AI Accelerates Vulnerability Discovery in Critical Infrastructure

Executive Summary

Research published by Forescout Technologies' Vedere Labs has demonstrated a paradigm shift in vulnerability discovery, driven by commercially available Artificial Intelligence. In a study titled "Finding Critical Infrastructure Bugs with Off-the-Shelf AI," researchers used an AI-powered analysis pipeline to audit 10 common TCP/IP stacks, which are fundamental components in millions of Operational Technology (OT), Internet of Things (IoT), and medical devices. The AI-assisted process completed in just 90 hours what would have taken an expert researcher nine months. It uncovered 99 vulnerabilities, 66 of which were zero-days at the time of discovery. This 20x acceleration in vulnerability hunting fundamentally changes the economics of cyber-offense and defense, putting immense pressure on asset owners to improve their security posture.

Threat Overview

The research does not detail a specific threat actor or attack, but rather a meta-threat: the democratization and acceleration of vulnerability discovery. By building a specialized research harness using commercial AI models from Anthropic, Forescout proved that finding high-impact bugs no longer requires months of painstaking manual reverse engineering. The barrier to entry for discovering exploitable flaws has been significantly lowered.

This means that well-resourced threat actors and even less-skilled malicious individuals can now find vulnerabilities in critical, deeply embedded software at an unprecedented rate. The TCP/IP stacks analyzed are present in devices across critical infrastructure sectors, meaning newly discovered flaws could be used to disrupt power grids, manufacturing plants, or healthcare services.

Technical Analysis

The Forescout research team developed an AI-assisted vulnerability research pipeline. This process involved:

1. Code Ingestion: Feeding the source code of 10 different TCP/IP stacks into the system. These included open-source stacks like Contiki, lwIP, and PicoTCP, as well as closed-source, proprietary stacks.
2. AI-Powered Static Analysis: Using large language models (LLMs) to analyze the code for potential vulnerabilities like buffer overflows, integer overflows, and improper input validation. The total cost for this automated analysis was under $1,000.
3. Expert Verification: Human vulnerability researchers then triaged and verified the findings generated by the AI to confirm their exploitability and impact.

The AI was not only able to find 66 new vulnerabilities but also rediscovered 40% of known, previously patched vulnerabilities in the same codebases, demonstrating its effectiveness. The flaws discovered were of high severity, with 52% of the new bugs rated as high or critical.

Impact Assessment

The primary impact is a drastically compressed timeline for vulnerability discovery and, consequently, exploitation. What once took months can now be done in hours, creating a much smaller window for defenders to patch systems. This research signals a new reality for security teams:

• Accelerated Risk: The risk to OT, IoT, and other embedded systems has increased significantly, as a constant stream of new vulnerabilities can be expected.
• Shift in Attacker Economics: Attackers can now find more bugs, faster and cheaper, making it more profitable to target a wider range of devices.
• Pressure on Vendors: Software and device manufacturers are now under immense pressure to integrate similar AI-powered testing into their own Secure Software Development Lifecycles (SSDLC) to find and fix bugs before products ship.
• Urgency for Asset Owners: Organizations using these devices must have robust asset inventory and patch management programs to respond to the accelerated pace of disclosures.

Detection & Response

Since this is about vulnerability discovery, detection focuses on identifying vulnerable assets.

• Comprehensive Asset Inventory: Organizations must have a complete and accurate inventory of all connected devices, including OT and IoT assets. This is the foundation for any effective vulnerability management program.
• Software Bill of Materials (SBOM): Obtain and maintain SBOMs for all devices to quickly identify which assets contain a vulnerable TCP/IP stack or other component when a new flaw is disclosed.
• Accelerated Patching: Security teams must be prepared to test and deploy patches on a much faster timeline than before. D3FEND's Software Update is the primary countermeasure.

Mitigation

Mitigation strategies must adapt to this new, accelerated threat landscape.

• Assume Vulnerability: Operate under the assumption that any embedded device on the network could have undiscovered vulnerabilities. Implement a Zero Trust architecture to limit the blast radius of a potential compromise.
• Network Segmentation: Use network segmentation to isolate critical OT and IoT devices from the corporate IT network and the internet. This aligns with D3FEND's Network Isolation and can prevent attackers from reaching vulnerable devices.
• Enhanced Vendor Scrutiny: Demand more from vendors regarding the security of their software supply chain. Ask for evidence of secure coding practices and AI-assisted testing.
• Proactive Threat Hunting: With more bugs being found, proactive threat hunting for signs of exploitation becomes even more critical.