AI vs. AI at the Perimeter: Defending Critical Infrastructure in 2026

Two years ago, we wrote that ports and other infrastructure had become cyber infrastructure. In 2026, that is no longer a forecast. Since the outbreak of war involving Iran on 28 February, state-linked and hacktivist groups have moved from espionage and nuisance attacks to deliberate attempts to disrupt physical operations in the United States and allied countries. At the same time, artificial intelligence is speeding up both attack and defence. For operators of energy, water, transport and industrial systems, the threat model has changed in a matter of weeks.

What has happened since February

• An immediate surge. Within days of the first strikes, more than 60 hacktivist groups had claimed cyber actions linked to the conflict, and security researchers reported attempts to exploit industrial control systems and connected cameras across the Middle East.
• Attacks on operational technology. On 7 April, U.S. cyber, intelligence and energy agencies jointly warned that Iranian government-linked actors had escalated to exploiting internet-facing programmable logic controllers and SCADA systems in water, energy and local government facilities, with the aim of causing disruption. Victims reported manipulated displays and tampered device configurations.
• Corporate IT as an entry point. In March, a major medical technology company suffered a disruptive attack after attackers took over its device-management environment — a reminder that cloud administration tools can be turned into weapons.
• Insurance is tightening. Ratings agencies and insurers have flagged elevated cyber risk for public entities and infrastructure providers, and war-exclusion clauses are drawing new scrutiny.

AI on both sides

AI has lowered the cost of attack. Attackers use it to scan for exposed devices at scale, write convincing phishing in any language, adapt malware faster and work through stolen data. A small team can now operate with the reach of a much larger one.

Defenders have the same tools. AI-driven monitoring can learn what normal looks like on an industrial network and flag anomalies in seconds, sort thousands of alerts, and automate first-response containment. The organizations that will manage this period best are those that combine automated detection with human operators who understand the physical process they are protecting.

Canada's new rules

On 26 March, the House of Commons passed Bill C-8, which would create the Critical Cyber Systems Protection Act. Once in force, it will require designated operators in federally regulated finance, telecommunications, energy and transportation to maintain cybersecurity programs, manage supply chain and third-party risk, and report prescribed incidents. The bill is now before the Senate. Operators should treat its requirements as the new baseline now, not after implementation dates are set.

The next horizon: post-quantum

Governments, including Canada's, have published roadmaps for migrating critical systems to post-quantum cryptography over the next decade. Data stolen today could be decrypted later. Infrastructure with long-lived equipment, which is most industrial infrastructure, should start inventorying its cryptography now.

What this means for clients

• Get industrial devices off the open internet. Exposed PLCs and HMIs are the attack path in the current advisories. Remove direct exposure, change default credentials and enforce multi-factor authentication for remote access.
• Separate IT, cloud admin and OT. A compromised email account or device-management console should never reach a control system.
• Practise manual operations. Have tested procedures to run critical processes safely if control systems must be isolated.
• Use AI for detection, with people in the loop. Deploy anomaly detection on OT networks, but make sure operators can interpret and act on alerts.
• Prepare for C-8 now. Map critical cyber systems, assign accountable executives and set up incident reporting processes.
• Review insurance wording. Understand how war exclusions and state-actor clauses apply to your coverage.

Aquamerge advises critical infrastructure operators and investors on cybersecurity strategy and risk. Through our R&D program, we are developing AI-driven security technology for port and infrastructure environments.

Sources: FBI, NSA, CISA and DOE joint advisory on Iranian-affiliated exploitation of PLCs (7 Apr 2026), via TechCrunch and Cybersecurity Dive; Cybersecurity Dive, "US entities face heightened cyber risk related to Iran war" (10 Mar 2026); Baker Botts, "The Law of War – Critical Infrastructure Cyber Threats" (Mar 2026); Parliament of Canada, Bill C-8 legislative record.