AI finds the bugs; the patching gap still decides the damage.

The incident. French supermarket chains Carrefour, Monoprix and Intermarché had refrigeration systems pushed to 50°C, with units smoking and catching fire. Attackers went after Danfoss, Copeland and Dixell management systems running outdated firmware. Danfoss had issued a fix after Team82 reported the flaws, yet many units stayed unpatched. The failure is not exotic. It is the standard operational technology pattern: internet-connected devices, no update owner, and a gap between vendor warning and field reality.

The lesson. The cost of taking OT offline for maintenance is real, but the panel is right that controlled downtime beats uncontrolled failure. Spoiled stock runs into millions of euros, and the physical risk is worse when temperature shifts hit manufacturing or power sites. For engineering leaders, the point is ownership. Someone has to decide which devices are exposed, who patches them, and what happens when a fix requires downtime. Without that, every vendor advisory becomes another piece of paper.

The data. The Semperis 2026 Ransomware Risk Report, based on 1,200 IT professionals across nine countries, claims 84% of ransomware attacks are now AI-assisted. 69% of victims were hit multiple times, and 59% paid at least once. These are survey numbers from a security vendor, so treat them as directional. The panel's point that many companies quietly pay is worth repeating: public stats undercount the real payout rate.

The agent risk. The more forward-looking number is 44% of attacks exploiting a company's own AI agents and identity systems. The panel frames agent identities as insider threats, which is the right mental model. Agents need identities, permissions and data to do work, and those same privileges can be used against the organization. Controls like kill switches, scoped permissions and continuous monitoring need to be in place before agents touch production, not after an incident.

The fix. Bank of America's use of Anthropic's Mythos tool to find hundreds of vulnerabilities, followed by hiring 1,000 contractors on top of 3,000 existing workers, shows what AI-driven discovery does to an organization: it creates a remediation backlog. CEO Moynihan's claim that remediation costs fall once the pipeline moves is plausible only if patching becomes continuous. A one-time surge is not strategy. It is catching up.

The open question. The panel is appropriately skeptical about full automation. AI will keep finding more bugs and generating faster attacks, but humans still carry context and remediation judgment. The unresolved tension is scale: if frontier models find vulnerabilities faster than teams can patch them, the bottleneck shifts from discovery to delivery. Engineering leaders should watch for that gap in their own organizations.