What would break first if hackers hit US infrastructure?

A single cyberattack could knock out power, water, and emergency services across the US. Experts warn that aging tech, staff cuts, and weak defenses make it easier than ever.

Imagine waking up in the morning without electricity, water, or cell phone service. It might sound dystopian, but it’s only one cyberattack away.

Critical infrastructure, such as power grids, water systems, hospitals, traffic control, and internet backbones, all rely on operating systems that could be compromised.

That’s according to former deputy national security adviser and NSA cybersecurity director Anne Neuberger, who spoke at the AI Expo for National Competitiveness on June 4th.

“There’s old tech … tech that wasn’t built to be connected to the internet,” Neuberger said, noting that these kinds of systems often have less cybersecurity than modern IT systems.

These systems – some not even designed for internet access – include programmable logic controllers which are used to control machinery in power plants and water treatment facilities. Many were built without encryption or authentication.

Furthermore, staff shortages and layoffs at the Cybersecurity and Infrastructure Security Agency (CISA) make the situation worse, as the digital fortress weakens.

With fewer experts on watch, threats slip through cracks in federal defense.

What crumbling could look like

As experienced in Spain and other parts of Western Europe recently, when the grid collapses and causes a power blackout, everything comes to a standstill.

Being without cell phone coverage is the tip of the iceberg, especially when hospitals and homes are plunged into chaos – life-support systems fail, refrigerated medication spoils, and heating or air conditioning units go out.

Water treatment systems may be hacked and supply systems compromised or shut down. Contaminated water can spread disease in a matter of hours.

Communication systems may also go down – 911 calls can be disrupted along with emergency broadcasts.

AI as the emergency fix?

Neuberger’s pitch is to use artificial intelligence to spot weaknesses before attackers do. Smart algorithms can scan complex systems faster than human analysts, flagging vulnerabilities in critical infrastructure.

“Let’s approach national cyberdefense differently – with a more targeted approach, using AI to close the holes in the most critical infrastructure,” Neuberger urged.

Digital twinning could help – think of it as a flight simulator for a power plant or any civilian infrastructure. It’s a proactive approach, testing for vulnerabilities before real-world damage happens.

Speculation has mounted since Trump’s budget cuts to CISA about how vulnerable the US cyberdefense really is.

A proposed 17% cut would eliminate a third of the agency’s workforce, and Neuberger has warned that these cuts could “lose talented cyber defenders” at the worst possible time.