With the increasing use of artificial intelligence in cybersecurity, security officials are warning about an important vulnerability: legacy infrastructures and technology systems may become the first targets of attacks that, aided by AI, identify vulnerabilities faster than before.
Abigail Bradshaw, Director-General of the Australian Signals Directorate, warned about the challenges posed by the proliferation of AI systems active online during her appearance at the "Sydney Dialogue" summit. According to her, determining the exact number of these systems, referred to as "AI agents," on the internet is difficult and their number may already be significant.
The main concern is that AI can increase the speed of finding security weaknesses; while many organizations still need a lot of time to update or replace their legacy infrastructure.
Why are legacy systems more at risk?
Legacy systems are not necessarily insecure simply because they are old; the more important issue is that maintaining, updating and protecting them becomes more difficult. Some of these systems have been in use in organizations for years and may be relied upon to run important and critical services.
In such situations, installing a security update or even fully replacing a system may not be simple. Organizations sometimes cannot take their critical systems offline for long, because stopping them can disrupt services that people or businesses continuously depend on.
Bradshaw warned that this dependency can turn legacy systems into one of the likely entry points in wider cyber attacks-especially if attackers can use AI tools to find vulnerabilities in these infrastructures more quickly.
AI increases the speed of cyber attacks
One of the most important changes AI can bring to cybersecurity is increasing the speed of information processing and analysis.
AI-based tools can examine large volumes of data and help attackers or defenders in the process of identifying security weaknesses. As a result, the time gap between discovering a vulnerability and attempting to exploit it can become more significant.
This means organizations cannot simply rely on usual cycles of releasing and installing security updates. If a serious vulnerability is discovered, an organization may have to react quickly; while legacy infrastructure does not always allow rapid changes.
In fact, the new challenge is not necessarily that AI can on its own break into a system, but the speed it can create at various stages of an attack. If the speed of discovering a security weakness exceeds an organization's speed of response, the window to counter the threat will shrink.
The perennial dilemma of updating critical infrastructure
Dependency on legacy systems confronts organizations with a difficult choice. On one hand, updating or replacing systems to reduce security risks is necessary, and on the other hand, applying changes to critical infrastructure may disrupt services.
This issue is especially important for systems that must operate around the clock. Temporarily shutting down such systems to install updates can have practical consequences, but continuing to run a vulnerable system also increases the risk of exploitation.
With the increasing speed of AI tools, this conflict can become more serious. An organization that needs substantial time to identify, test and deploy an update may face an environment where an attacker can perform some stages of reconnaissance and analysis much faster.
Full replacement is an expensive solution
Updating legacy infrastructure is not a simple or inexpensive solution either. Over the years many organizations have built a set of systems, software and digital infrastructure alongside each other, and the operation of various services depends on them.
Fully replacing such infrastructures may require significant investment from governments and the private sector. In addition to the cost of acquiring new technology, migrating data, integrating different systems, training staff and maintaining service continuity are among the challenges that must be considered in this process.
For this reason, Bradshaw has emphasized gradual replacement of legacy systems; an approach aimed at reducing dependency on vulnerable infrastructure before a wide-scale attack occurs, rather than forcing organizations to make rapid and costly changes after a security crisis.
This concern is not limited to old computers. The digital infrastructure used to deliver critical services, enterprise systems and other technologies that have accumulated over years within an organization can be part of the same problem.
AI; a tool for defense and attack
The spread of AI in cybersecurity has a dual aspect. The same technology that can help defenders identify threats faster, analyze data and discover vulnerabilities can provide similar capabilities to attackers.
Thus, the competition between attackers and defenders can become more dependent on reaction speed than before. Organizations must not only know what vulnerabilities exist in their infrastructure, but also be able to identify, prioritize and remediate them within an appropriate timeframe.
According to the British newspaper The Guardian, the concern raised here is not that AI can automatically break into every computer system; the main issue is that the speed of discovering and exploiting vulnerabilities may in some cases outpace organizations' ability to update and protect their infrastructures.
From this perspective, legacy systems are one of the sensitive points in this equation. The more an organization depends on technologies that are difficult to update, the more challenging it can be to bridge the gap between the speed of the threat and the speed of defense.
Ultimately, the Australian official's warning focuses on a broader issue in cybersecurity: countering future threats is not limited to using new tools, and modernizing existing infrastructure also matters. With increasing AI capabilities and the likelihood of its use in cyber attacks, gradually reducing dependency on legacy systems can become an important part of organizations' preparedness to face new threats.