Artificial intelligence (AI) is making faster and easier discovery of vulnerabilities in code that is common in critical infrastructure, according to findings from Forescout’s research arm Vedere Labs.
The Forescout report, Finding critical infrastructure bugs with off-the-shelf AI looked at how security researchers and attackers can use generally available AI models and a limited budget to find vulnerabilities in both open source software and proprietary “binaries”, which are executable computer files.
The Vedere researchers built an AI vulnerability “research harness” – software infrastructure around a large language model (LLM) – and applied it to 10 TCP/IP stacks, including seven they had analysed in 2020-21, in a project dubbed Memoria.
Daniel dos Santos, vice-president of research at Forescout, based in Eindhoven in the Netherlands, said: “AI did not eliminate the need for expert vulnerability researchers, but it dramatically compressed the work.
“With access to an effective AI-assisted workflow, vulnerabilities in complex embedded software can be found much faster and at a fraction of the cost by security researchers and attackers alike.
“Our research demonstrates that AI is changing the economics of vulnerability discovery and accelerating the pace at which security teams need to identify, prioritise and mitigate cyber risk. This is especially impactful for critical infrastructure, where legacy and difficult-to-patch devices may remain in service for years.”
The threats converging on operational technology and IT was a theme of the research as presented to a small group of journalists in London.
The supplier’s cyber threat landscape findings for the UK, presented by Dos Santos at the same event, stated that 108 threat actors have targeted the UK in 2026. Most were cyber criminals (55%), then state-sponsored actors (33%), then hacktivists (12%).
There were 227 hacktivist attack claims against the UK between 1 January and 30 September, according to Vedere’s research team. This represents a 337% increase over the 52 claims observed in all of 2025 – 60% were claimed by two active pro-Russian groups, NoName057 (16) and the Z Pentest Alliance.
Some 29% of the attackers tracked by Forescout are from Russia, 20% in China, 6% in Iran, 5% in North Korea, and the remaining 40% come from other countries.
Forescout’s research team said: “We continue to observe hacktivist groups targeting British government institutions, public services and organisations perceived as strategically important due to the UK’s geopolitical role and support for international allies.”
With respect to the AI-assisted approach used for their most recent research project, the researchers said their results have shown that AI reduced analysis time from approximately nine months to 90 hours. It uncovered 99 vulnerabilities, including 66 previously unknown.
Some 52% of the new bugs were rated as high or critical severity. The cost of the automated analysis was $935, averaging just $2.58 per finding.
TCP/IP stacks are embedded in products used used in OT, internet of things (IoT), medical devices, network equipment, and other systems that are both physical and cyber.
The same underlying software can be used across products from many and varied manufacturers, so a single vulnerability can create risk across a broad technology supply chain, the researchers said.
Barry Mainz, CEO at Forescout, said: “The speed of vulnerability discovery is increasing with AI, but the reality for asset owners and operators has not changed. Organisations still have legacy systems, operational requirements and devices that can’t easily be patched or simply taken offline. Containing risk, rather than patching, must be the priority.”
