Tributech: AI is rewriting the threat model for Europe's CNI

Much of Europe's critical national infrastructure (CNI) was designed before today's AI-enabled, remotely operated threat landscape emerged.

Operators of CNI face a threat landscape their existing monitoring tools weren't designed for, argues Thomas Plank, CEO of London-headquartered cybersecurity firm Tributech.

In CERT-EU's Threat Landscape Report for 2025, the organisation reported at least 174 threat actors engaged in malicious activity against the European Union ecosystem, with firewalls, VPNs, and network management solutions as primary targets.

Many CNI operators map their risks to the four levels of the IEC 62443 industrial cybersecurity standard, with level four representing a state-sponsored attacker, he said.

"If we assume a level four is a state-sponsored attacker, high budgets, a lot of resources, high expertise, this can now be done by a smaller group of people or even individuals with AI tools, and the state-sponsored attackers also now have AI tools.