threats against it continue to change. When attackers can exploit new weaknesses before the next scheduled assessment, traditional validation cycles may leave critical gaps unaddressed.

In our first Cybersecurity Awareness Month post, we explored what "Securing the Next 250" means for technology leaders. This post takes a closer look at how AI is changing attack timelines, why operational technology (OT) presents unique challenges and what organizations can do to keep their security validation aligned with a changing threat landscape.

How AI is changing the attacker's timeline

Two developments illustrate how the threat landscape is evolving.

The window between vulnerability disclosure and exploitation is shrinking. The 2026 Verizon Data Breach Investigations Report identified vulnerability exploitation as the leading initial access vector, accounting for 31% of breaches in its dataset. Verizon also highlighted how AI is helping threat actors accelerate exploitation, in some cases reducing timelines from months to hours.

AI is taking on more of the attack process. In late 2025, Anthropic reported disrupting what it described as the first documented AI-orchestrated cyber espionage campaign. According to Anthropic, the attackers used AI to carry out an estimated 80–90% of the campaign's tactical operations, with humans involved at a limited number of decision points. Targets included technology companies, financial institutions, government agencies and chemical manufacturers.

These examples point to a broader shift. AI isn't necessarily introducing entirely new attack techniques. It's helping automate and accelerate activities that previously required more time and specialized expertise.

For defenders, that changes the relationship between assessment schedules and actual exposure. Penetration tests and security assessments may happen quarterly or annually, while network configurations, access permissions, vulnerabilities and attacker capabilities evolve continuously.

A security posture validated months ago may no longer reflect the environment an attacker encounters today.

Where AI-accelerated attacks show up in IT

In traditional IT environments, AI is influencing several familiar attack techniques.

Faster exploitation of known vulnerabilities. When a vulnerability is disclosed, AI can help attackers analyze technical details, adapt publicly available proof-of-concept code and identify potentially exposed systems. Combined with existing automation, these capabilities can shorten the time organizations have to respond before exploitation begins.

Automated reconnaissance. Identifying exposed services, mapping networks and finding potential paths to valuable data have traditionally required significant manual effort. As the Anthropic case illustrates, AI agents can now perform substantial portions of this work with less direct human involvement.

More convincing social engineering. Generative AI allows attackers to produce polished, personalized phishing messages at scale. Traditional warning signs, such as poor grammar or awkward phrasing, are becoming less reliable indicators of malicious activity.

None of these are entirely new attack categories. What's changing is how efficiently attackers can execute them and how quickly defenders may need to respond.

That acceleration becomes particularly consequential when attacks extend beyond traditional IT systems into environments responsible for physical operations.

Why OT is especially hard to protect

Operational technology supports essential physical processes across manufacturing, energy, utilities, transportation, building automation and other critical infrastructure.

These environments face many of the same cybersecurity threats as traditional IT, but their operational requirements make security testing and remediation more complicated.

Attackers are targeting operational processes. The Dragos 2026 OT Cybersecurity Year in Review describes adversaries moving beyond initial network access to develop a deeper understanding of industrial environments, including control systems and physical processes.

This matters because successful attacks against OT can have consequences beyond data loss, potentially affecting equipment availability, operational continuity and safety.

Attackers are exploiting delays between disclosure and remediation. Threat actors can take advantage of newly disclosed vulnerabilities in internet-facing and edge devices before organizations have implemented available fixes. Specialized groups may also establish initial access and transfer it to other attackers, creating additional opportunities for compromise.

These techniques are not necessarily AI-driven. However, as AI and other automation capabilities accelerate reconnaissance and exploitation, existing OT weaknesses can become more consequential.

Defenders can't always patch or scan without disruption. Unlike traditional IT systems, OT equipment may need to operate continuously. Aggressive scanning, unplanned downtime or software changes can interfere with production processes, and some legacy systems have limited or no available patches.

Visibility and segmentation remain challenges. In complex industrial environments, incomplete asset inventories, insufficient monitoring and weak separation between IT and OT networks can make it difficult to identify potential attack paths and understand which systems are exposed.

The result is a difficult combination. OT environments are often assessed less frequently because testing is harder and riskier, yet they continue to change as vendors add remote access, firewall rules are modified and new vulnerabilities are disclosed.

Each change can introduce a potential path to critical assets that did not exist during the previous assessment.

The consequences are not theoretical. As NIST highlighted in its discussion of water and wastewater OT security, attackers have accessed internet-facing control devices at U.S. utilities and modified passwords and network settings, preventing operators from accessing affected equipment.

While these incidents were not necessarily AI-driven, they illustrate the kinds of exposure that faster attack capabilities can make more urgent.

This is where the Cybersecurity Awareness Month theme, Securing the Next 250, becomes especially relevant. Protecting the infrastructure communities depend on requires security practices that can adapt as technology, operations and threats evolve.

What keeping pace looks like

Defenders cannot address faster attacks simply by performing the same assessments more frequently.

Keeping pace requires changing what triggers validation, how risks are prioritized and where testing takes place.

1. Tie validation to change, not just the calendar

A security assessment reflects the environment at the time it was performed.

A new firewall rule, vendor connection, software update or disclosed vulnerability can change what an attacker might be able to reach after that assessment is complete.

Organizations can strengthen their approach by treating significant environmental changes as triggers for targeted revalidation rather than relying exclusively on the next scheduled test.

Regular assessments still provide an important baseline. Change-driven validation helps ensure that baseline remains relevant between testing cycles.

2. Prioritize the paths that lead to critical assets

Not every vulnerability presents the same level of risk.

A weakness on an isolated system may have a very different impact than one an attacker could combine with other exposures to reach critical infrastructure.

Instead of focusing solely on vulnerability counts or severity scores, security teams should consider how weaknesses connect and what an attacker could ultimately access.

This attack-path perspective helps organizations prioritize remediation based on potential impact, available controls and the systems most important to operations.

3. Test safely, especially in OT

Production OT environments cannot always tolerate disruptive security testing.

One approach is to validate potential attack paths against an accurate digital model of the environment, such as a digital twin, rather than executing attack simulations against live operational systems.

When the model accurately reflects the relevant assets, connections and configurations, this approach can enable more frequent validation while reducing operational disruption.

It's the approach behind TSG/ControlBurn, which TSG launched in October 2026 with technology partner Frenos.

TSG/ControlBurn builds a digital twin of an OT environment and tests attack paths against the copy, never production. This helps organizations identify which paths could reach critical assets and prioritize the exposures that matter most.

4. Put AI to work on defense

The same capabilities that help attackers process information and identify opportunities can support faster defensive decision-making.

AI-assisted tools can help security teams analyze configuration changes, identify unusual network activity, correlate threat information and surface potential attack paths that warrant investigation.

These capabilities do not replace security expertise or human judgment. They can help teams process information more efficiently and focus their attention on risks requiring action.

5. Close the gaps attackers rely on

AI-driven security capabilities are valuable, but foundational controls remain essential.

Separating IT and OT networks, securing remote and vendor access, maintaining visibility into connected assets and monitoring OT network traffic can help reduce opportunities for attackers to move through an environment.

These practices also support more effective validation by making it easier to understand which systems are exposed, how they connect and where additional protections may be needed.

The objective is not simply to detect attacks faster. It's to reduce the number of viable paths attackers can use in the first place.

Security that moves at the speed of change

AI hasn't changed the goal of cybersecurity. It has changed the clock.

As attackers gain the ability to identify and exploit weaknesses faster, organizations need security practices that reflect how quickly their environments and exposure can change.

Securing the next 250 means building programs that keep pace: validating after meaningful changes, prioritizing paths to critical assets and testing in ways that protect operational continuity.

One practical place to start is by asking what has changed since your last security assessment and whether those changes have been evaluated for new exposure.

This challenge is central to what we call the assessment half-life: the gradual decline in how accurately an assessment reflects an environment as configurations, connections and vulnerabilities change.

Explore the concept in greater depth in our whitepaper, The assessment half-life, including why traditional assessment cycles can leave OT environments exposed and how a more adaptive validation approach can help.

At The Select Group, we help organizations strengthen cybersecurity across IT and OT, from threat detection and mitigation to governance, risk and compliance and system hardening, including OT attack-path validation through TSG/ControlBurn.