Topic starter
06/11/2026 6:55 pm
TL;DR: AI is amplifying long-standing weaknesses in legacy infrastructure, unknown assets and OT exposure rather than creating wholly new threats, according to Forescout's analysis of Richard Horne's NCSC speech. For practitioners, the issue is whether visibility is being converted into containment, resilience and access control.
Editorial analysis by NHI Mgmt Group, based on content published by Forescout: “Don’t Miss the Train: NCSC’s Sliding Doors Moment for OT”.
Key questions
Q: Why do AI tools make legacy infrastructure more dangerous?
A: AI tools make legacy infrastructure more dangerous because they increase the speed, scale, and reach of actions taken against systems that already lack strong segmentation, patching, or monitoring.
Q: What is the best way to reduce risk from unmanaged connected devices?
A: The best way to reduce risk is to discover those devices continuously, assign ownership, and remove default or unnecessary network access.
Q: How should teams secure OT systems that share networks with IT?
A: Use network segmentation, strict allowlisting, and an accurate asset inventory to separate OT from enterprise IT and limit lateral movement.
Practitioner guidance
- Harden exposed OT and legacy systems first Focus remediation on internet-reachable or internally discoverable systems that still lack modern controls, because those are the most likely to be found and abused quickly.
- Separate visibility from containment Use device discovery to drive segmentation, access restriction and exception removal, rather than treating inventory completeness as the end state.
- Remove convenience-based access paths Review persistent access into operational environments and revoke any permission that exists only because it was easier to keep than to redesign.
Bottom line: AI is best understood here as an accelerator of neglected infrastructure risk, not as a source of entirely new vulnerability classes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:56 pm
AI governance debt: The real problem is not that AI creates entirely new flaws, but that it turns accumulated neglect into an operationally exploitable condition. Years of deferred upgrades, unknown assets and convenience-led access decisions now sit on top of one another, creating a governance debt that attackers can cash in quickly. Practitioners should treat AI as an accelerator of existing control failure, not as a reason to reframe the threat model from scratch.
A question worth separating out:
Q: What happens when convenience access is left in place too long?
A: Convenience access left in place too long becomes standing trust, which means broad, persistent access that is no longer tied to a current need. That increases exposure to privilege creep, forgotten service accounts, and reused credentials, especially when temporary exceptions, shared admin paths, or vendor access are never revoked.
👉 Read our full editorial: AI amplifies weak foundations in OT and legacy infrastructure