2023 cyber threats point to hybrid tactics, AI abuse and OT risk

At a glance

What this is: Nozomi Networks Labs highlights five 2023 threat trends, including hybrid tactics, quantum preparation, medical device exploitation, cyber insurance pressure and malicious AI-driven chatbots.

Why it matters: It matters because practitioners have to defend environments where attack methods, target sectors and enabling technologies are converging faster than conventional threat labels and control assumptions can keep up.

Context

The security gap here is not a single new exploit class. It is the way threat actors are combining familiar techniques across infrastructure, identity-adjacent systems and social engineering to create attack paths that are harder to classify and slower to block.

In OT and IoT environments, that convergence matters because exposed devices, unsupported software and monitoring systems create a wider operational blast radius than conventional enterprise IT. The post also reaches into healthcare identity security because medical devices and the systems that aggregate their data depend on access governance, segmentation and trustworthy telemetry.

Key questions

Q: How should security teams respond when attacker tactics blend criminal and nation-state tradecraft?

A: Treat attribution as useful context, not the first control decision. Build detection and response playbooks around observed behaviour, target asset value and potential impact, because hybrid campaigns can use criminal methods for disruption and state-style methods for persistence. This approach reduces delay when labels are uncertain and the operational effect is clear.

Q: What makes unsupported medical devices so difficult to secure?

A: Unsupported devices are hard to secure because their vulnerabilities persist after vendor support ends, while the surrounding clinical workflow still depends on their data and availability. That creates a governance gap between asset management, segmentation and patient safety. Security teams need to treat those devices as operationally critical, not as ordinary endpoints.

Q: Why do AI-generated phishing attacks change human identity controls?

A: They reduce the value of message inspection as a control because attackers can now generate persuasive, context-aware lures at scale. Human identity programmes should shift toward phishing-resistant authentication, stronger verification for sensitive actions, and recovery processes that do not depend on user intuition alone.

Q: What is the difference between cyber insurance and cyber resilience?

A: Cyber insurance transfers some financial loss from a cyber incident, while cyber resilience is the organisation’s ability to withstand, respond to, and recover from it. Insurance can help with costs after an event, but it does not prevent outages or data loss. Resilience depends on controls, backups, recovery testing, and incident readiness.

Technical breakdown

Why hybrid threat tactics complicate attribution and response

Hybrid tactics emerge when attackers borrow methods from multiple playbooks instead of matching a single actor type. A hacktivist crew can use ransomware-like disruption, while a nation-state group can adopt criminal extortion methods to obscure motive and amplify impact. That blurring weakens attribution models that depend on stable TTP patterns and forces defenders to focus on observable behaviour, target selection and impact pathways rather than labels. In critical infrastructure, the result is slower triage and more ambiguous incident handling because the same campaign can look criminal, ideological or strategic depending on the phase being observed.

Practical implication: Map detections to behaviour and impact first, then use attribution as supporting context rather than the primary response trigger.

How medical device exploits turn asset weakness into operational harm

Medical devices are especially exposed when legacy platforms remain in service after vendor support ends. Attackers can scan for vulnerable devices, exploit known weaknesses and then manipulate the systems that aggregate device data for monitoring or control. That changes the risk from simple compromise to operational distortion, where false readings, device malfunction or incorrect dosage automation can create patient safety issues. The security issue is not only vulnerability presence but also the trust chain between the device, the data aggregator and the clinical workflow that depends on both. See the Healthcare Identity Security Guide.

Practical implication: Segment medical devices, validate the trust boundary around aggregating systems and treat unsupported hardware as an operational safety risk, not only an IT issue.

Why malicious AI-generated content changes phishing economics

Malicious use of generative AI reduces the cost of producing convincing lures at scale. A chatbot can generate personalised phishing messages, mimic company tone and help attackers iterate faster on social engineering content. The same pattern can extend into code generation and exploit development, which shortens campaign preparation time and increases volume. The control problem is not that the model itself is malicious, but that it lowers the skill barrier for threat actors and increases the speed at which weak identity verification and poor user training are exploited.

Practical implication: Strengthen phishing-resistant authentication and suspicious-content handling because text realism alone is no longer a reliable trust signal.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.
• Sisense breach 2024: A credential in Sisense's GitLab reportedly opened S3 buckets of customer tokens, passwords and certificates; CISA urged a full reset.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Hybrid threat tactics create an attribution debt problem: the more attacker methods converge, the harder it becomes to rely on static labels for response prioritisation. Organisations that still separate criminal, hacktivist and state activity into different operational paths will miss the shared control failures underneath them. The practical shift is toward behaviour-led detection and impact-led escalation, especially in environments where OT disruption can be achieved through ordinary intrusion methods.

Medical device security is really access governance for clinical operations: unsupported devices are not only vulnerable, they are difficult to govern because their lifecycle outlasts the software and asset assumptions built into enterprise programs. The real failure mode is unmanaged trust between the device, the monitoring layer and downstream clinical action. That is why healthcare environments need healthcare identity security thinking applied to operational technology, not just perimeter defence.

AI-assisted phishing changes the economics of identity fraud: the main shift is not novelty in technique but volume, speed and personalisation. When attackers can generate tailored lures cheaply, human verification becomes a weaker control unless it is paired with stronger authentication, better sender validation and tighter account recovery governance. This is a preview of how AI lowers attacker cost before it raises defender maturity.

Quantum preparation is a data governance issue before it becomes a cryptography issue: the article’s “store now, decrypt later” warning means organisations should treat long-lived sensitive data as a future exposure problem today. The key question is not whether quantum decryption is immediate, but which records, telemetry and credentials remain valuable long enough to be harvested now and exploited later. Practitioners should shorten retention where possible and identify data classes whose confidentiality window exceeds their current cryptographic assumptions.

Cyber insurance is becoming part of the threat model, not outside it: once attackers price ransom demands against expected payouts, insurance becomes a signal inside the attack economy. That does not make coverage irrelevant, but it does mean organisations must stop assuming policy ownership reduces adversary pressure. The stronger posture is to reduce the conditions that make extortion economically attractive in the first place.

What this signals

Detection must move beyond actor labels: as hybrid tactics spread, security programmes will need to classify campaigns by behaviour, target environment and consequence rather than by a fixed threat category. That makes response faster in critical infrastructure, where the operational impact matters more than the attacker's self-description.

OT and healthcare convergence will keep widening the blast radius: medical device exposure shows how infrastructure, monitoring systems and clinical workflows can fail together. Practitioners should expect more cases where a technical vulnerability becomes a safety event because the trust chain was never designed for adversarial conditions.

For practitioners

• Strengthen detection for hybrid intrusion patterns Tune monitoring to catch campaigns that mix criminal extortion, ideological disruption and state tradecraft in the same incident path.
• Inventory unsupported medical devices Identify legacy devices and the monitoring systems they feed so you can assess where unsupported software creates safety and availability risk. See the Healthcare Identity Security Guide.
• Harden identity controls against AI-assisted phishing Prioritise phishing-resistant authentication, account recovery governance and user verification steps that do not rely on message tone or grammar.
• Review sensitive data retention against quantum risk Classify records that may remain valuable for years and decide which data sets need shorter retention, stronger encryption planning or earlier disposal.

Key takeaways

• The article frames 2023 threat activity as a convergence problem, not a single new malware or exploit trend.
• Unsupported medical devices and their monitoring paths create a safety issue because operational trust extends beyond the device itself.
• Practitioners need controls that match the blended attack economy, including better segmentation, stronger identity verification and faster behaviour-led detection.

Related NHI Mgmt Group resources: Breach and Attack Simulation (BAS) Guide · Authenticator Apps and OTP Guide · Global Cybersecurity Regulatory Map

Key terms

• Hybrid Threat Tactics: A threat pattern where attackers mix methods from different playbooks, such as criminal extortion, ideological disruption or state-style persistence. The practical challenge is that labels become less useful than behaviour, target selection and impact when one campaign can cross categories in a single incident.
• Store now, decrypt later: An attacker captures encrypted data today with the expectation that future cryptographic advances will make it readable later. This is especially relevant where identity traffic, secrets, or certificates protect information that must remain confidential for years.
• Medical Device Security: Medical device security is the practice of protecting connected clinical equipment from unauthorized access, tampering, data exposure, and service disruption. It covers device firmware, communications, identity controls, patching, segmentation, logging, and lifecycle management so that patient safety, clinical availability, and regulated data integrity are preserved across hospitals, suppliers, and remote support channels.
• AI-Driven Phishing Tests: AI-driven phishing tests are simulations that use machine learning and language generation to create believable phishing scenarios. They are designed to reflect current attacker methods, including personalization and multi-channel delivery, so security teams can measure resilience more accurately and provide targeted coaching based on observed behaviour.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and secrets management. It helps practitioners connect identity controls to the broader security programmes they already run.