95% of Critical Infrastructure Leaders Are Concerned About Frontier AI Attacks

Frontier AI Is Raising the Stakes for Critical Infrastructure

Critical infrastructure operators are facing a growing cybersecurity challenge as legacy operational technology (OT) systems increasingly operate alongside connected technologies such as IoT, private 5G and physical AI.

Palo Alto Networks says Frontier AI is adding another layer of risk by reducing the time between vulnerability discovery and exploitation.

The company points to research indicating that this window can shrink from months to minutes.

To examine how organizations are responding, Palo Alto Networks surveyed more than 1,600 critical infrastructure security leaders across 11 countries and five critical sectors for its 2026 State of Critical Infrastructure Cybersecurity Report.

The findings point to a combination of existing infrastructure challenges and growing concern about AI-powered attacks.

Organizations continue to report incomplete visibility, fragmented security tools, difficulty prioritizing risks and challenges connecting IT and OT security operations.

At the same time, security leaders are preparing for attackers that may be able to identify and exploit weaknesses at significantly greater speed.

95% of Leaders Are Concerned About Frontier AI-Powered Attacks

The most prominent finding is the level of concern around AI-enabled threats.

Palo Alto Networks reports that 95% of surveyed leaders are concerned about Frontier AI-powered attacks against critical infrastructure.

That concern comes alongside existing security pressures.

According to the survey:

• 60% of organizations experienced a significant security breach in the previous year.

• 50% of respondents cited physical safety concerns as a result of security incidents.

• 91% expect AI-driven cybersecurity to play a role in defending against exploits accelerated by Frontier AI models.

The findings suggest that critical infrastructure security leaders are not viewing AI only as an attacker capability. They also expect AI-driven cybersecurity to become part of the defensive response.

The report frames this as a growing race between the speed of attacks and the ability of organizations to identify, prioritize and contain threats.

Legacy OT Systems Remain a Major Challenge

The report highlights several weaknesses that predate Frontier AI.

One of the most significant is incomplete visibility across operational technology environments.

Palo Alto Networks reports that 68% of organizations do not have complete, real-time visibility of all assets connected to their OT networks.

More than half of respondents attributed this visibility challenge to legacy OT systems.

These environments can include equipment that was designed around operational requirements such as safety and uptime rather than modern cybersecurity controls.

Another issue is security tool sprawl.

Organizations surveyed use an average of seven disparate security systems and tools to monitor and identify risk.

Palo Alto Networks says this fragmentation can increase complexity and cost. It can also create delays when one security tool identifies a threat but another system or human operator is required to take action.

For critical infrastructure environments, where operational disruption can have physical consequences, these delays can become particularly important.

IT and OT Security Operations Remain Disconnected

The survey also identifies a gap between IT and OT security operations.

Palo Alto Networks reports that 74% of organizations have not yet fully integrated IT and OT security operations across their organizations.

The company identifies technology incompatibility and differing priorities as leading barriers.

This separation can create gaps between where threats are detected and where security actions need to occur.

For critical infrastructure operators, the challenge is therefore not only detecting threats. It is also coordinating security decisions across environments with different technologies, operational requirements and risk considerations.

Unpatchable OT Assets Create a Difficult Security Problem

Patching is another area where traditional cybersecurity practices can be difficult to apply to critical infrastructure.

Palo Alto Networks reports that 42% of respondents identify legacy, unpatchable OT assets as their single biggest cybersecurity risk.

The report notes that unpatchability is not necessarily a failure by the teams operating these systems. Many of these systems were designed with safety and uptime as primary considerations.

That creates a difficult security equation.

A vulnerability may exist in an asset that cannot simply be taken offline, upgraded or replaced without affecting operations.

This makes compensating security controls increasingly important in environments where traditional patching cannot be performed quickly.

Frontier AI Is Compressing the Response Window

Palo Alto Networks says Frontier AI is changing the pace of vulnerability exploitation.

The report states that 29% of CVEs were exploited within 24 hours in 2026, while the industry average time to deploy a patch is 55 days.

These figures illustrate the gap the report identifies between attack speed and defensive response.

Critical infrastructure operators may need time to test fixes, coordinate maintenance and deploy changes safely.

Attackers, meanwhile, may be able to act much faster after vulnerabilities become known.

Palo Alto Networks says AI is increasingly being used to lower barriers to targeting OT environments, including identifying weaknesses in widely used software and generating attack logic for industrial systems.

The company argues that Frontier AI does not create the underlying weaknesses in critical infrastructure.

Instead, it can compress the amount of time organizations have to identify those weaknesses, prioritize them and deploy protections before exploitation.

Security Tool Sprawl Adds Complexity

Palo Alto Networks reports that organizations use an average of seven disparate security systems and tools to monitor and identify risk.

The company says many organizations consider this tool sprawl a source of additional complexity and cost.

For critical infrastructure environments, the problem is not simply the number of tools.

A threat detected by one system may still require another system or a human operator to take action.

The report argues that this handoff becomes more challenging when attacks operate at machine speed.

The broader issue is whether security operations can move from detection to action quickly enough to protect operational environments.

What Critical Infrastructure Leaders Should Prioritize

Palo Alto Networks identifies several areas that organizations should prioritize as they respond to the changing threat environment.

1. Know What Matters, Not Just What Is Connected

The survey reports that 92% of respondents consider alert prioritization important or critical.

However, only about half still rely on CVSS scores or manual review as part of that prioritization.

Palo Alto Networks recommends continuous, non-intrusive visibility across OT, IoT, IT and private 5G environments.

The report emphasizes prioritizing assets according to factors such as what each asset controls, how exposed it is and the operational impact if it fails.

The objective is to help security teams focus limited resources on risks that could have meaningful operational consequences.

2. Contain Threats Before They Spread

Palo Alto Networks reports that only 53% of organizations have policy enforcement and access controls in place across connected assets and users.

The report emphasizes segmentation and access controls as ways to limit how far an attacker can move after gaining access.

This becomes particularly important when critical infrastructure contains connected devices across plants, remote sites and other operational environments.

The underlying goal is to prevent a compromised device from becoming a much larger operational incident.

3. Protect Critical Infrastructure at Machine Speed

The report argues that traditional vulnerability management models may not be sufficient when attackers can move faster than organizations can patch.

Palo Alto Networks reports that only 40% of organizations have virtual patching or other immediate compensating controls in place today.

The company advocates AI-driven defenses that can protect against known and unknown vulnerabilities at the network level while organizations work toward an official fix.

The report frames this as a shift from measuring only time-to-patch toward measuring time-to-protection.

This is a recommendation and product-positioning perspective from Palo Alto Networks rather than an industry-wide standard.

4. Accelerate IT and OT Collaboration

The report also emphasizes closer collaboration between IT and OT security teams.

Shared visibility, coordinated security operations and common workflows can help organizations respond more effectively to threats while supporting operational resilience.

Palo Alto Networks connects this coordination with the need to reduce security complexity and improve how quickly organizations can contain threats.

Palo Alto Networks' Approach to Critical Infrastructure Protection

Palo Alto Networks says the goal is to make critical infrastructure harder to exploit by placing appropriate protections around vulnerable systems.

The company argues that critical infrastructure security requires visibility across the environment, prioritization based on operational and safety risk, and greater automation in incident response while keeping operators in control of critical decisions.

The company also highlights several of its own offerings and recent announcements.

Palo Alto Networks says PAN-OS 12.2 Ceres introduced capabilities including Frontier Virtual Patching, new ruggedized next-generation firewalls and enhanced OT defense features such as microsegmentation and attack path mapping.

The company also describes its Frontier AI Critical Defense Program, which it says enables leaders across operational technology, healthcare, commercial software and open-source communities to coordinate with Palo Alto Networks on proactive virtual patching.

These are Palo Alto Networks' stated capabilities and initiatives described in the source.

The Bigger Picture: Critical Infrastructure at AI Speed

The Palo Alto Networks report highlights a growing mismatch between the operating realities of critical infrastructure and the speed of AI-assisted cyber threats.

Many organizations continue to operate legacy OT systems that cannot be easily patched or replaced. They also face incomplete visibility, disconnected IT and OT security operations and fragmented security tooling.

At the same time, Frontier AI is reducing the time attackers may need to identify and exploit vulnerabilities.

The survey results suggest that critical infrastructure leaders recognize the changing threat environment. 95% report concerns about Frontier AI-powered attacks, while 91% expect AI-driven cybersecurity to play a role in defending against exploits accelerated by Frontier AI models.

The announcement highlights a broader industry shift toward security programs that focus not only on vulnerability discovery and patching, but also on visibility, prioritization, segmentation, compensating controls and coordinated response.

For critical infrastructure operators, the central challenge is balancing cybersecurity improvements with the safety, availability and operational requirements of systems that may have been designed decades ago.

As AI accelerates both discovery and exploitation, the ability to protect critical systems may increasingly depend on how quickly organizations can move from identifying a risk to applying effective protection.