The patching gap: Hacked fridges, AI ransomware and Mythos finds

BLUF: This episode of IBM’s Security Intelligence podcast analyzes three critical cybersecurity trends: the physical dangers of outdated OTT infrastructure, the rise of AI-generated ransomware, and the strategic use of AI for vulnerability discovery, emphasizing that continuous patching and robust governance are essential for defense.

Key Takeaways:

• The Risks of Outdated OTT Infrastructure: A recent hack on French supermarkets’ refrigeration systems caused temperatures to spike to 50°C, leading to spoiled goods and fires. This incident highlights that outdated firmware in internet-connected IoT devices poses severe physical and operational risks, as manufacturers like Danfoss have long advised updates that many customers ignored 0:30.

• Continuous Protection vs. Downtime: While taking critical infrastructure offline for updates is expensive, the cost of unplanned downtime and product loss is far higher. Security leaders argue that businesses must weigh the controlled risk of scheduled maintenance against the unpredictable danger of cyber-physical failures, including potential loss of life in industrial settings 2:15.

• AI-Driven Ransomware and Identity Risks: A 2026 report reveals that 84% of ransomware attacks now involve AI, with attackers increasingly exploiting corporate AI agents and identity management systems. This necessitates a shift in defense strategies to include autonomous security controls and rigorous governance to prevent AI agents from becoming insider threats 10:19.

• Bank of America’s AI Vulnerability Strategy: Bank of America hired 1,000 contractors to help patch vulnerabilities discovered by the Anthropic "Mythos" AI tool. This strategy underscores the reality that while AI can accelerate vulnerability discovery, human oversight remains crucial for context and remediation, creating a hybrid model for security operations 19:35.

• The Future of Cybersecurity Workforce: The massive hiring of contractors to address AI-discovered bugs suggests a new norm where cybersecurity professionals act as "wandering samurai," moving between organizations to manage continuous patching. However, experts emphasize that scaling teams requires strict identity and access management to prevent new risks from entering the environment 27:02.

Closing Statement:
The podcast concludes that while AI is transforming both attack and defense landscapes, it does not replace the need for fundamental security hygiene. Organizations must prioritize continuous monitoring, robust identity governance, and the integration of human expertise with AI capabilities to stay resilient against evolving threats.

Sources:

• 0:30 Introduction to the French supermarket hack and the dangers of outdated OTT infrastructure.
• 2:15 Discussion on the balance between scheduled downtime for updates and the risks of unplanned failures.
• 10:19 Analysis of the 2026 Ransomware Risk Report showing AI's role in 84% of attacks.