Researchers using off-the-shelf AI found 99 vulnerabilities, including 66 new flaws, in networking software found across OT, IoT, and critical infrastructure environments

Forescout Technologies, Inc., a cybersecurity company focused on asset intelligence, exposure management, and network security, today announced new research from Forescout Research – Vedere Labs demonstrating how artificial intelligence is changing the economics of vulnerability discovery, dramatically reducing the time and cost required for security researchers – and attackers alike – to find vulnerabilities in foundational software commonly found in critical infrastructure environments.

The report, “Finding Critical Infrastructure Bugs with Off-the-Shelf AI,” examines whether security researchers and attackers can use generally available AI models and a limited budget to find vulnerabilities in both open-source software and proprietary binaries. Researchers built a specialized AI-assisted vulnerability research harness and applied it to 10 popular TCP/IP stacks – the foundational software that enables connected devices to communicate over a network – including seven previously analyzed by Vedere Labs and three new stacks.

The results demonstrate how AI can significantly lower the time and cost barriers to vulnerability discovery, for both attackers and defenders. The AI-assisted approach reduced analysis time from approximately nine months to 90 hours and uncovered 99 vulnerabilities, including 66 that were previously unknown. More than half (52%) of the new vulnerabilities were rated high or critical severity, and 54 were reported to vendors and maintainers. The total cost of the automated static analysis was just $935, averaging just $2.58 per finding.

“AI did not eliminate the need for expert vulnerability researchers, but it dramatically compressed the work,” said Daniel dos Santos, VP of Research at Forescout. “With access to an effective AI-assisted workflow, vulnerabilities in complex embedded software can be found much faster and at a fraction of the cost, by security researchers and attackers alike. Our research demonstrates that AI is changing the economics of vulnerability discovery and accelerating the pace at which security teams need to identify, prioritize, and mitigate cyber risk. This is especially impactful for critical infrastructure, where legacy and difficult-to-patch devices may remain in service for years.”

Key Findings

• AI cut vulnerability analysis from nine months to 90 hours. The study combined approximately 10 hours of independent AI analysis with roughly 80 hours of validation.
• Researchers validated 99 vulnerabilities across 10 TCP/IP stacks, including 66 previously unknown vulnerabilities.
• 52% of the 66 new vulnerabilities were rated high or critical severity.
• The AI-assisted system rediscovered 40% of previously known vulnerabilities, demonstrating its ability to identify flaws even in software that had already undergone extensive manual research.
• Researchers reported 54 of the new vulnerabilities to vendors and maintainers. Responsible disclosure remains ongoing for some findings.
• Static analysis across the 10 stacks cost approximately $935, averaging $2.58 per finding.
• Binary analysis was approximately six times more expensive and took twice as long as source-code analysis, but the findings demonstrate that AI-assisted vulnerability research can extend to proprietary firmware where source code is unavailable.
• Based on previous Vedere Labs research, vulnerabilities in these foundational TCP/IP components are likely to affect hundreds of downstream products from dozens of vendors.

Implications for Critical Infrastructure

TCP/IP stacks are embedded in products used across OT, IoT, medical devices, network equipment and other cyber-physical systems. Because the same underlying software can be used across products from multiple manufacturers, a single vulnerability can create risk across the broader technology supply chain.

This supply chain risk is particularly difficult to address when vulnerable software is embedded in devices that may remain in service for decades, even after vendor support ends. Even when a fix is available, it must make its way from the software developer through firmware and product vendors before it reaches the organization operating the affected device. For discontinued or unsupported products, a patch may never come.

“The speed of vulnerability discovery is increasing with AI, but the reality for asset owners and operators hasn’t changed,” said Barry Mainz, CEO, Forescout. “Organizations still have legacy systems, operational requirements, and devices that can’t easily be patched or simply taken offline. Containing risk, rather than patching, must be the priority. Forescout helps organizations know what is connected, understand which vulnerabilities create real operational risk in their environment, and have controls in place to contain that risk.”

Mitigating the Risk

As AI accelerates vulnerability discovery for both researchers and attackers, Forescout recommends that organizations:

• Assess and prioritize risk based on reachability, exploitability, and operational impact. Consider a device’s role, network exposure, compensating controls, and potential operational consequences rather than treating all vulnerabilities equally.
• Reduce unnecessary exposure of connected devices. Disable or restrict unnecessary services such as FTP, Telnet, IPv6 and web administration interfaces where possible.
• Isolate devices that cannot be patched. Place end-of-life and unsupported devices in tightly controlled network segments and only allow required communications.
• Accelerate patching timelines when fixes exist. Reassess processes for embedded-device patching to account for a faster rate of vulnerability disclosure.
• Build security into procurement. Require suppliers to define support lifetimes, publish vulnerability disclosure policies, provide software bills of materials (SBOMs), and demonstrate ongoing security testing.

Forescout also recommends that software vendors and maintainers incorporate AI-assisted security analysis into development and release processes and prepare for growing volumes of AI-generated vulnerability reports.

As AI makes vulnerability discovery increasingly scalable, organizations need complete visibility and context to determine where vulnerable software exists in their environments, understand its operational importance, and prioritize appropriate risk-reduction measures.

Read the full report, “Finding Critical Infrastructure Bugs with Off-the-Shelf AI,” and visit Forescout’s Frontier AI Readiness Resource Center for additional support navigating cybersecurity in the era of Frontier AI.

Frequently Asked Questions

Q: What did Forescout researchers study?
A: Forescout Research – Vedere Labs sought to answer whether security researchers – and attackers alike – could use generally available AI models with a limited budget to find vulnerabilities both in open-source targets and binaries that are relevant to critical infrastructure. The team developed an AI-assisted vulnerability research harness and tested it against 10 popular TCP/IP stacks, including seven stacks previously analyzed through earlier research and three new stacks.

Q: What are TCP/IP stacks?
A: TCP/IP stacks are foundational software components that enable connected devices to communicate over networks. They are embedded in many OT, IoT, medical, network, and other connected devices.

Q: How many vulnerabilities did the research uncover?
A: Researchers validated 99 vulnerabilities in total. Thirty-three were previously known vulnerabilities rediscovered by the AI-assisted system, while 66 were new findings. 54 of the new findings were reported to vendors and maintainers. 52% were rated high or critical severity.

Q: How much faster was the AI-assisted research?
A: The study reduced analysis time from approximately nine months of manual code analysis to 90 hours, consisting of roughly 10 hours of independent AI analysis and 80 hours of dynamic validation.

Q: Why do these findings matter for critical infrastructure?
A: TCP/IP stacks are foundational networking components embedded in a wide range of OT, IoT, medical, network and other connected products. Vulnerabilities in these components can therefore propagate through the software supply chain and potentially affect many downstream products. Legacy and unsupported products may also be difficult or impossible to patch.

Q: How can Forescout help organizations reduce their exposure?
A: Forescout provides continuous visibility and control across IT, OT, IoT and IoMT environments, helping organizations identify exposed assets, understand their risk and prioritize remediation. For devices that cannot be immediately patched or taken offline, Forescout can apply compensating controls, such as segmentation and isolation, to help contain risk and prevent lateral movement.

About Forescout

As AI-driven vulnerability discovery and exploitation accelerate attack velocity to machine speed, Forescout is a foundational cyber defense layer that allows organizations to segment and isolate compromised systems, block lateral movement, and automate response across IT, OT, IoT, and IoMT environments. The Forescout Vistaro™ platform, powered by agentic AI and enhanced with Vedere Labs threat intelligence, delivers a Universal Zero Trust Network Access (UZTNA) architecture that integrates seamlessly with 180+ security and IT products. With Forescout Vistaro, organizations get comprehensive inventory and classification of both managed and unmanaged assets, continuous exposure management, and real-time protection including dynamic network segmentation and automated threat response.

View source version on businesswire.com: https://www.businesswire.com/news/home/20261112616886/en/