AI readiness is now a security check

Critical flaws in PHP disrupted websites around the world this month. AI helped find them. Urgent patches followed, and organisations pulled sites offline while they fixed systems. The lesson for Australian manufacturers is blunt: you cannot secure what you cannot see, understand or manage.

ARM Hub, the AI Adopt Centre for Australian manufacturing, says manufacturers should use an AI-readiness assessment as a structured check of their technology, data, connectivity and security.

"AI readiness is more than adding automation or a chatbot," said ARM Hub AI Engineer Charlotte Birkinshaw. "It's an opportunity to map systems and identify legacy or unsupported technology, understand where sensitive data sits, and put in place the controls needed to operate safely. Right now, AI readiness is a security exercise as much as it is a productivity exercise."

Legacy systems are the exposure

PHP runs many business websites and online stores, including WordPress, Drupal and Magento. Censys data reported in October 2026 showed about 1.5 million of 2.6 million PHP hosts running versions with no fix available.

Factories and supply-chain businesses also run operational technology built for a different threat environment. The Australian Signals Directorate notes these environments hold legacy devices, outdated protocols and slow replacement cycles, in systems never engineered to withstand a cyber incident. They are hard to document, patch, monitor and isolate.

ASD Director-General Abigail Bradshaw has warned that AI will either prompt decisions to replace legacy technology or leave it "the first to be compromised in a major AI-enabled attack".

The exposure runs past public websites. Customer portals, supplier systems, remote-access tools, industrial software, cloud applications and connected equipment all form part of an attack surface nobody understands if the stack has not been modernised.

Security firm ZeroFox found manufacturing was the industry most targeted by ransomware and digital extortion in the second quarter of 2026. The sector has held that position since at least 2021.

What a review should cover

• What systems, machines, software and data the business runs, including legacy and unsupported technology

• Which services face the internet, who can reach them, and whether they are still needed

• Whether patches, identity controls, monitoring, backups and network segmentation are current and working

• Where sensitive production, customer, design and commercial data sits

• Whether AI, automation and robotics can be deployed safely, with human oversight and clear governance

ASD recommends organisations shrink their attack surface, remove unnecessary internet-facing services, replace services no longer receiving vendor patches, patch fast, and use AI under human supervision to analyse security logs and test for vulnerabilities.

"Manufacturers do not need to become cyber security specialists overnight," said Birkinshaw. "But you do need to know what you're running, what's connected, what is out of date, and what would happen if a key system went down. AI readiness gives a disciplined way to answer those questions."

Modernising serves both

The average age of Australian manufacturing capital rose from 11 to 13 years over the decade to 2024. ARM Hub helps manufacturers design, test and deploy advanced technologies, from audits and roadmaps through to prototyping, automation and AI, including Data and AI-as-a-Service for businesses without their own data science capability.

"Delaying modernisation does not reduce risk," said Birkinshaw. "It leaves businesses running older systems with less visibility and fewer options, while attackers' tools get faster and more capable."

This article first appeared in Manufacturers' Monthly.