:quality(90):no_upscale()){kind=logo}
Attackers Now Outpace the Processes Built to Stop Them
STATUS: Evolving Threat Landscape SEVERITY: 7/10 AUDIENCE: Government, Critical Infrastructure, Transportation and Logistics Security Leads
Oct 12, 2026
·Blog
·Secure Communications
:quality(90):no_upscale())
Security leaders from Google, Mandiant, Symantec, Trellix, and CISA warn that AI is lowering the barrier to sophisticated cyberattacks, reducing the time between vulnerability disclosure and exploitation to minutes. The result is a growing need for government and critical infrastructure organizations to plan for operating through a compromise, not merely preventing one.2,3
What Happened
Nation-state attacks are weaponizing known vulnerabilities almost instantly.
At the Billington Cybersecurity Summit earlier this month, senior security leaders and government officials described a shift already underway: AI is lowering the technical bar for nation-state-level attacks while shrinking the time defenders have to respond. “The bar for a nation-state-level sophistication of an attack has gone down,” Vikram Thakur, technical director at Symantec by Broadcom, said, warning that AI now lets even ordinary cybercriminals mount attacks that look like nation-state operations.1
The most concrete change is speed. John Hultquist, chief analyst at Google's Threat Intelligence Group, described a shift from attackers who manually check for new vulnerabilities each day to autonomous systems that never stop looking, compressing the gap between disclosure and exploitation toward minutes or seconds. Trellix's John Fokker put the practical consequence plainly: organizations now have only a few seconds to close a window before someone is already inside.1 That timeline makes routine patching cycles, even disciplined ones, an unreliable defense on their own.
US officials are treating this as an active planning problem, not a future risk. CISA's acting director, Nick Andersen, raised the specific scenario security teams are now expected to plan around: a moment where an adversary nation moves to degrade civilian critical infrastructure directly, rather than merely positioning inside it. Mandiant's Charles Carmakal, who tracks intrusion activity into organizations capable of disrupting critical infrastructure, frames the open question the same way: the access already exists in many cases, and the remaining variable is whether a geopolitical trigger changes the calculus for using it.1
That's not a hypothetical confined to one country. Reported intrusions and disruptions across multiple regions this year, a sustained campaign against more than 100 US water utilities2, a four-day outage at a UK power generator attributed to suspected state-linked activity3, and confirmed account takeover campaigns against senior EU officials4, all fit the same pattern experts are describing: adversaries positioning inside or acting against civilian infrastructure well outside a declared conflict. The pre-positioning Carmakal describes is no longer theoretical. This year, it has already contributed to real outages and account compromises across multiple regions.
CISA's own guidance to CISOs reflects the shift from prevention to resilience. Andersen told the summit that tabletop exercises can no longer hand-wave away extended disruptions to power, telecommunications, water, cloud services, or suppliers as out of scope. The expectation now is that organizations plan to keep operating through a compromise, not simply to prevent one.1
What They Found and What It Means
Finding | What It Means | Operational Consequence | Open Question |
AI is compressing the gap between vulnerability disclosure and exploitation toward minutes, with researchers describing a future where autonomous systems monitor for new flaws continuously rather than waiting for a human to check. | Patch cadence, even a disciplined one, is no longer a sufficient defense on its own, because the exploitation window can close before a patch cycle completes. | Organizations relying solely on scheduled vulnerability management are structurally behind an adversary that doesn't sleep or wait for a convenient release window. | How many current patch and change-management processes assume a response window measured in days rather than minutes? |
Experts describe AI as blurring the line between nation-state and criminal capability, letting lower-skilled actors mount attacks that look state-sponsored. | Organizations can no longer rely on sophistication alone to determine who they are facing. The signals that once suggested an attack was state-backed are becoming less reliable. | An organization that never considered itself strategically significant may face nation-state-caliber tradecraft from an actor with no state backing at all, and vice versa. | Do current threat models still meaningfully distinguish between criminal and nation-state actors, or has that distinction become less useful? |
CISA has told CISOs to plan around operating through extended disruptions to power, telecom, water, cloud, or suppliers, rather than assuming those scenarios stay out of scope in planning exercises. | The federal government's own posture has moved from helping organizations prevent an incident to helping them survive one, a materially different planning bar. | An organization whose continuity plan still treats prolonged infrastructure disruption as a low-probability edge case is now out of step with the government agency coordinating the response to exactly that scenario. | Did your organization's most recent tabletop exercise actually test a scenario this severe, or was it implicitly assumed away? |
Why This Matters
Old Assumption | Current Reality | BlackBerry Response |
A meaningful patch cadence, weekly or monthly vulnerability scanning and scheduled updates, is an adequate defense against a serious adversary. | Security researchers describe the gap between disclosure and exploitation compressing toward minutes, driven by AI systems that monitor continuously rather than periodically. | BlackBerry® UEM enforces device compliance continuously rather than on a scan cycle, closing the gap between a patch becoming available and a device actually being verified as updated. |
Only organizations with obvious strategic value, defense contractors, major utilities, government agencies, need to actively model nation-state threats. | Experts describe AI eroding the line between criminal and state-sponsored capability, meaning sophistication alone no longer indicates who's behind an attack. | BlackBerry® SecuSUITE® and BlackBerry® AtHoc® are built on the assumption that any organization handling sensitive coordination is a plausible target, not a contingent one, regardless of how the organization sees its own strategic profile. |
Business continuity planning can reasonably treat extended power, telecom, water, or cloud disruption as an edge case unlikely enough to hand-wave in a tabletop exercise. | CISA is now telling CISOs directly that this assumption is no longer acceptable, and real incidents this year already show the scenario playing out. | BlackBerry AtHoc is built specifically for the scenario CISA is describing, coordinating personnel and response when the primary network or infrastructure an organization depends on is the thing that's down. |
Recommended Actions
Action | What It Means in Practice |
IMMEDIATE | Review whether your organization's most recent continuity exercise actually tested a prolonged power, telecom, water, or cloud disruption, or assumed it away as out of scope. |
IMMEDIATE | Reassess whether your threat model still treats “nation-state” and “criminal” as separate response tiers, given that AI-enabled tooling now lets either category of actor mount similar-looking attacks. |
SHORT-TERM | Move device and patch compliance verification toward continuous monitoring rather than periodic scanning, since the exploitation window driving this shift is now measured in minutes rather than days. |
SHORT-TERM | Identify which of your organization's assets, research, suppliers, customer relationships, contracts, infrastructure access, could make it strategically relevant to a foreign adversary, even if that relevance isn't obvious from the outside. |
ONGOING | Track CISA and equivalent international guidance for language shifting from prevention-focused to resilience-focused, since that shift in emphasis often precedes formal policy or procurement changes. |
BlackBerry Secure Communications Position
CISOs already understood nation-state risk. What's changed is how much time they have to act on it: an adversary that used to take days to move from a disclosed flaw to a working exploit now closes that gap in minutes, and an organization that assumed it wasn't strategically interesting enough to be a target has no reliable way to verify that assumption anymore. Successfully navigating this shift will depend less on patch speed and more on whether an organization has a way to continue coordinating when the infrastructure it normally relies on becomes unavailable.
Citations:
1. CISOs can no longer ignore the nation-state threat (CSO Online, Cynthia Brumfield, September 22, 2026).
2. CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs (Cybersecurity and Infrastructure Security Agency (CISA), July 30, 2026).
3. Small UK power generator shut down after cyberattack linked to Iran: Telegraph (CNBC, August 23, 2026).
4. State-backed hackers targeted EU officials on WhatsApp, document shows (POLITICO Europe, Sam Clark, August 25, 2026).
:quality(90):no_upscale())