The critical infrastructure behind our utilities, factories, transport systems and hospitals has never been more at risk. Decades-old OT built for connectivity rather than security now runs alongside IoT, private 5G and physical AI, and frontier AI is shrinking the time from vulnerability discovery to exploitation from months to minutes.
For the 2026 State of Critical Infrastructure Cybersecurity report, Palo Alto Networks surveyed more than 1,600 security leaders across 11 countries and five critical sectors. The readiness gap is growing from both sides.
Today’s defences are already under pressure
- Incomplete visibility: 68% lack complete, real-time visibility of all assets connected to their OT networks, more than half of it attributed to legacy OT systems.
- Tool sprawl: organisations use an average of seven separate tools to monitor risk. When a tool sees a threat but cannot act, the alert waits for a person; against machine-speed attacks, that handoff is the exposure.
- Separate IT and OT: 74% have not yet fully integrated IT and OT security operations.
- Unpatchable assets: 42% name legacy, unpatchable OT assets as their single biggest risk, the natural result of equipment designed for safety and uptime above all else.
Leaders are bracing for AI-powered attacks
95% of leaders are concerned about frontier AI-powered attacks on critical infrastructure. 60% suffered a significant breach in the past year, and half of those cited physical safety concerns.
The speed gap is stark: in 2026, 29% of CVEs were exploited within 24 hours, while the industry average to deploy a patch is 55 days. Frontier AI does not create the underlying weaknesses, but it compresses the time to find, prioritise and protect them. 91% expect AI-driven cybersecurity to play a role in defending against these exploits.
Four priorities now
1. Know what matters, not just what is connected
92% say alert prioritisation is important or critical, yet half still rely on CVSS scores or manual review. Continuous, non-intrusive visibility across OT, IoT, IT and private 5G should rank each asset by what it controls, how exposed it is and the operational impact if it fails.
2. Contain threats before they spread
Only 53% have policy enforcement and access controls across connected assets and users. Frontier AI shortens how long attackers need to get in; segmentation limits how far they can go, keeping one compromised device from becoming a plant-wide outage.
3. Protect at machine speed
“Find the flaw, wait for the vendor fix, schedule a maintenance window” worked when attackers were slow. Today only 40% have virtual patching or other immediate compensating controls. The measure that matters is no longer time-to-patch but time-to-protection: AI-driven defences that stop exploits of known and unknown vulnerabilities at the network, without touching the device or halting the process.
4. Accelerate IT–OT collaboration
Shared visibility, coordinated security operations and common workflows speed up containment while reducing operational cost and complexity.
Palo Alto Networks’ response
The recent PAN-OS 12.2 Ceres release introduced Frontier Virtual Patching, new ruggedised Next-Generation Firewalls and enhanced OT defence features including microsegmentation and attack path mapping, working together with the Strata network security platform and Advanced Threat Prevention.
Albisec supports energy, manufacturing and healthcare organisations with OT segmentation design, Palo Alto NGFW deployment and virtual patching policies. Request an assessment.
Source: Palo Alto Networks Blog, “State of Global Critical Infrastructure Cybersecurity 2026: 95% of Leaders Concerned About Frontier AI-Powered Attacks”, 6 October 2026. Image: Palo Alto Networks.
