> The advent of AI and its ability to find vulnerabilities so quickly

No AI needed. The supermarket controllers had software with guessable passwords and outdated nginx, both of which had patches out for a year.

Some hardware had reached end-of-live, and were never replaced.

All were connected directly on the internet instead of secure APNs or VPNs.

This is long-standing, basic management failure, and the fines should reflect that.

So, the people in charge are either inept or just sleeping on the job especially for things that are so important to people's lives. cause it seems like everyday something else is getting hacked or exploited because of its vulnerabilities.

in case of my friends, I see a lot of them dropping out of the workforce because of these inept people stuck in managerial positions. my college roommate has a masters in data science and now works as a construction worker. I am also thinking about something similar. i'm absolutely frustrated with idiots above me conducting meetings and wasting hundreds of workhours to deny changes like "don't use default passwords" because they are "unnecessary risk".

It sounds like they are both inept and indifferent about the running of the business, default passwords are not really that huge of a risk. Not updating systems after a long time is one and keeping the fridges connected to the internet while not spending enough on cyber security is a big risk.

It is hard to wrap your head around a freezer reaching EOL due to no longer providing firmware updates though. I can absolutely understand why you'd have a hard time convincing a manager that you need to spend money to replace a "perfectly good" freezer just because the vendor no longer provides firmware security updates.

I agree that it's a manager failure in part, but I also think it's a failure on part of the industry to not demand longer term support for this type of product, and also on part of regulators for not realizing the vulnerability of the situation (though the EU Cyber Resilience Act seems an acceptable first stab at remedying this).

Indeed, NIS2 and CRA are meant to motivate critical infrastructure to allocate focus and resources as needed. There is enough blame and incompetence to go around.

Do you want to guess which EU country delayed their NIS2 implementation - again - in the Summer of 2026?

https://www.it-connect.tech/nis-2-delay-france-referred-to-t...