In February 2026, threat actors exploited weak credentials on management interfaces to breach over 600 Fortinet firewalls across Europe and North America. The attack was not remarkable for its sophistication—credential stuffing is a decades-old technique. What was remarkable was its scale and speed. Automated reconnaissance tools, powered by generative AI, had identified and catalogued the vulnerable systems in hours. The exploitation followed within days. By the time most affected organisations had detected the breach, the attackers had already established persistent access.
This is the new normal of critical infrastructure cybersecurity in 2026. The threat landscape has not merely evolved—it has been restructured by artificial intelligence. Adversaries now have access to tools that automate reconnaissance, generate convincing social engineering content at scale, identify and exploit vulnerabilities faster than human defenders can patch them, and adapt their tactics in real time based on defensive responses. The asymmetry between attack and defence, always present in cybersecurity, has been dramatically amplified.
The regulatory response—embodied primarily in the EU's NIS2 Directive and the Digital Operational Resilience Act (DORA)—represents a serious attempt to impose systemic resilience requirements on critical infrastructure operators and financial entities. But regulation, however well-designed, is a lagging indicator. The question for 2026 is not whether organisations are compliant with NIS2 and DORA. It is whether compliance is sufficient for resilience in an environment where the threat is evolving faster than the regulatory framework.
The 2026 Threat Landscape: Three Structural Shifts
Understanding the current threat environment requires recognising three structural shifts that have occurred over the past two years. Each represents a qualitative change in the nature of the threat, not merely a quantitative increase in its volume.
The Weaponisation of Generative AI
Generative AI has fundamentally changed the economics of cyberattack. Tasks that previously required skilled human operators—crafting convincing phishing emails, generating realistic voice clones for executive impersonation, writing functional malware—can now be automated at minimal cost. The World Economic Forum's Global Cybersecurity Outlook 2026 documents the widespread use of AI by threat actors for large-scale social engineering, voice cloning, and executive impersonation. These are not sophisticated nation-state capabilities. They are available to criminal organisations and even individual actors with modest resources.
The implications for critical infrastructure are significant. Social engineering has always been the most effective attack vector—humans are more reliably exploitable than software. AI-powered social engineering is more convincing, more scalable, and more adaptive than its human-operated predecessor. A single threat actor can now conduct thousands of simultaneous, personalised phishing campaigns, each tailored to the specific role, responsibilities, and communication patterns of the target. The Fortinet breach was enabled by credential theft that almost certainly involved AI-assisted social engineering at some point in the attack chain.
The Shadow AI Problem
While external AI-powered threats receive most of the attention, a more insidious risk has emerged from within organisations themselves. Shadow AI—the use of unvetted or personal AI tools by employees within enterprise environments—has become one of the most significant and underestimated attack surfaces of 2026.
Shadow AI—employees using unvetted personal AI tools within enterprise environments—has emerged as one of the most underestimated attack surfaces of 2026. Unlike external threats, it bypasses perimeter defences entirely because it originates inside the trust boundary.
The problem is structural. Employees use AI tools because they are genuinely useful—they accelerate work, improve quality, and reduce cognitive load. But when those tools are not vetted by IT and security teams, they introduce risks that are difficult to detect and manage. Sensitive data—customer information, intellectual property, strategic plans, authentication credentials—may be uploaded to external AI services without the organisation's knowledge. The AI service's data handling practices may not meet the organisation's security or regulatory requirements. And the outputs of these tools may introduce vulnerabilities—AI-generated code, for example, has been documented to contain security flaws at higher rates than human-written code.
Infosecurity Magazine's September 2026 analysis of geopolitical and supply chain risks identifies shadow AI as a critical internal risk, noting that many organisations still lack defined incident-response playbooks for these specific vulnerabilities. This is a significant gap. An organisation that has invested heavily in perimeter defence, endpoint detection, and network monitoring may have no visibility into the AI tools its employees are using or the data those tools are processing.
The Geopolitical Integration of Cyber Risk
The third structural shift is the integration of geopolitical risk into the cyber threat landscape. Cyber operations are no longer a separate domain of conflict—they are an integral component of geopolitical competition, used alongside economic pressure, information operations, and conventional military activity. The WEF's Global Cybersecurity Outlook 2026 notes that geopolitical volatility—from regional conflicts in East Asia and the Middle East to trade tensions—is no longer an external factor in cyber risk assessment but an embedded component of it.
Shadow AI—employees using unvetted personal AI tools within enterprise environments—has emerged as one of the most underestimated attack surfaces of 2026. Unlike external threats, it bypasses perimeter defences entirely because it originates inside the trust boundary.
For critical infrastructure operators, this means that the threat model must incorporate geopolitical intelligence. An energy company operating in a jurisdiction that is in active geopolitical tension with a major cyber power faces a qualitatively different threat environment than one operating in a stable, aligned jurisdiction. Maritime and logistics infrastructure—which relies heavily on legacy operational technology systems—is particularly vulnerable, as supply chain chokepoints become prime targets for state-sponsored disruption.
The Regulatory Framework: NIS2 and DORA
The EU's regulatory response to these threats is embodied in two instruments that together cover the majority of critical infrastructure and financial entities operating in Europe.
NIS2: Systemic Resilience for Essential Entities
The NIS2 Directive (Directive (EU) 2022/2555) significantly expands the scope and requirements of its predecessor, covering "essential" and "important" entities across 18 sectors including energy, health, transport, water, digital infrastructure, and public administration. Its core requirements are demanding: robust risk management frameworks, supply chain security assessments, incident reporting within 24 hours (early warning) and 72 hours (detailed notification), and management accountability for cybersecurity governance.
The 24-hour reporting window is particularly significant. It is not merely a bureaucratic requirement—it is a forcing function for real-time situational awareness. An organisation that cannot detect and characterise a significant incident within 24 hours does not have adequate monitoring capabilities. The reporting requirement thus serves as a proxy for the broader capability requirement: continuous monitoring, automated detection, and rapid response.
Non-compliance carries substantial penalties: up to €10 million or 2% of global annual turnover. But the more significant consequence of non-compliance is operational: an organisation that cannot meet NIS2's requirements is, by definition, not resilient against the current threat landscape.
DORA: Operational Resilience for Financial Entities
The Digital Operational Resilience Act (DORA, Regulation (EU) 2022/2554), in effect since January 2025, applies to financial entities—banks, insurance companies, investment firms, payment processors, and their critical ICT service providers. Its requirements are more prescriptive than NIS2, reflecting the systemic importance of financial infrastructure and the interconnected nature of financial sector risk.
DORA's most distinctive requirement is mandatory digital operational resilience testing, including threat-led penetration testing (TLPT) for significant financial entities. TLPT is not a standard penetration test—it is a red team exercise conducted by qualified external testers using real threat intelligence, designed to simulate the tactics, techniques, and procedures of actual threat actors. It is expensive, demanding, and genuinely useful. It forces organisations to test their defences against realistic adversarial scenarios rather than theoretical attack patterns.
DORA also imposes rigorous third-party risk management requirements, reflecting the reality that financial sector resilience depends heavily on the security of ICT service providers. The Ericsson incident of 2025-2026—in which a supply chain compromise affected multiple financial entities—demonstrated the systemic risk that third-party dependencies create. DORA's requirements for contractual cybersecurity clauses, continuous oversight, and exit strategies for critical providers are a direct response to this risk.
NIS2 and DORA represent a fundamental shift in regulatory philosophy: from compliance as a periodic audit to resilience as a continuous operational state. The 24-hour incident reporting window is not a bureaucratic requirement—it is a forcing function for real-time situational awareness.
The Gap Between Compliance and Resilience
NIS2 and DORA are well-designed regulatory instruments. But compliance with them is not the same as resilience against the 2026 threat landscape. Several gaps deserve attention.
The Speed Problem
The Ivanti EPM vulnerability (CVE-2026-1603) was exploited in the wild within days of its public disclosure. CISA mandated a two-week patching window. For many organisations, two weeks is not enough time to test, approve, and deploy a patch across complex, interconnected systems without disrupting operations. The speed of exploitation has outpaced the speed of remediation, and this gap is widening as AI-powered tools enable faster vulnerability discovery and exploitation.
NIS2 and DORA represent a fundamental shift in regulatory philosophy: from compliance as a periodic audit to resilience as a continuous operational state. The 24-hour incident reporting window is not a bureaucratic requirement—it is a forcing function for real-time situational awareness.
NIS2 and DORA require robust vulnerability management, but they do not—and cannot—mandate the operational agility needed to patch critical systems in days rather than weeks. That agility requires architectural choices—modular systems, automated patch deployment, robust testing environments—that go beyond regulatory compliance.
The AI Governance Gap
Neither NIS2 nor DORA specifically addresses the shadow AI problem. Both require risk management frameworks that should, in principle, cover the risks of unvetted AI tools. But the specific governance requirements for AI use within organisations—inventory of AI tools, data handling assessments, security testing of AI-generated outputs—are not explicitly mandated. Organisations that are technically compliant with NIS2 and DORA may still have significant shadow AI exposure.
Tata Communications' 2026 analysis of AI-predictive cybersecurity identifies responsible AI management—focusing on explainability, privacy, and clear model governance—as the cornerstone for maintaining trust and ensuring business continuity. This is correct, but it requires organisations to develop AI governance capabilities that are distinct from, and complementary to, their existing cybersecurity frameworks.
The Quantum Horizon
EU regulatory instruments, including NIS2 and DORA, are technology-neutral: they require "state of the art" cryptographic standards without specifying which standards. This is appropriate for a regulatory framework that must remain relevant across technological generations. But it places the burden on organisations to assess when current cryptographic standards are no longer "state of the art"—and to act accordingly.
The post-quantum cryptographic (PQC) migration is the most significant such assessment facing critical infrastructure operators today. The "harvest-now-decrypt-later" (HNDL) threat—in which adversaries collect encrypted data today, intending to decrypt it when quantum computers capable of breaking current standards become available—is not a future problem. It is a present one. Adversaries are already collecting data. The question is not whether quantum computers will eventually be able to decrypt it, but when.
The harvest-now-decrypt-later threat is not a future problem. It is a present one. Adversaries are already collecting encrypted data today, waiting for quantum computers capable of breaking current cryptographic standards. The window for post-quantum migration is closing.
The EU's quantum security policy, updated in June 2026, explicitly incorporates PQC requirements into its "state of the art" standard for long-lived sensitive data. Organisations that have not begun their PQC migration are already behind the regulatory curve—and significantly behind the threat curve.
The Architecture of Autonomous Resilience
The convergence of AI-powered threats, regulatory requirements, and geopolitical risk demands a fundamental rethinking of critical infrastructure defence. The perimeter model—in which organisations defend a defined boundary against external threats—is no longer adequate. The threats are too fast, too adaptive, and too likely to originate from within the trust boundary (through shadow AI, supply chain compromise, or insider threat) to be contained by perimeter defences.
The emerging model is autonomous resilience: a continuous, intelligence-driven approach to security that combines automated detection and response with human oversight and geopolitical awareness.
Autonomous Security Operations
Security Operations Centres (SOCs) are transitioning from human-operated monitoring centres to AI-powered platforms that correlate signals across cloud, network, and endpoint environments. Tata Communications' analysis estimates that AI-powered SOCs can reduce mean time to respond (MTTR) by up to 60%, and projects that by 2028, AI will process 80% of first-level security warnings. These are significant efficiency gains, but they are not the primary argument for autonomous security operations.
The primary argument is speed. Human analysts cannot process the volume of security signals generated by modern enterprise environments at the speed required to detect and respond to AI-powered attacks. Automated detection and response—systems that can identify anomalous behaviour, correlate it with threat intelligence, and initiate containment actions without human intervention—is not a luxury. It is a necessity.
The harvest-now-decrypt-later threat is not a future problem. It is a present one. Adversaries are already collecting encrypted data today, waiting for quantum computers capable of breaking current cryptographic standards. The window for post-quantum migration is closing.
But automation without oversight is dangerous. The same AI systems that enable faster detection and response can also generate false positives that disrupt legitimate operations, or miss novel attack patterns that fall outside their training data. Human oversight remains essential—not as a bottleneck in the response process, but as a quality control mechanism that can identify and correct systematic errors in automated systems.
Integrated Exposure Management
Leading organisations are moving beyond siloed security functions—network security, endpoint security, application security, identity security—towards integrated exposure management: a unified view of the organisation's attack surface that incorporates technical vulnerabilities, third-party dependencies, geopolitical risk, and insider threat.
This integration is technically demanding. It requires data from multiple sources—vulnerability scanners, threat intelligence feeds, supply chain assessments, geopolitical risk databases—to be correlated and contextualised in real time. It also requires organisational integration: security teams working alongside business continuity, supply chain, and geopolitical risk functions rather than operating in isolation.
The WEF's Global Cybersecurity Outlook 2026 identifies integrated exposure management as a defining characteristic of leading organisations in the current threat environment. The organisations that are most resilient are not those with the most sophisticated individual security tools, but those that have the most coherent view of their overall risk exposure and the most integrated response capability.
Management Accountability as a Resilience Driver
Both NIS2 and DORA shift the burden of cybersecurity oversight to management bodies, requiring senior leaders to be actively involved in risk management and incident preparedness. This is not merely a compliance requirement—it is a resilience driver. Organisations in which cybersecurity is treated as a technical function, isolated from strategic decision-making, consistently underperform in their resilience posture.
Management accountability creates the conditions for the resource allocation, organisational integration, and strategic prioritisation that resilience requires. When senior leaders are personally accountable for cybersecurity outcomes—as NIS2 and DORA now require—they have the incentive to invest in resilience rather than merely in compliance.
Sovereignty and the Limits of Regulatory Harmonisation
The EU's regulatory framework for cybersecurity is among the most sophisticated in the world. But it operates within a global threat environment that does not respect regulatory boundaries. Critical infrastructure operators in EU member states face threats from actors operating in jurisdictions where EU law has no reach, using techniques that evolve faster than regulatory frameworks can adapt.
This creates a tension between the harmonisation benefits of EU-level regulation and the sovereignty requirements of national security. Member states retain primary responsibility for national security, including cybersecurity of the most sensitive infrastructure. The EU framework provides a floor—minimum requirements that all operators must meet—but national security requirements may demand significantly more.
The data sovereignty dimension adds further complexity. EU regulations including the Data Act, combined with national data localisation requirements, create obligations that can conflict with the operational requirements of effective cybersecurity. Threat intelligence sharing, for example, is most effective when it crosses borders rapidly and without friction. Data sovereignty requirements can impede this sharing, creating gaps in the collective defence that adversaries can exploit.
Conclusion: Resilience as a Strategic Imperative
The 2026 cybersecurity landscape has made one thing clear: compliance is necessary but not sufficient. NIS2 and DORA provide a robust regulatory foundation for critical infrastructure resilience. But the organisations that will be genuinely resilient against the current and emerging threat landscape are those that treat resilience as a strategic imperative rather than a compliance exercise.
This means investing in autonomous detection and response capabilities that can match the speed of AI-powered attacks. It means developing AI governance frameworks that address the shadow AI problem before it becomes a breach. It means beginning the post-quantum cryptographic migration now, before the HNDL threat matures into a decryption capability. And it means integrating geopolitical intelligence into cyber risk assessment, recognising that the threat landscape is shaped by forces that extend far beyond the technical domain.
The autonomous adversary is here. The question is whether critical infrastructure operators are building the autonomous resilience to match it.
