2025 AI Threats: Critical Infrastructure at Risk

The Mandiant 2025 Cyber Threat Report dropped a bomb: a 45% increase in AI-powered cyberattacks against critical infrastructure (Mandiant). That number confirms what we’re seeing on the ground, a complicated and growing threat to energy security. The real question is, how do we defend our core energy systems when the attacks are getting this smart?

45% Increase in AI-Driven Reconnaissance Attempts

That 45% jump in AI-driven reconnaissance that Mandiant reported isn’t an abstract number. It’s a total change in the threat model. Recon used to be manual work, with attackers painstakingly mapping networks and looking for holes. AI automates all of it. Now, automated tools scan huge parts of internet-facing infrastructure with frightening speed, zeroing in on weak points in SCADA and DCS systems that run our grids and pipelines. Forget simple port scans. We’re now up against AI agents smart enough to mimic normal traffic, which makes them a nightmare to detect. I’ve seen it in incident response cases: by the time your human analysts even spot one of these advanced probes, the AI has already finished its intel gathering and is probably preparing a much bigger attack.

The Mean Time to Detect (MTTD) for AI-Powered Intrusions Extends to 280 Days

A recent study by the Ponemon Institute (referenced by IBM Security) put the average Mean Time to Detect (MTTD) for an AI-powered intrusion at about 280 days. For energy infrastructure, that’s an eternity, a breach left to fester that long could be catastrophic. People think throwing money at advanced IDS and SIEM platforms will fix this, but those tools are getting swamped by the sheer volume of subtle, AI-generated alerts. The challenge isn’t just about collecting logs. It’s about finding the real threat when the noise is deliberately designed to look harmless. An AI-driven attack can operate below standard detection thresholds, making tiny changes over months, which allows an adversary to establish deep persistence inside an OT network. Digging them out becomes a complex and expensive mess. We need our own AI systems that can spot these anomalous AI behaviors, you have to fight fire with fire.

Only 15% of Energy Sector Organizations Deployed AI for Defensive Purposes in 2025

So the threats are AI-driven, but what about the defenses? According to a 2025 report from the International Energy Agency (IEA), only 15% of energy companies had deployed AI for defensive purposes. This gap is a massive vulnerability. Most organizations are still stuck with signature-based detection and other rule-based systems that are purely reactive. That’s a losing game. AI threats are adaptive. They change their own signatures. Defending against a learning AI requires a learning defense. This means moving to predictive analytics, behavioral anomaly detection, and autonomous response. For example, a defensive AI could baseline the normal performance of a turbine or the pressure in a pipeline, so that any tiny deviation, something a human would miss, triggers an alert, possibly catching an AI-led attack before it does real damage. Companies are hesitant because of the cost, the complexity, or the ‘black box’ feel of AI, but the cost of getting hit is far higher than the cost of preparing. It’s the same story we’re seeing in other sectors, with many projects stalling as discussed in why 70% of AI integration projects stall in 2026.

Projected $2.5 Billion in Damages from Energy Sector Cyberattacks by 2028

The World Economic Forum’s 2026 meeting came out with a projection: damages from cyberattacks on the energy sector could hit $2.5 billion a year by 2028 (World Economic Forum). Honestly, that number feels low. The financial damage isn’t just about repair costs. It’s the lost revenue from outages, the regulatory fines that follow, the damaged reputation, and the massive cost of rebuilding trust with the public. Imagine a major city losing power, commerce stops, hospitals are crippled, public safety is at risk. Those indirect economic costs will dwarf the direct damages. On top of that, you have the huge investments needed to harden the infrastructure against these new threats. This requires redesigning entire operational architectures, integrating AI-driven monitoring, and training a new generation of security pros who understand both OT and AI. We see similar pressures in other regions, like those outlined in the UAE energy tech digital shift imperatives for 2026.

90% of Operational Technology (OT) Systems in Energy Remain Unpatched or Lack Modern Security Features

Here’s the scariest part, and where most IT-centric security plans fail. A 2025 Deloitte report found that about 90% of Operational Technology (OT) systems in the energy sector are unpatched or lack modern security. This is the real world of critical infrastructure. You can’t apply IT security logic to OT. These environments control physical things, and they’re full of legacy systems designed decades ago without any thought of internet connectivity. They have extremely long lifecycles and ironclad uptime requirements that make patching a nightmare, you often can’t do it without shutting down a plant. The idea that we can just roll out patches is pure fantasy. Many of these devices use proprietary software on ancient operating systems, so they can’t even run modern security agents. Management often decides the risk of a bad patch taking down a physical process is higher than the cyber risk. This thinking is dangerous. AI-powered threats are designed to exploit exactly these weaknesses, mapping out old firmware flaws and crafting exploits that sail right past network segmentation. The fix is a multi-layered approach: deep network segmentation, continuous passive monitoring of OT traffic to spot anomalies, one-way data diodes, and strict access controls. A phased modernization to replace the oldest gear with secure-by-design hardware is unavoidable, but it demands serious capital and careful planning to keep the lights on.