Key Takeaways
- Senior U.S. and allied officials urge a focus on basic cybersecurity resilience rather than sensational AI‑driven threat scenarios.
- Organizations should shift from a prevention‑only mindset to ensuring continuity of essential services when systems are compromised.
- Legacy infrastructure, limited budgets, and overworked staff make sectors like water utilities especially vulnerable, regardless of AI use.
- The U.S. is adopting resilience‑centric programs such as CI Fortify, inspired by Australian and Canadian initiatives that define “minimum vital” systems.
- Effective resilience requires cross‑functional collaboration, with CISOs engaging senior leaders to plan for downtime and maintain mission‑critical functions.
- While AI can amplify hacking capabilities, the Trump administration prefers maintaining AI leadership over imposing restrictive regulations, advocating instead for sufficient guardrails.
- The accelerating pace of technological change raises the stakes for policymakers and security leaders, demanding a new risk calculus for operating in contested environments.
Shift from Prevention to Continuity
At the Black Hat 2026 conference, senior U.S. and allied officials emphasized that the immediate cybersecurity challenge is not speculative “runaway AI” but building resilience to operate effectively in a faster‑paced threat landscape. Michael Duffy, the acting U.S. federal chief information security officer, argued that organizations must move away from a pure prevention mindset and instead prioritize the continuity of their most critical services. He noted that failures are inevitable (“Things will go down”), so the focus should be on ensuring that essential functions can persist even when primary systems are compromised. This change in perspective reflects a broader need for a new risk calculus that acknowledges operating in a contested environment where disruption is the norm rather than the exception.
Legacy Systems and Pace of Change
Jonathon Ellison, director for national resilience at the UK’s National Cyber Security Centre, highlighted that many organizations are burdened by legacy issues that impede rapid adaptation. The combination of outdated technology, limited budgets, and overworked staff creates a environment where even modest cyber incidents can cascade into significant service outages. Ellison warned that the speed at which threats evolve outpaces the ability of many entities to modernize their defenses, making resilience—a capacity to absorb shocks and maintain core operations—more urgent than chasing the latest speculative threats. The panel agreed that addressing these foundational weaknesses is the first step toward a resilient posture.
AI’s Role in Hacking
While acknowledging that artificial intelligence can lower the barrier for attackers and potentially increase the destructiveness of cyber operations, the officials stressed that AI is not a prerequisite for harmful hacking. AI‑enhanced tools may automate reconnaissance, vulnerability discovery, or the crafting of phishing lures, but the underlying vulnerabilities that attackers exploit often exist independently of such technology. Consequently, the panic surrounding AI‑driven “nightmare scenarios” should not distract organizations from addressing the more immediate, tangible weaknesses present in their networks and operational technology.
Exploitable Vulnerabilities Without AI
The panel pointed to real‑world incidents that demonstrate how serious damage can occur without any AI involvement. Last week, Iran‑linked hackers targeted water utilities across at least twelve U.S. states, exploiting known weaknesses in aging operational technology, insufficient staffing, and constrained budgets. Water systems exemplify critical infrastructure that is particularly susceptible because they cannot afford prolonged downtime, yet they often run on legacy systems that lack modern security controls. This case underscores that even rudimentary hacking techniques can disrupt essential services when basic cybersecurity hygiene is neglected.
Case Study: Iran‑Linked Water Utility Attacks
The recent cyberattacks on water utilities serve as a concrete illustration of the resilience gap. Attackers leveraged simple intrusion methods—such as exploiting unpatched software or using compromised credentials—to gain access to control systems. Because many water agencies operate with minimal IT staff and rely on outdated SCADA (Supervisory Control and Data Acquisition) platforms, the attackers could manipulate processes, threaten water quality, or cause service interruptions. The incident prompted federal agencies to highlight the need for water sector operators to prepare for offline operations, implement segmentation, and develop incident‑response plans that assume compromise rather than rely solely on prevention.
U.S. Resilience Initiatives: CI Fortify
In response to growing concerns about critical infrastructure vulnerability, the Cybersecurity and Infrastructure Security Agency (CISA) launched the CI Fortify program. CI Fortify aims to get owners and operators of essential services to plan for downtime and to maintain functionality when networks are offline. Joseph Alm, the assistant secretary for cyber, infrastructure, risk and resilience policy at the Department of Homeland Security, explained that the initiative emphasizes “harm reduction” alongside traditional risk reduction. Operators are encouraged to identify which services must stay alive, develop manual work‑arounds, and invest in redundancies that allow them to continue delivering water, power, or communications even after a cyber incident.
International Models: Australia and Canada
CI Fortify draws inspiration from similar resilience frameworks abroad. Australia’s approach, which preceded the U.S. effort, focuses on helping critical infrastructure entities define the smallest set of systems necessary to keep essential functions running. Canada has adopted a parallel initiative called “Minimum Vital Canada,” led by Rajiv Gupta, head of the Canadian Centre for Cyber Security. Gupta described this effort as “incredibly important” for understanding how to prioritize assets and allocate limited resources toward the most crucial capabilities. By studying these models, U.S. policymakers aim to create a standardized method for determining what must survive an attack and how to sustain it under adverse conditions.
Cross‑Functional Leadership and CISO Role
Effective resilience cannot be achieved by the cybersecurity team alone. Duffy stressed that CISOs must engage senior leaders across the organization—operations, finance, executive management—to ensure that plans for maintaining essential services have broad buy‑in. He urged CISOs to initiate conversations that ask, “If this system goes down, what is our plan B? How do we keep the organization’s mission alive regardless of what’s happening to it?” Such dialogue fosters a culture where resilience is viewed as a business imperative rather than a technical afterthought, and where budgeting and planning reflect the need for continuity.
Policy Stance on AI Regulation
Despite the anxieties AI can provoke, the Trump administration has signaled little interest in imposing sweeping regulations on frontier AI models. Alm articulated the administration’s goal as preserving U.S. leadership in AI development, warning that excessive risk‑averse regulation could cede technological advantage to other nations. At the same time, he acknowledged the necessity of “sufficient guardrails” to prevent AI from creating immense danger. The administration’s stance reflects a preference for fostering innovation while relying on sector‑specific best practices and voluntary standards to mitigate AI‑related security risks.
Future Outlook and Stakes
Panelists concluded that while AI has not yet precipitated a catastrophic cyber crisis, the accelerating pace of technological change presents an unprecedented challenge for security leaders and policymakers. Ellison warned that “the stakes are way, way higher than they were before,” noting that the convergence of legacy vulnerabilities, resource constraints, and sophisticated adversaries demands a proactive resilience posture. By focusing on continuity, learning from international exemplars, and aligning leadership across functions, organizations can better withstand the inevitable disruptions of an increasingly contested digital environment.