On August 18, the NSA, CISA, the FBI, the Department of Energy, and the EPA put their names on the same document. Five agencies. That doesn't happen for a slow news cycle. The advisory warns that attackers are using AI-generated scripts to reach into Siemens S7 programmable logic controllers across water systems, power generation, chemical plants, food production, and manufacturing. The language they chose was "not a theoretical risk."
The headlines went where you'd expect. AI is attacking the power grid.
Then Siemens responded and said something the headlines mostly skipped: there is no new vulnerability here. No fresh CVE. Nothing in the product changed. What changed is that somebody pointed AI at a set of misconfigurations we have known about, complained about, and written advisories about for the better part of two decades.
The controllers were on the open internet. Running old firmware. With default passwords.
That's the finding. We left the front door open, we've been getting three letters a month from the HOA about it, and we still haven't closed it. Years of letters. The door is still open.
Stop connecting things to the internet
I want to be unfair for a second, because the fair version of this argument has been made a hundred times and the door is still open.
Nothing except your public website belongs on the open internet. Nothing. Not your controllers, not your management interfaces, not your monitoring tools, not the thing a contractor stood up in 2014 so they could check a sensor from home. All of it goes behind multiple doors and multiple locks.
This is not an architecture project. You can stand up a working overlay network with something like Tailscale in about ten minutes. The gap between where you are and where you should be is measured in an afternoon, not a fiscal year. Which is exactly what makes it inexcusable.
Hackers carry a P&L
Here's the part of the AI story that's actually true, and it isn't the part in the headlines.
Attackers run a business. They always have. They do ROI math on every target: what does it cost me to build this capability, what's the probability it works, what's the payout, what's my exposure. They operate like your company does, with two differences. They move faster, and they have zero aversion to risk.
For years, that math was the only thing protecting small organizations. A rural water district wasn't safe because it was secure. It was safe because it wasn't worth the development time. The economics did the work that the security program didn't.
AI collapsed the cost of building an attack. When capability development gets cheap enough, the target floor disappears. There is no longer any such thing as too small to be worth attacking.
Which means the era of hiding behind bad hygiene and calling it a risk-based decision is over. You weren't making a risk decision. You were getting lucky inside somebody else's spreadsheet, and their spreadsheet changed.
You secure your loading dock. There's a fence, a gate, a camera, a badge reader, and somebody who notices a truck that doesn't belong. Breaching it takes equipment, time, proximity, and nerve. And yet the systems that run the actual plant are available to anyone on earth with a credit card and an AI account.
Explain that to me in a way that makes sense.
While we're here, vendors
Default credentials should not exist in 2026. Not on controllers, not on management consoles, and not on the monitoring tools that were supposed to be watching all of it.
The next firmware update should disable the default account outright, force a rotation on first boot, and refuse to come up until it happens. If that's too aggressive for the product managers in the room, here's my alternative: reset the default password to the Social Security number of whoever signed the purchase order. Let's find out how long it survives as a default.
The part nobody wants to say out loud
Being an above-average technology executive right now mostly means doing the basics well enough not to look foolish. That's a low bar. It's sitting on the ground.
So why do the people who trip over it keep getting hired, while genuinely excellent operators sit there with a green ring on their LinkedIn photo?
Here's my answer, and it's uncomfortable because it points at the top of the building instead of the bottom.
The organizations getting hit hardest are the ones investing least in technology maturity. Then, when it costs them, they double down on ignoring it. That pattern holds because the people doing the hiring have no way to evaluate the hire.
In twenty years of doing this work, the number of times a CEO has called and asked me to sit in on an interview for a CIO, CISO, CTO, CDO, or CAIO is zero. Not a handful. Not once in a while. Zero.
Companies that would never hire a CFO without a board member who reads financial statements will hire the person responsible for the systems that run the entire business based on a conversation about culture fit. And then they'll be genuinely surprised when it doesn't work.
What boards do about it
Three things, and none of them are hard.
Put a technologist on your board. Most boards are assembled from people who "worked in the industry," which usually means the parts of the industry that existed before software ate it. Meanwhile some enormous fraction of the business is now technology, and there is nobody in the room who can tell a competent answer from a confident one. Call the technologists you already trust and ask them to serve. If you don't know any, ask someone who does. I'll give you names.
Hire a real mentor, and bar them from bidding. Your security leader may be underwater and hiding it well. If you're unaware they're failing, that doesn't mean they're succeeding. It means they're failing quietly. So spend real money on somebody who has actually run this before, and let that person either get your leader up to speed or tell you honestly that it isn't going to happen.
And when you hire that mentor, put it in writing that they are permanently barred from bidding on any downstream work for the security organization.
I'm tired of "we wrote the specification, and then we bid on the specification." That is the fox writing the henhouse security policy, and it serves exactly one party. The large consultancies have become the same problem as private equity with a nicer billing model and the same enshittification. Every assessment becomes a roadmap, every roadmap becomes a statement of work, and somehow the answer is always more hours from the firm that did the assessment. Structure the engagement so that telling you the truth is the only product they can sell you.
Make the CISO report to the board. If your security leader is a senior director reporting up through a CIO who reports to the CFO, you've already announced your posture to everyone who has ever sat in on a board meeting, an investor call, or an analyst briefing. Attackers listen to those calls too. Reporting structure is public information, and it's a signal.
That one decision, all by itself, moves you up the target list. And I'm assuming your CIO gets meaningful board time and doesn't report to finance, because it isn't 2006 anymore.
And if you're the one holding the bag
If you're a CISO making half the national average or less, with no budget, no approval authority, no team, and a mandate from Satan, take a breath.
You are not the problem. Or at least you're not the only problem, and you're certainly not the one who should be losing sleep over it.
Reach out and let me see if I can help you find something better. Don't go down with a ship when everyone on the bridge was told exactly where the iceberg was and had no interest in turning.
What to do now
TO BOARDS: Ask your CIO and CISO one question at the next meeting: what of ours is reachable from the open internet, and why? If the answer takes more than a week to produce, you've learned something more important than the answer.
TO VENDORS: Kill default credentials in the next release. Not the roadmap. The next release.
TO CISOs AND CIOs IN IMPOSSIBLE JOBS: Call me. Free, no strings of any kind, and I'm not selling you anything on the back end. I'll tell you what I would do, and if the real answer is that you should leave, I know thirty people who would hire you and each of them knows twenty more.
Ignore another letter from the HOA at your peril.