In the Age of AI, We Are Still Losing to Old Cybersecurity Problems

In an era when artificial intelligence dominates cybersecurity conversations, three incidents in October delivered a rather uncomfortable reality check.

Some of Canada's most prestigious law firms had confidential client information compromised. Binance, the world's largest cryptocurrency exchange, lost approximately US$6.3 billion in digital assets. And across France, hundreds of supermarkets discovered that hackers had turned their refrigeration systems into heaters, destroying enormous quantities of food.

Three very different industries. Three very different attacks. Yet they raise a remarkably similar question: are we so focused on the cybersecurity threats of tomorrow that we are neglecting the vulnerabilities of today?

The human vulnerability

In Canada, attackers targeted major law firms by impersonating internal IT support staff, sometimes using Microsoft Teams and convincing employees that urgent account or security updates were required.

Victims were directed to fraudulent authentication pages capable of intercepting credentials and relaying multifactor authentication responses in real time.

This was not simply a matter of employees using weak passwords. The attackers exploited something far more fundamental: trust in familiar workplace processes and supposedly legitimate authority.

The Canadian Centre for Cyber Security issued a warning on October 28 about the ongoing campaign, which increasingly targeted legal and financial organizations.

The lesson is not that employees are careless. It is that security processes must be designed for a world where a convincing request from IT might not actually come from IT.

The forgotten infrastructure

France offered a different kind of warning.

On October 11 and 12, attackers remotely manipulated refrigeration controllers across hundreds of supermarkets. Freezers that should have been preserving food instead reached temperatures as high as 50°C, triggering enormous inventory losses and, in some cases, fires.

Investigators identified concerns involving outdated firmware, previously disclosed vulnerabilities and remotely accessible control systems.

There was no need to imagine an AI superintelligence taking control of the food supply. The more troubling reality was that ordinary operational equipment, connected to the internet for convenience and remote maintenance, had become a potential point of attack.

For many organizations, operational technology sits outside traditional IT security conversations. Equipment gets installed, performs its function and remains in service for years, sometimes long after its software becomes obsolete.

The business consequences, however, are anything but theoretical.

The billion-dollar question

Then there is Binance.

On October 29, attackers stole approximately US$6.3 billion in cryptocurrency. Binance initially pointed to a compromised DevOps engineer's laptop, potentially allowing unauthorized access to internal infrastructure. Its subsequent investigation identified additional intrusion points.

On October 31, the FBI attributed the theft to North Korean state-sponsored actors.

This was clearly a complex operation, and its precise technical causes remain under investigation. It would be premature to describe it as simply a failure to patch software or prevent phishing.

But the incident raises an important question for every organization: how much damage can an attacker cause once a trusted device, identity or internal system has been compromised?

Security cannot depend entirely on preventing initial access. It must also restrict privileges, isolate critical operations, monitor abnormal activity and limit the damage when something inevitably goes wrong.

The problem is not a lack of technology

Artificial intelligence is undeniably changing cybersecurity. Attackers can use it to make phishing more convincing, automate reconnaissance and accelerate the discovery of vulnerabilities. Defenders can use it to detect anomalies, investigate incidents and respond faster.

Those developments deserve serious attention.

But none of these three incidents requires us to assume that AI was the decisive weapon. And focusing too heavily on AI risks obscuring a less glamorous set of questions.

Are systems being patched? Do we know which connected devices have reached the end of their supported life? Can employees independently verify unexpected IT requests? Are authentication methods resistant to phishing? Can a compromised account or device reach critical business systems? Who is accountable for ensuring these safeguards actually work?

These are questions of governance, process, architecture and organizational discipline.

They rarely make for exciting conference demonstrations. Yet their answers may matter more than another sophisticated cybersecurity product.

Innovation requires stronger foundations

There is a broader lesson here for organizations racing to adopt AI.

Every new technology creates opportunities, but also expands the systems, identities, data and dependencies that organizations must manage. AI adoption is no exception.

Deploying increasingly intelligent technology on top of poorly governed infrastructure does not make that infrastructure secure. It can simply amplify the consequences of weaknesses that were already there.

The answer is not to slow innovation or abandon investment in advanced cybersecurity. It is to recognize that technological sophistication and operational maturity are two different things.

An organization can be at the forefront of AI adoption and still struggle with basic access controls, patch management or security awareness.

Cybersecurity maturity is not measured by how advanced your tools are. It is measured by how reliably your organization manages risk.

Before investing in the next generation of AI-powered defences, leaders should ask a simpler question: have we actually secured what we already have?

Because sometimes the path to a multibillion-dollar cyberattack does not begin with a revolutionary algorithm. It begins with a familiar weakness that nobody adequately addressed.