AI and vulnerabilities
Security when AI finds the vulnerabilities
AI makes it faster and cheaper to find vulnerabilities. That is true for attackers and for defenders alike. Here we explain how we see it and what we do.
The situation
Updates cannot keep up
Finding a vulnerability and building an attack used to take a long time. Now AI can do much of the work. More vulnerabilities are found, and the time from discovery to attack is getting shorter.
Industrial equipment is rarely updated. Many machines can only be updated when production is stopped. So known vulnerabilities stay in the equipment for a long time.
The conclusion is simple. Protection must work even when there are vulnerabilities that no one has had time to fix.
More vulnerabilities are found
AI can go through large amounts of code and software in a short time. Flaws that have been hidden for years come to light.
Less time to act
Once a vulnerability is known, an attack can follow quickly. The time available for updating gets shorter.
Old equipment stays in place
Machines are used for many years. It takes time before every vulnerability is fixed or the equipment is replaced.
Our answer
Four layers that protect even when there are flaws
No one can promise that a product has no flaws. So we build protection in layers. If one layer is not enough, the next takes over.
1. What cannot be seen cannot be attacked
The Lock makes equipment invisible to anyone without permission. No inbound ports are open. The Lock stops all traffic that a rule in the XMS does not allow. An attacker cannot attack what cannot be found, however fast AI works.
2. The consequences stay small
If something still goes wrong, the damage should be small. Each permission covers specific machines for a set time. The user and the Lock check each other twice a minute. A revoked permission stops working at once.
3. Fixes are fast and open
We receive and prioritise reports continuously during Swedish office hours. For a critical vulnerability we assign a team at once. The team finds the cause, informs customers and produces a fast fix.
4. We use AI ourselves
We use AI in a very deliberate way. The aim is to gain the greatest possible advantage for cybersecurity. AI helps us both when we develop and when we test the security of XoT.
Layers 1 and 2
Protection starts with the equipment not being visible
An attacker often starts by scanning the network for equipment that responds. AI makes that scan faster. Behind a Lock, the equipment responds only to someone with a valid key.
Everything is denied by default
The Lock lets through only what a rule explicitly allows. It stops all other traffic. Equipment behind the Lock is invisible to others.
No passwords to guess
Every person and every device has its own certificate. There are no passwords for AI to guess or trick out of someone.
Fast shutdown
You can shut out a user or a vendor at once. With your own certificate authority you can also revoke and replace certificates.
A trail to follow
The XMS logs who reached what, when and for how long. The logs can be sent to your SIEM, a system that collects and analyses logs.
Layer 3
How we fix vulnerabilities in XoT
A team starts at once
A critical vulnerability gets its own team without delay. The team finds the root cause, informs customers and produces a fix.
Flaws in others' software are fixed fast
XoT is partly built on software from others. When the flaw is there, we fix it as soon as the supplier has a solution. If the supplier takes too long, we sometimes close the hole ourselves. We do that with a temporary fix until the supplier has fixed the root cause.
Open about vulnerabilities
We publish critical and known vulnerabilities on support.xertified.com. We report actively exploited vulnerabilities to ENISA within 24 hours.
Secure updates
Updates are signed. An update of XoT-S1 cannot leave the Lock unusable.
Free for five years
The support period is five years for all our products. During that time, security updates are free of charge.
Reports are welcome
We have no programme that pays for reports. Instead, we welcome everyone to report vulnerabilities to us responsibly.
Layer 4
How we use AI in our own work
AI gives defenders the same advantages as attackers. We want to be the first to find the flaws in our own products.
In development
We use AI with clear rules for code quality, testing and cybersecurity frameworks. Development is based on Microsoft SDL.
In security testing
We use AI when we test the security of XoT. Our partners also penetration-test it.
Together with the AI companies
We take part in the programmes AI companies run for security work. They give defenders access to tools for finding vulnerabilities.
Plainly put
What we do not promise
There is a lot of marketing about AI and security. So we also say clearly what we do not promise.
That XoT cannot be hacked
No software is completely free of flaws. We never say that XoT cannot be hacked.
That XoT is AI-proof
There is no standard for being AI-proof. We do not use that kind of word.
That XoT replaces updates
The Lock buys you time. You still need to update or replace vulnerable equipment when you can.
That XoT stops people who have permission
Someone who has been given access can misuse it. So permissions should be narrow, and the logs should be reviewed.
Questions to ask
Questions you can ask every supplier
AI does not change what a good supplier should do. But the pace is higher. Ask every supplier these questions, including us.
| Question | Our answer |
|---|---|
| What can someone without permission see of the product on the network? | Nothing. The Lock does not respond, and no inbound ports are open. |
| What can an attacker reach if a permission is misused? | Only the machines the permission covers, and only for a set time. |
| How fast do you fix a critical vulnerability? | A team starts at once. Flaws in others' software are fixed as soon as the supplier has a solution. Sometimes we close the hole temporarily before then. |
| Where do you publish vulnerabilities? | On support.xertified.com. We report actively exploited vulnerabilities to ENISA within 24 hours. |
| How long does the product get security updates? | For five years. The updates are free of charge. |
| Are updates signed? | Yes. An update of XoT-S1 cannot leave the Lock unusable. |
| Can we get a software bill of materials, an SBOM? | Yes, for every release. |
| How is the product tested, and by whom? | We test in every development cycle, including with AI. Our partners run penetration tests. |
| How do you use AI in development? | With clear rules for code quality, testing and cybersecurity. |
| Can we shut out a user at once? | Yes. A revoked permission stops working at once. |
| Can we follow what happens? | Yes. The logs can be sent to your SIEM. |
| Can you assign CVE numbers yourselves? | Not yet. A CVE number is an international identifier for a known vulnerability. |
Penetration-test reports are shared under an NDA.
From our CEO
Trust is built when something happens
Every supplier will have vulnerabilities. Anyone who claims otherwise has not looked hard enough, at least not with AI. So we never promise that XoT cannot be hacked. Instead we promise three things you can verify. We work on them every day.
Be seen less. Equipment that cannot be seen cannot be attacked, however fast AI searches.
Lose less. Every permission covers the right machine for the right time. If something goes wrong, the damage stays small.
Fix faster. A critical vulnerability gets its own team at once, and we are open about what happened.
We do not have every answer. But we have chosen our strategy, and we are building the organisation for it. Trust is not built with big words. It is built by how we act on the day something happens.
Want to know more?
We are happy to answer questions about how XoT handles vulnerabilities. We also help you start with the machine that is most exposed.