Cyber threats to critical infrastructure can put essential services at risk, with consequences that extend far beyond stolen information. When the affected systems support electricity, water, transport or healthcare, cyber security becomes a matter of public safety and operational continuity.

A warning from Jason D. Clinton, Anthropic’s deputy chief information security officer, has brought renewed attention to this challenge. In public comments reported on 23 October 2026, Clinton urged security leaders to seek board support for fundamental security improvements as the threat environment deteriorates. He also highlighted the urgency of protecting critical infrastructure through stronger network isolation. 

His warning raises an immediate question: can organisations strengthen their defences quickly enough as artificial intelligence helps attackers work faster?

What Did Anthropic’s Security Official Warn About?

According to reporting reproducing Clinton’s posts on X, he expects conditions to worsen before improving and suggested that defenders face a difficult period of approximately 18 months. His immediate recommendation was to secure investment in basic security measures. He also warned that organisations might struggle to patch critical infrastructure quickly enough as vulnerability discovery accelerates.

That timeline requires careful interpretation. It is a prediction, not a guaranteed deadline for either widespread disruption or improved security. Organisations should not assume that cyber risks will disappear after 18 months.

The broader concern is supported by the UK’s National Cyber Security Centre (NCSC). Its assessment of AI-related threats through 2027 concludes that AI will almost certainly make aspects of cyber intrusion more efficient and effective. It also identifies a realistic possibility that critical systems will become more vulnerable to advanced attackers if defensive measures fail to keep pace.

Why Critical Infrastructure Requires Different Protection

Operational technology, or OT, consists of systems that monitor or control physical processes. Examples include industrial controllers, transport systems and building automation. Unlike a conventional office application, an OT system may directly influence equipment, environmental conditions or the movement of materials.

The US National Institute of Standards and Technology (NIST) emphasises that OT security must account for distinctive safety, reliability and performance requirements. A security measure that works well on an office network may need significant adaptation before it can be introduced safely into an industrial environment.

For example, an unplanned restart or an incompatible update could interrupt an essential process. Security teams and operational engineers therefore need to assess changes together, ensuring that Cyber Security solutions support safe operation during maintenance or an incident.

The following examples illustrate the relationship between digital systems and physical services; they are not claims about specific attacks.

Infrastructure setting	Illustrative digital dependency	Potential consequence of disruption
Electricity networks	Monitoring and control equipment	Reduced operational visibility or interrupted supply
Water facilities	Pump and treatment controls	Disrupted processing or distribution
Transport networks	Control and communications systems	Delays, restricted operations or service suspension
Industrial facilities	Production controllers and safety interfaces	Stopped production or unsafe operating conditions

These possibilities explain why infrastructure protection must consider the consequences of failure alongside the likelihood of an intrusion. NIST’s OT guidance places this relationship between cyber security and physical operation at the centre of risk management.

What the UK’s Incident Data Shows

The NCSC’s 2025 Annual Review, covering September 2024 to August 2025, provides a useful measure of the seriousness of the UK threat environment.

NCSC measure	2023–2024	2024–2025
Incidents requiring NCSC support	430	429
Nationally significant incidents	89	204
Highly significant incidents, included within the nationally significant total	12	18

Although the total number of incidents handled remained almost unchanged, nationally significant incidents more than doubled. The distinction matters: an apparently stable overall workload can conceal a substantial increase in severity.

These figures are not a count of all UK cyberattacks, nor are they limited to critical infrastructure. They also do not establish that AI caused the increase. The NCSC explicitly cautions that its figures do not capture every incident affecting the country because reporting is incomplete.

How AI Could Intensify Cyber Threats to Critical Infrastructure

AI can accelerate familiar attack techniques. The NCSC identifies reconnaissance, vulnerability research, exploit development, social engineering and basic malware generation as activities that attackers are almost certainly already enhancing with AI.

Its assessment anticipates that much of the near-term change will come from improving existing methods. This means an organisation can face greater pressure even when the underlying weaknesses exposed services, insecure configurations or inadequate access controls are familiar. 

The practical concern is the time available to respond. If attackers can investigate vulnerabilities more efficiently, defenders need reliable processes for identifying affected systems, deciding which risks matter most and implementing appropriate protections.

However, finding a vulnerability is not the same as successfully disrupting an industrial process. Access restrictions, network architecture and operational safeguards remain relevant. The consequences of a compromise depend on the environment and the controls surrounding it.

Why Connectivity and Supplier Access Matter

A plant does not need to expose every controller directly to the internet to face external risk. Connections through maintenance providers, gateways or other networks can create routes into operational systems.

The NCSC gives the example of a contractor whose remote access to one device also permits access to other equipment on a flat OT network. Without effective boundaries, one compromised connection can expose a much wider environment. Its guidance recommends segmented networks to limit movement between systems and contain the effects of a breach.

Understanding those connections is essential. The NCSC’s architecture guidance calls for organisations to identify and categorise assets, document connectivity and understand third-party risks. This creates the evidence needed to decide which connections are necessary and which introduce avoidable exposure.

What Infrastructure Operators Should Prioritise

1. Establish an Accurate View of Critical Systems

Protection begins with knowing what supports each essential service.

An operational inventory should help teams understand equipment ownership, dependencies, connectivity and supplier involvement. It should also support decisions about which assets require the strongest protection.

The value lies in maintaining this information as systems change. An outdated network diagram can create false confidence, particularly when remote access or new integrations have been added. This approach follows the NCSC’s emphasis on maintaining a definitive understanding of OT architecture. 

2. Limit the Reach of a Compromise

Network segmentation divides an environment into controlled areas, reducing unnecessary communication between systems.

In practice, operators should examine whether a compromised office account, supplier connection or maintenance device could reach equipment unrelated to its purpose. Access should be restricted to the systems and functions required.

The NCSC also highlights gateways and network switches as valuable targets because they connect multiple assets. These components need maintained configurations, appropriate updates and replacement before vendor support ends. 

3. Make Remediation Safe and Risk-Based

Patching remains important, but operational environments require controlled implementation. Teams should assess compatibility, test changes where practical and agree maintenance arrangements with engineers.

Where immediate updating is unsafe or impractical, organisations should assess temporary protections and document the remaining risk. Decisions should consider both the vulnerability and the potential operational consequences of the proposed fix.

NIST’s OT guidance provides a framework for adapting security controls to these safety and reliability constraints.

4. Prepare and Test Isolation Plans

Disconnecting an affected environment may help contain an incident, but isolation itself can disrupt essential dependencies.

The NCSC recommends planning how OT environments can be isolated, linking those arrangements to business continuity and testing them regularly. Plans should also account for suppliers: remote maintenance may need to be replaced by an on-site response.

For operators with multiple facilities, planning should cover both individual sites and wider incidents affecting shared infrastructure.

5. Practise Recovery Before an Emergency

An incident response plan should establish who can make operational decisions, how technical and engineering teams will coordinate, and how services will be restored.

Useful exercises should test recovery arrangements and communications under realistic disruption. They should expose missing dependencies and unclear responsibilities before those weaknesses affect a live response. NIST includes incident response and recovery capabilities within its recommended OT security programme.

Can AI Strengthen Infrastructure Defences?

AI also offers opportunities to improve analysis and decision-making. Its use in operational environments nevertheless introduces additional risks that need explicit assessment.

Joint guidance released by the NSA, CISA and international partners in December 2025 recommends introducing AI only where its benefits outweigh its risks. It stresses testing, monitoring, clear governance, human involvement in critical decisions and mechanisms that limit the consequences of failure.

An AI system that recommends action should therefore have a clearly defined role. Before connecting it to critical processes, operators need to understand what information it receives, what authority it has and what happens when its output is wrong.

Faster analysis is useful only when the resulting decisions remain safe and dependable.

What Boards Should Ask Now

Clinton’s warning gives leaders a reason to examine whether existing security commitments are producing demonstrable protection.

A practical board discussion should ask:

• Which essential services depend on unsupported or poorly understood systems?
• Can supplier access be restricted and revoked promptly?
• Which weaknesses could interrupt safe operation?
• Have isolation and recovery arrangements been tested with operational teams?
• Who owns unresolved risks, and when will they be addressed?

These questions translate technical concerns into decisions about service continuity, investment and accountability.

The immediate task is concrete: identify essential dependencies, reduce unnecessary access, maintain critical equipment and rehearse disruption. Those actions remain valuable regardless of how quickly AI capabilities develop.

References

1. OfficeChai. (23 October 2026). Things Will Get Worse Before They Get Better: Anthropic Deputy Chief Information Security Officer on Recent Cyber Incidents. Secondary reporting reproducing Clinton’s public comments.
2. National Cyber Security Centre. (7 May 2025). Impact of AI on cyber threat from now to 2027.
3. National Cyber Security Centre. (14 October 2025). Annual Review 2025: Incident management.
4. Stouffer, K., et al. (September 2023). Guide to Operational Technology (OT) Security. NIST SP 800-82 Revision 3.
5. National Cyber Security Centre. Creating and maintaining a definitive view of your OT architecture.
6. National Cyber Security Centre. (14 January 2026). Secure connectivity principles for operational technology: Principle 6 Limit the impact of compromise.

Sources accessed on 23 October 2026.