Preparing Infrastructure for AI-Driven Cyber Threats

Adam Cady

Preparing Infrastructure for AI-Driven Cyber Threats

27 seconds.

That’s the fastest time from initial access to lateral movement that CrowdStrike recorded in its 2026 Global Threat Report. The average was 29 minutes. Most change-control meetings take longer.

Behind that speed is a new kind of attacker. In late 2025, Anthropic disclosed the first reported AI-orchestrated espionage campaign: a group it assessed as Chinese state-sponsored used AI agents against about 30 organizations, with the AI doing an estimated 80 to 90 percent of the tactical work. Adversaries now get machine speed and machine scale for the price of a subscription.

Most infrastructure strategies were built on assumptions from a slower era. Four of them no longer hold.

Four assumptions AI just broke

“We’ll patch before they get here.” CrowdStrike found 42% of exploited vulnerabilities were hit before public disclosure. For edge appliances, scanning often starts within hours of an advisory, before patched firmware even ships. An AI that reads the advisory, writes the exploit and sprays it across the internet doesn’t wait for your maintenance window.

“Our perimeter will hold.” According to the 2026 Verizon DBIR, vulnerability exploitation passed stolen credentials as the top way in for the first time. Edge devices and VPNs went from 3% to 22% of exploitation-driven breaches. The perimeter isn’t just being tested. It’s the target.

“We’ll spot lateral movement in time.” Human-paced detection and response assumes a human-paced attacker. When an agent maps internal services and tries credentials at a pace no human team could match, the gap between first alert and full compromise can be shorter than the time it takes to page the on-call engineer.

“If something breaks, we’ll log in and fix it.” This is the assumption that matters most, and the one least often questioned. Automated attackers go straight for the management plane: consoles, VPN concentrators and admin interfaces. If the only way to reach your equipment runs through the network under attack, your recovery plan depends on the attacker’s cooperation.

Build for recovery at machine speed

You can’t out-scan or out-patch an AI. You can make sure your ability to respond never depends on the infrastructure it’s attacking.

That is the job of true out-of-band management. A dedicated LTE path, running on separate hardware outside the production network, gives engineers direct serial console access to every router, switch and firewall. From there they can cut off a compromised segment, roll back to a known-good configuration or power-cycle a device through serially controlled power control, even while the in-band network is locked, flooded or being watched.

That path has to be invisible to the scanners hunting for it. That means private APN connectivity instead of a public IP address, two-factor authentication on every session, and cryptography you can prove. That proof is FIPS 140-3 validation through NIST’s Cryptographic Module Validation Program, not a “compliant” label. With FIPS 140-2 certificates moved to NIST’s Historical list on September 22, the difference is now easy for auditors to spot.

Where to start

• This week: Look at your own external footprint the way an AI would. List every management interface that can be reached from the internet, and treat each one as already found.
• This month: Require a second factor for every administrative session, and check every “FIPS” claim in your network against a FIPS 140-3 certificate number.
• This quarter: Put an independent, validated out-of-band path in front of the consoles at your most critical sites, and rehearse a recovery that never touches the production network.

Speed is the new threat model

The next wave of attacks won’t announce itself with a ransom note on day one. It will move quietly, quickly and everywhere at once. The teams that come through it will be the ones that planned their recovery path before they needed it.

Communication Devices, Inc. designs and builds FIPS 140-3 validated, LTE-based out-of-band management and power control equipment in the USA. Explore the platform at commdevices.com.

#SmarterOutOfBand #OutOfBandManagement #FIPS1403Validated #ConsoleServer

Sources

• Disrupting the first reported AI-orchestrated cyber espionage campaign (Anthropic)
• Anthropic Reveals the First AI-orchestrated Cyber Espionage Campaign (ExtraHop)
• 2026 CrowdStrike Global Threat Report press release (CrowdStrike)
• DBIR 2026: Edge Exploits Hit 22% of Breaches (Cybele Software, summarizing Verizon DBIR 2026)