Defending the Nation’s Infrastructure

The threat to United States critical infrastructure has changed character. Adversaries are no longer only stealing data. They are quietly pre-positioning inside the systems that keep the lights on, the water running and benefits flowing, waiting for a moment of their choosing. Defending against that takes a different approach from guarding the edge of the network. Assume they are already inside, make it hard for them to move from one system to the next, and build services that keep running during an attack.

Drawing on Varmoda’s delivery work across federal civilian, defense and state government environments, this paper sets out the defensive practices that are effective against current campaigns, shows where machine intelligence really helps defenders and where it helps the attacker just as much, and sets out the step-by-step plan Varmoda’s teams use with operators today.

The hardest part of this problem is that nothing looks wrong. There is no ransom note and no outage. An attacker who intends to act in a future crisis has every reason to stay quiet now, which means the absence of visible damage tells an operator almost nothing about whether their network is clean.

That changes what good security looks like. The old measure was how high the wall was. The better measure now is how far an intruder can get once they are over it, how quickly anyone notices, and whether the service keeps running while the problem is dealt with. Those three questions run through everything below.

The adversary has a new mission

The big change is pre-positioning: getting inside early and waiting. Groups linked to China, including Volt Typhoon, Salt Typhoon and Silk Typhoon, have shown they can get into communications, energy, water and transportation networks and stay there for a long time. They get in through stolen passwords, unpatched devices at the network edge, and the access that trusted suppliers already have.

United States intelligence says Volt Typhoon is getting into position to disrupt or destroy critical infrastructure in a future crisis, rather than to spy. There has been no public confirmation that it has been fully removed from those networks. Salt Typhoon is different: it is a spying operation, and has been reported inside at least nine United States phone and internet carriers.

What they share is stealth. They blend in by using the tools already built into the systems they break into, which is called living off the land, and by logging in with real passwords. They have been seen testing their way into plant equipment using the default passwords the manufacturer shipped. Often there is no virus to find, only a login that looks legitimate doing things it should not.

Why critical infrastructure is uniquely exposed

Varmoda’s engineers point to three structural realities that make these systems harder to defend than a typical enterprise.

IT and OT convergence

Attacks usually start in the office network, then move across into the systems that control physical equipment: a substation, a pump, a rail switch. The line between the office network and the plant floor is where the real damage can be done.

Legacy and long-lived systems

Plant equipment runs for decades. It often cannot be patched on the same schedule as office systems, and it was never designed for an internet full of people trying to break in. Replacement cycles are measured in capital programs, not sprints.

Trusted third parties and exposed edge

Suppliers logging in remotely, and devices exposed to the internet, are where these attacks usually start. Because the attackers then sit quietly, a break-in can go unnoticed for months.

The defensive foundation

Federal guidance now points the same way, and it matches what Varmoda’s security team sees in the field. Keeping services running matters as much as keeping attackers out. The question is no longer whether someone gets in, but how little they can do once they are there.

Adopt zero trust, starting with assume breach

Federal guidance on protecting plant systems asks operators to split the network into small sealed sections, lock down the controllers, and see more of what is happening, all on the assumption that someone is already inside. Every request is checked, and nothing is trusted simply because of where it sits on the network.

Segment and isolate aggressively

Varmoda’s experts rate this the single most effective move against an attacker who is already inside and waiting. CISA’s CI Fortify program asks operators to be able to keep essential services running in an emergency: cutting off supplier and office-network connections to the plant systems and running cut off for weeks or months while a threat is active. The ability to disconnect and keep going has to be built before it is needed.

Fix the entry points the campaigns actually use

• Patch the devices exposed to the internet on their own fast schedule, separate from the general patching queue.
• Eliminate default and shared credentials, including on OT assets where vendor defaults are routinely left in place.
• Enforce phishing-resistant multifactor authentication.
• Tightly control and time-box vendor remote access.

Because these actors rely on stolen credentials and native tooling, identity hygiene and behavioral monitoring matter more than signature-based antivirus.

Instrument for detection of legitimate-looking activity

Varmoda’s team watches for the tools attackers use to move between systems, and for unusual use of the admin tools already built into them. The aim is to catch a real login being used in a way it never normally is. That is a question about behavior, not about recognizing a known virus.

Map it to a governing framework

NIST Cybersecurity Framework 2.0 gives operators a shared language: Govern, Identify, Protect, Detect, Respond and Recover. Adding Govern in version 2.0 puts the question of who is accountable at the center, and that is exactly where critical infrastructure programs tend to be weakest.

Machine intelligence helps both sides

Super intelligence has moved out of trials and into daily security work, and the honest answer is that it cuts both ways.

On offense, attackers are already scaling up

SI-enabled attacks have risen sharply year on year, and security professionals now rank attacks run by agents as their biggest single threat, ahead of deepfakes and attacks that come through a supplier. An attack that once needed a team now needs one operator and an agent.

On defense, it is how operators keep pace

In Varmoda’s work the gains are concrete. Threats are spotted faster. A large share of the routine analyst work is handled automatically. Alerts are sorted and connected in seconds rather than hours, and a contained response can be triggered within set limits. This layer sits on top of existing industrial systems, so nothing has to be torn out and replaced, which matters enormously when the equipment cannot be touched.

Autonomy must be bounded and governed

This is where a solid program separates itself from a risky one, and it is where Varmoda draws its own line. Federal guidance on using machine intelligence safely in critical infrastructure is still being written rather than finished, and the ways of testing these systems are still improving. They will not catch every way one can go wrong.

A practical implementation roadmap

The Varmoda approach

War Mode is the right mindset here: defend as though the attacker is already inside, because for critical infrastructure that is no longer a precaution. It is what the record shows.

Varmoda builds critical-infrastructure defense the way the guidance now asks for it. Zero trust and hard network separation come first. Services are engineered to keep running while cut off. Machine intelligence is given a job and a boundary, not free rein.

Varmoda pairs cleared public-sector delivery with a Microsoft-anchored security practice, and decides how much autonomy an agent gets based on the approval boundary and the mission rather than on what is fashionable. The companion paper on agentic workflows inside GCC High sets out how.