# The patching gap: Hacked fridges, AI ransomware and Mythos finds

## Executive summary

This summary analyzes three critical cybersecurity trends: the vulnerability of outdated Operational Technology (OT) infrastructure, the escalating threat of AI-powered ransomware, and the necessity of continuous vulnerability management. Key discussions highlight that patching cannot be a one-time event, requiring continuous governance, especially when integrating AI agents or dealing with third-party contractors. The panel emphasizes that organizations must treat AI agents as potential insider threats and adopt autonomous security strategies to maintain resilience.

## Key takeaways

- OT Infrastructure Vulnerabilities: Hackers successfully targeted refrigeration systems (Danfoss, Copeland, Dixell) in French supermarkets by exploiting outdated firmware on internet-connected OT devices, causing overheating and potential fire. This highlights the risk of legacy, critical infrastructure.
- AI's Role in Ransomware: A Semperis survey found that 84% of ransomware attacks are now generated with the help of AI. Furthermore, 44% of attacks exploit a company's own AI agents and identity management systems, requiring AI governance to be part of the insider threat model.
- Continuous Vulnerability Management: The Bank of America initiative, which hired 1,000 contractors to patch vulnerabilities found by Anthropic’s Mythos, reinforced that patching is not a point-in-time activity. Security must be managed continuously, requiring robust Identity and Access Management (IAM) for all third-party personnel.

## Technical details

- Operational Technology (OT) Security: The vulnerability of refrigeration controllers (Danfoss, Copeland, Dixell) running outdated firmware, even after manufacturers issue fixes. The challenge lies in reconciling the cost of planned downtime for patching versus the risk of catastrophic failure.
- AI Agent Risk and Governance: AI agents, when integrated into business processes, must be treated as potential insider threats. Implementing 'guardrails' and continuous monitoring is necessary to ensure they adhere to policies and regulations.
- AI Vulnerability Discovery: The use of advanced AI models like Anthropic’s Mythos to identify hundreds of vulnerabilities, necessitating large-scale, temporary contractor teams (e.g., Bank of America hiring 1,000 contractors) to patch them.

## Practical implications

- Implement continuous monitoring and governance for all connected OT/IoT devices, treating firmware updates as an ongoing process, not a project milestone.
- Update the insider threat model to include AI agents and third-party contractors, ensuring strict IAM controls (onboarding, offboarding, and monitoring) are in place.
- Adopt autonomous security strategies that automate detection and response, as human speed is insufficient against AI-generated threats.
- Conduct risk assessments that weigh the cost of planned downtime for patching against the potential cost of an uncontrolled system failure.

## Topics

Operational Technology (OT), Cybersecurity, AI Governance, Ransomware, Vulnerability Management, Identity and Access Management (IAM), Semperis's 2026 Ransomware Risk Report, Anthropic Mythos, Danfoss, Copeland, Dixell

Source: https://www.youtube.com/watch?v=qV36V-WOsDo