Parag K Adarkar

Insights Security at AI speed

Cybersecurity at AI speed: is your defence model ready?

Parag K Adarkar · · 5 min read

CybersecurityAI governanceUtilities

For most of the history of cybersecurity, both attack and defence moved at human speed. An intruder researched a target, probed it, waited, and tried again. A defender reviewed alerts, investigated, escalated and patched. Our processes, staffing and response times were all designed around that tempo.

That tempo is changing. Cybersecurity is moving from human speed to AI speed, and the question every CIO, CTO and CISO now has to answer is whether their defence model is ready for it.

What attackers have already shown

In November 2025, Anthropic disclosed what it described as the first reported AI-orchestrated cyber espionage campaign. A group it assessed as Chinese state-sponsored had manipulated Claude Code into acting as an autonomous operator against about 30 organisations, including technology firms, financial institutions, chemical manufacturers and government agencies, with a small number of successful intrusions.

The striking detail was the division of labour. The AI carried out an estimated 80–90% of the tactical work, including reconnaissance, vulnerability discovery, credential harvesting and data analysis, while human operators intervened only at a handful of key decision points. The AI also made mistakes, sometimes inventing credentials or overstating findings, which is a reminder that fully autonomous attacks are not yet routine. But the direction is clear.

Why utilities should pay particular attention

Energy companies were already a priority target before AI arrived.

In February 2024, the US cybersecurity agency CISA and its partners warned that the state-sponsored group known as Volt Typhoon had compromised organisations in the energy, water, transport and communications sectors. The agencies assessed with high confidence that the group was pre-positioning itself on IT networks in order to move later into operational technology and disrupt it, and found that it had kept footholds in some victims’ environments for at least five years. It did so largely by “living off the land”, using valid credentials and built-in system tools rather than malware.

The International Energy Agency reports that cyberattacks on energy utilities have tripled in the past four years and have become more sophisticated because of AI.

Combine patient, well-resourced adversaries with tools that let them work faster and at greater scale, and the margin for slow detection shrinks sharply.

The good news: defenders get AI too

The same capabilities are available to defence, and the results so far are encouraging.

In DARPA’s AI Cyber Challenge, whose finals concluded in August 2025, autonomous systems found 54 of 63 deliberately planted vulnerabilities in real open-source software and patched 43 of them. Along the way they discovered 18 real, previously unknown vulnerabilities. Patches took an average of about 45 minutes, at an average cost of around $152 per task. The finalists’ systems are being released as open source.

In April 2026, Anthropic launched Project Glasswing, giving a restricted, highly capable model to organisations that maintain critical software, including major cloud, chip and security companies and the Linux Foundation, so they can find and fix vulnerabilities before attackers do.

The race is no longer about whether AI will be used in cybersecurity. It is about which side uses it more effectively.

Six shifts for a power-sector defence model

1. Shrink what can be seen. If reconnaissance happens at machine speed, every exposed service, forgotten test server and unpatched internet-facing system will be found. Maintain a continuously updated inventory of what is exposed, and measure time-to-patch for internet-facing systems in days, not months.

2. Treat identity as the main perimeter. Volt Typhoon succeeded with valid credentials. Phishing-resistant multi-factor authentication, strict control of privileged and service accounts, and monitoring for unusual but “legitimate” activity matter more than ever.

3. Hold the line between IT and OT. Pre-positioning in IT to reach operational technology is the pattern to defeat. Segment SCADA and grid control networks rigorously, control and record every crossing between IT and OT, and assume the corporate network may already be compromised.

4. Put AI to work in the security operations centre. Use AI to triage alerts, correlate events across systems, summarise incidents and draft response steps, so that analysts spend their time on decisions rather than on sorting. Keep humans accountable for containment and recovery decisions, especially anywhere near the grid.

5. Secure your own AI. Every AI assistant and agent you deploy is a new identity with access to data and systems. Give agents the minimum permissions they need, log what they do, test them against prompt injection, and include them in your threat model.

6. Rehearse at the new speed. Run tabletop exercises that assume an attacker who moves in minutes and works through the night. Check whether your escalation paths, approvals and communication plans still hold at that pace.

The Indian context

India’s power sector already has building blocks to build on. The Cyber Security in Power Sector Guidelines, 2021 set a baseline framework. CSIRT-Power, established in April 2023 as an extension of CERT-In, coordinates incident response, supported by sector-specific teams for thermal, hydro, transmission, grid operations, renewables and distribution. The Central Electricity Authority’s Cyber Security in Power Sector Regulations, 2025 were under finalisation at the end of 2025.

These are strong foundations. The opportunity now is to update them for adversaries, and defenders, that operate at AI speed.

The question to ask this quarter

Is our cyber defence model ready for AI-assisted security, on both sides of the fight?

If the honest answer is “not yet”, the place to start is not a new tool. It is a clear-eyed review of what an AI-speed attacker would find first, how quickly we would notice, and who would decide what to do next.

Sources