Three Steps to the Terminal: A Siemens ROX II Zero-Day Trilogy

Critical infrastructure is changing. Security must change with it. As industrial systems become more connected, converge with IT, and adopt AI and automation, cyber risk increasingly extends beyond data to affect physical operations. Understanding how these changes are reshaping the threat landscape is essential to strengthening operational resilience and preparing for what’s next.

• Expanding attack surface: Greater connectivity across industrial environments creates new pathways for cyber risk.
• Real-world impact: Cyber incidents can affect safety, production, and business continuity, not just data. 
• What’s changing: AI, automation, and IT/OT convergence are reshaping how organizations approach industrial security.

The latest frontier AI models are changing cyber risk faster than traditional defenses can adapt. In this threat briefing, Sam Rubin, SVP of Unit 42, and Palo Alto Networks CISO Marc Benoit will break down how these new models can find and exploit exposures that have gone undetected for years and the implications for security leaders.

This session examines how the threat landscape has hit an inflection point, with work that once took deep expertise, time, and manual effort happening in seconds at machine scale. Our experts will discuss what CISOs need to prioritize now to reduce exposure before attackers put these capabilities to broader use.

• Exploit time compression: How frontier AI models are shrinking the time from vulnerability discovery to exploitation from months to minutes.
• The biggest risks today: The most immediate risks created by sophisticated, automated attacks at scale.
• Immediate actions to take: Practical guidance from Palo Alto Networks’ own CISO on what leaders should do now.

The 2026 Unit 42 Global Incident Response Report confirms it: The adversary isn’t just smarter; they are faster.

Your new threat reality? AI enables threat actors to move from initial access to exfiltration in minutes, effortlessly bypassing traditional defenses.

In the report, you will learn how:

• Speed now defines risk: Attacks are 4X faster, with data exfiltration in <1 hour in some cases.
• Identity accelerates impact: 65% of initial access is driven by identity-based techniques allowing unauthorized access, privilege escalation and lateral movement.
• Sprawl expands exposure: 87% of attacks unfolded across multiple attack surfaces, making it harder to correlate attack signals.