From concrete to cognition: when infrastructure gets a nervous system, it also gets new vulnerabilities

Smart sensors can prevent failures, but they also expand the cyber attack surface of bridges, grids, and water systems.

Article link: https://open.substack.com/pub/johanosteyn/p/from-concrete-to-cognition-when-infrastructure?r=73gqa&utm_campaign=post&utm_medium=web&showWelcomeOnShare=true

Audio summary: https://youtu.be/2C_edQRyyN4

Follow me on LinkedIn: https://www.linkedin.com/in/johanosteyn/

We are wiring up the built world. Bridges, substations, water networks, ports, traffic systems and rail corridors are being fitted with sensors, connected controllers, and analytics that can detect stress, predict faults, and optimise performance. Think of it as a nervous system: nerves (sensors), reflexes (automation), and a brain (analytics and, increasingly, AI). Done well, this is a leap forward for safety and reliability. Done badly, it becomes a new pathway for disruption.

The uncomfortable truth is that every new sensor, gateway, cloud dashboard, and remote-access tool is also a potential point of entry. As we rush to make infrastructure smarter, we need to make it harder to break.

CONTEXT AND BACKGROUND

“Smart infrastructure” is often sold as a modernisation project, but it is really a shift in how we manage risk. Instead of periodic inspections and reactive repairs, we move towards continuous monitoring and preventative maintenance. That matters in places where budgets are tight, and failure is expensive, not only in money but in trust, safety, and social cohesion.

The challenge is that critical infrastructure is no longer purely physical. It is cyber-physical. The systems that open valves, balance load, and manage signalling are increasingly connected to corporate networks, vendors, and the wider internet. That connectivity brings efficiency, but it also expands exposure.

Recent incidents and advisories underline how real this is. Reuters reported in December 2025 on warnings from US and Canadian agencies about Chinese-linked hackers using malware as a back door for potential sabotage, including activity targeting widely used virtualisation infrastructure. This is the landscape: patient access, pre-positioning, and the ability to disrupt later.

INSIGHT AND ANALYSIS

The first mistake organisations make is treating “smart infrastructure” like normal IT. It is not. Operational technology, the systems that control physical processes, has different priorities: uptime, safety, and predictable behaviour. Patching windows is harder, legacy equipment is common, and downtime can be dangerous. When you layer AI and analytics onto that environment, you can create enormous value, but you also create complex dependencies that attackers love.

The second mistake is assuming that more visibility automatically equals more security. Sensors can tell you a bridge is vibrating strangely or that a transformer is overheating. But sensors can also be spoofed, disabled, or used as a foothold if they’re poorly secured. Denmark’s experience is a warning sign: the Associated Press reported that Danish authorities linked cyberattacks on infrastructure, including a water utility incident that temporarily left homes without water, to a wider pattern of hostile activity. The lesson is not “don’t modernise”. It is “assume hostile actors exist”.

So what does “security by design” look like in this world? It looks boring, which is precisely why it gets ignored. Strong network segmentation between IT and OT. Tight control of remote access. Asset inventories that are actually accurate. Logging that is monitored, not just stored. Redundancy and manual fallbacks for when digital controls fail. And procurement discipline that treats cybersecurity as part of engineering, not an optional add-on.

Standards matter here. The IEC has been explicit that smart grids and industrial control environments require structured security approaches, including the IEC 62443 family for industrial automation and control systems. And in December 2025, the International Society of Automation announced updated guidance in the ISA/IEC 62443 series aimed at helping organisations build and maintain security protection schemes for operational environments. These are not academic documents. They are practical guardrails for a world where “smart” must also mean “defensible”.

IMPLICATIONS

For policymakers and municipal leaders, the priority is governance, not gadgets. If you cannot answer three questions, you are not ready: Who is accountable for risk? Who can override automated decisions during emergencies? What is the incident response plan when something goes wrong? “Smart” without clear authority and a rehearsed response is just connected fragility.

For business leaders and operators, this is a procurement and skills issue. Cyber risk is increasingly showing up in places where it used to be hidden.

TechCabal noted in late 2025 that regulation and disclosure pressures are making breaches in Africa harder to keep quiet, which changes reputational and operational stakes for organisations across the continent. If you are buying sensors, platforms, and managed services, you are also buying long-term dependency. Make sure you have the in-house competence, contractual leverage, and audit rights to manage it.

CLOSING TAKEAWAY

Smart infrastructure is a compelling idea: systems that can feel stress, anticipate failure, and keep societies running more safely and efficiently. But the nervous system metaphor cuts both ways. A nervous system can help you avoid harm, and it can also become a pathway for pain if it is exposed. The next phase of modernisation must treat cybersecurity as part of civil engineering, not a separate IT project. If we want bridges and grids that can sense and respond, we must build defences, redundancy, and accountability into the design from day one. Our future depends on it.

Author Bio: Johan Steyn is a prominent AI thought leader, speaker, and author with a deep understanding of artificial intelligence’s impact on business and society. He is passionate about ethical AI development and its role in shaping a better future. Find out more about Johan’s work at https://www.aiforbusiness.net