AI Won't Make Script Kiddies Into Nation-State Hackers. Not Yet, Anyway.

The gap between a bored teenager with a hacking toolkit and the kind of attacker who can knock out a power grid is still very much real. But that gap is narrowing, and the OT security community is paying attention.

Speaking at a media panel ahead of Frenos' State of AI in Security report, a cluster of operational technology security professionals made roughly the same point from slightly different angles: AI isn't yet turning low-skill attackers into critical infrastructure threats, but the trajectory is uncomfortable.

Steve Swick, former CISO at American Electric Power, pointed to something the utilities sector has quietly relied on for decades. 'One thing that we've relied on for years is security by obscurity when it comes to utilities,' he said. The unspoken assumption has always been that successfully attacking a substation or water treatment plant requires deeply specialised knowledge that most attackers simply don't have. AI is chipping away at that assumption.

Paul Shaver, head of OT at Kevin Mandia's new AI-driven security startup Armadin, put it bluntly. Most industrial automation controllers have publicly available manuals. An attacker can pull one down, feed it to a model, and within minutes have a reasonable map of exploitable design flaws in a specific system. 'I can download the manual for almost any automation controller, parse through that very quickly, and come up with ways that I can exploit a dedicated feature of something that was not secure by design,' Shaver said.

Shaver spent six years leading the global OT practice at Mandiant before Google acquired it in 2022. He's seen the threat landscape from both sides, and he's not trying to generate panic. But he is watching the tools get better. At Armadin, he says he's building attack simulation tools in days that would previously have taken months. If that's true for an experienced security professional working with AI assistance, the same efficiency gains are theoretically available to anyone.

'I wouldn't go so far as to script kiddies yet,' he said, 'but as the models improve, that becomes more of a possibility in this space.'

Harry Thomas, CTO and co-founder of Frenos, added another angle: it's not just about skill level, it's about speed. Even if AI only elevates slightly-above-average attackers, that still means more threat actors operating faster, with less preparation time needed. 'There's an acceleration in timeline, more attacks could be happening, and from a defensive position, you might not know who your threat actor is anymore,' Thomas said.

What the tests actually showed

Frenos didn't just speculate. The company ran nearly 17,000 tests across ten AI models between October 2025 and September 2026, covering decision-making, attack planning, and simulated scenario execution. They tested six frontier models, two US open-weight models, and two foreign open-weight models, though they declined to name any of them.

Each test gave a model background context about a target environment, including network details, known vulnerabilities, and required access levels, then asked it to choose an attack action or build out a full attack plan.

The results were mixed in revealing ways. The top three frontier models succeeded in around 90 percent of planning tasks, meaning they could produce a structurally coherent attack plan most of the time. But consistency was another matter: when those same plans were evaluated repeatedly, pass rates dropped to between 60 and 74 percent. The models could get it right, but they couldn't get it right reliably.

Hallucinations were a real problem. Plans would skip steps, or assume the attacker already had access they hadn't established. 'A plan can look sensible and still leave out something essential,' the report noted.

The open-weight models performed worse overall, though one non-US model hit a 36.2 percent success rate, which was actually higher than three of the US frontier models tested. Make of that what you will.

Critically, none of these tests involved a human in the loop to catch errors and redirect the model. In an actual attack, a competent attacker who spotted a gap in the AI's reasoning could simply point it out and ask for a revised plan. The test harness was also relatively simple. A more sophisticated setup would likely have pushed the numbers higher.

'We still think human judgment remains essential,' Thomas said. Which is reassuring, right up until the models get good enough that it isn't.

What defenders should actually do

Frenos' recommendations for OT defenders are not surprising, but they're worth saying out loud because a lot of organisations still haven't done them. Network segmentation. Tight controls on remote access and user permissions. Actually testing your disaster recovery and business continuity plans rather than just having them sit in a folder somewhere.

'We have our business continuity plans and disaster recovery plans for a reason,' Thomas said. 'Let's execute them.'

That last point is quietly damning. The tools attackers are using are getting faster and more accessible. The basics of defence have been the same for years. The gap between knowing what to do and actually having done it is where most incidents begin.