In a rapidly evolving global landscape marked by geopolitical uncertainties, the surge in cyber attacks, and the increasing interconnectedness of digital systems, a vigorous revamp of cybersecurity measures is more necessary than ever. Debilitating cyber attacks on OPTUS and Medibank, two significant Australian companies, have underscored the urgency to act. The response has been a shift in policy-making, moving away from a historically casual approach to cybersecurity regulations to one focused on bolstering resilient systems capable of withstanding an attack without endangering public safety or disrupting essential services.

As we step into the future, experts predict a surge in digital transformation, with increasing connectivity and network convergence. The number of connected IoT devices, currently estimated between 15 billion and 17 billion, is expected to double over the next two years. It is predicted that by 2024, these devices will generate over 80 billion IoT connections, the majority of which will be linked to critical infrastructure sectors.

The changing digital landscape means there is an anticipated shift from a network-centric approach to a more asset-centric approach to cybersecurity. Even as organisations continue to maintain physically detached brownfield sites for extended periods, they will increasingly adopt an asset-centric approach to digital infrastructure to maximise their competitive edge. This approach to digital infrastructure will yield significant cost benefits to enterprises, as has been the case with the evolution from physical to virtual capabilities in many IT systems.

However, the traditional vulnerability management is flailing under the weight of rapidly evolving and increasingly complex cyber-physical systems. This is evident from the fact that, despite the high proportion of cyber-physical system vulnerabilities disclosed last year, fewer than 8% have since been exploited. Around 78% of professionals from the healthcare sector agreed that patching vulnerabilities in clinical cyber-physical systems is the most crucial gap in their organisations' cyber defence measures.

Vulnerability management is ultimately expected to evolve to leverage new paradigms. It is predicted that critical infrastructure organisations will speed up their adoption of predictive security methodologies and zero-trust approaches to make significant improvements in strengthening their cyber defences. The current practice of vulnerability scoring will be supplanted by a scoring model that predicts vulnerabilities likely to be exploited by attackers. This will enable cyber defenders to make smarter decisions in risk management, prioritisation, and remediation.

Another evolving threat comes from the weaponisation of AI by malevolent actors. A report by the NSA and its intelligence partners highlighted the recent discovery of indicators of compromise linked to a China-based state-sponsored actor on networks across U.S. critical infrastructure. The increasing use of AI by malicious actors necessitates an equally sophisticated response. Gartner estimates that by 2027, generative AI will contribute to a 30% reduction in false-positive rates for application security testing and threat detection by refining results from other techniques to differentiate between benign and malicious events.

To counter the rapidly escalating threats, generative AI is expected to enhance the cyber and operational resilience of cyber-physical systems. In the ever-growing web of interconnected devices forming the XIoT, generative AI is set to automate critical security and operational workflows and provide advanced visibility into the entire XIoT attack surface. This transformative approach to cybersecurity will enable organisations to preempt malicious actors effectively, bolstering the resilience of business and, by extension, public safety.