ARM Hub urges AI checks to bolster factory cyber security

ARM Hub has urged Australian manufacturers to treat AI-readiness assessments as part of their cyber security checks. The Brisbane-based manufacturing technology centre linked the advice to recent disruption caused by critical PHP vulnerabilities.

The flaws exposed a basic problem for many industrial businesses: systems cannot be secured if they are not fully visible, understood and managed. ARM Hub argued that reviews designed to prepare companies for AI adoption can also uncover outdated software, weak controls and poorly documented links across production, supplier and data systems.

Recent security incidents have sharpened that message. Critical vulnerabilities in PHP, a programming language widely used in websites and online stores including WordPress, Drupal and Magento, prompted urgent patching and precautionary shutdowns as organisations moved to protect their systems.

According to ARM Hub, the incident showed how quickly weaknesses in older software can become operational problems when attackers use AI tools to find and exploit them faster. For manufacturers, the risk often extends beyond public-facing websites to customer portals, remote-access tools, industrial software, cloud applications and connected machinery.

Legacy exposure

Figures from Censys cited by ARM Hub showed around 1.5 million of 2.6 million PHP hosts were running versions for which no fix was then available. In manufacturing, the issue is compounded by long equipment lifecycles and operational technology designed in a different security era.

The Australian Signals Directorate has said operational technology environments can include legacy devices, outdated protocols and slow replacement cycles, making systems harder to document, patch, monitor and isolate. Smaller manufacturers may face an added burden if they lack clear records of what equipment is connected, how suppliers access systems and where critical data is stored.

Australian Signals Directorate Director-General Abigail Bradshaw has warned that AI will either force decisions to replace legacy technology or, if businesses move too slowly, make that technology "almost certainly ... the first to be compromised in a major AI-enabled attack".

The warning comes as the sector faces heavy pressure from cyber criminals. Security firm ZeroFox found manufacturing was the industry most targeted by ransomware and digital extortion in the second quarter of 2026, and had held that position consistently since at least 2021.

Readiness review

A practical AI-readiness review should examine what systems, machines, software and data sources a business operates, including unsupported technology, ARM Hub said. It should also identify which services are internet-facing, who can access them and whether they are still needed.

The same process should test whether security patches, identity controls, monitoring, backups and network segmentation are current and effective. Businesses should also establish where production, customer, design and commercial data is stored, shared or exposed, and whether AI, automation and robotics can be deployed safely with human oversight and governance.

"AI readiness is more than adding automation or a chatbot," said Charlotte Birkinshaw, AI engineer at ARM Hub.

"It's an opportunity to map systems and identify legacy or unsupported technology, understand where sensitive data sits, and put in place the controls needed to operate safely. Right now, AI readiness is a security exercise as much as it is a productivity exercise."

Guidance from the Australian Signals Directorate recommends organisations reduce their attack surface, remove unnecessary internet-facing services, replace tools that no longer receive vendor patches and apply updates quickly. The agency has also said AI can be used carefully, and under human supervision, to analyse security logs and test for vulnerabilities.

Modernisation push

The argument also connects to a broader investment challenge across Australian industry. The average age of Australian manufacturing capital rose from 11 to 13 years over the decade to 2024, while policymakers have identified robotics, automation and advanced manufacturing investment as part of the response to ageing assets, labour shortages and weak productivity growth.

ARM Hub works with manufacturers on technology audits, roadmaps, prototyping, automation and AI deployment. It said modernisation can bring unmanaged systems into view and reduce exposure created by unsupported or poorly governed technology, while also helping companies improve quality, consistency and operational decision-making.

Birkinshaw said manufacturers do not need deep cyber expertise to begin that work, but they do need a disciplined understanding of their technology estate.

"Manufacturers do not need to become cyber security specialists overnight," she said.

"But you do need to know what you're running, what's connected, what is out of date, and what would happen if a key system went down. AI readiness gives a disciplined way to answer those questions."

She added that delaying upgrades increases risk as attackers gain access to better tools.

"Delaying modernisation does not reduce risk.

"It leaves businesses running older systems with less visibility and fewer options, while attackers' tools get faster and more capable. The businesses that treat AI readiness as a security and productivity check will be better placed to adopt new technology, protect their operations and compete."