Cybersecurity in industry is facing a paradigm shift that no longer accepts the reactive approach. That was the central premise of Amanda Redin, Account Executive of Veeam, and Gustavo Dutschmann, Sales Engineer at Object First, In his talk «AI and Ransomware: When the threat learns faster than the defense» during the Industrial Cyber Summit Argentina 2026.
In fifteen minutes, the two specialists built an argument that was understandably uncomfortable: the mental model that most organizations still use to think about data protection is several steps behind how attackers operate.
The number that no one wants to see
The talk began with a statistic that doesn't give much room for optimism: around 160% of the companies reported having suffered a relevant ransomware attack in the last period. The percentage exceeds 100% because many organizations were attacked more than once in the same year.
The projection for the future is equally strong. According to data from Cybersecurity Ventures, The global cost of ransomware attacks could reach $265 billion by 2031. It’s not an abstract figure: it includes downtime, paid ransom, recovery costs, reputational damage, and the regulatory impact that follows every incident that is made public.
What has changed in recent years is not only the frequency but the nature of the attack. Dutschmann put it clearly: before, an attack was a quick event — a moment, an hour, maybe a day. Today, ransomware groups engage in sustained social engineering, study the target organization’s environment, identify its most sensitive points, and act when the moment is most convenient for them, not when the defense is more alert. The time of silent presence within a network before launching an attack can be measured in weeks or months.
Data poisoning: the attack that cannot be seen
The most awkward moment of the talk came when Redin introduced the concept of data poisoning. It sounds technical and abstract. Reality is simpler and more disturbing.
Data poisoning does not seek for systems to fail. It seeks for them to be vulnerable. Data fallen. Using artificial intelligence, attackers inject incorrect information into the datasets that an organization uses to operate, so that the systems continue to operate with apparent normality while, underneath, the decisions that are made begin to be based on contaminated information.
The real case they used as an example involves an artificial intelligence system for personnel selection: the data was modified, millions of records were exposed, and the AI continued to operate normally, using those incorrect data to feed into future processes. No one detected it immediately.
The real problem is not the insertion of the false data itself. It is that the contaminated data They continue to circulate And feeding business decisions. The effect accumulates silently: the organization begins to make incorrect decisions with complete confidence in its systems because the systems show no sign of failure. When the damage becomes apparent, reconstructing what data was compromised, at what time, and to what depth is an extremely complex task for digital forensics.
This dynamic directly connects to one of the most persistent problems in industrial cybersecurity: the lack of inventory of assets and of traceability regarding what data exists, where they are, and what their actual state is. Without that basic visibility, detecting corrupted data is almost impossible.
Detection no longer suffices
The second conclusion of the talk was equally straightforward: current defense strategies are, for the most part, reactive. They detect when something has already happened. They block when the attack has already begun. They alert when the damage is already done. And in an environment where attackers move faster than defenses, being several steps behind is not an acceptable stance.
Redin put forward the necessary change with one word: proactivity. Not as a marketing concept, but as an architectural decision. A proactive organization not only detects and responds: it has data that, by design, cannot be compromised. It has copies of information that cannot be modified retroactively. It has the ability to know, before an incident occurs, how long it would take to resume operations.
The data that supports that decision is overwhelming: organizations that have secure and immutable backups recover twice as fast as those that don't, according to the Veeam Data Protection Trends Report 2025. Two times faster is not an operational detail. It is the difference between a manageable disruption and a crisis that makes the headlines, with the regulatory, reputational, and financial cost that entails.
Immutability: the response to the data that must not die
The concept that Dutschmann put at the center of the argument was immutability. An immutable data copy is, by definition, a copy that cannot be modified, encrypted, or deleted once created. It doesn’t matter that the attacker has access to the network: if the backup is stored in immutable storage, that copy remains intact.
The combination of Veeam and Object First specifically addresses that problem. Veeam handles the orchestration of backup and recovery; Object First provides the immutable storage on which those backups are housed. The principle is simple: separate the management software from the storage hardware so that no compromised credentials in one allow modification of the other.
Architecture is not new as a concept, but its adoption in industrial and enterprise environments is still far from being universal. Many organizations have backup strategies that look good on paper but, in the face of real ransomware, discover that their own backups were also encrypted—because they were accessible from the same network that was compromised.
This vulnerability is exactly the one that the Remote access without VPN for OT environments It seeks to close the breach from another angle: limiting the range of action of any compromised credential so that the damage does not spread laterally across the entire infrastructure.
The question that few can answer
Towards the end of the talk, Redin asked the audience a question that had the effect of a mirror: «Which of you know how long it would really take to recover if you had to do it today?»
Not how much the plan says. Not how much the team estimated at the last security meeting. How long they would take. really, If the attack happened today, with the infrastructure they have today.
The honest answer, in most cases, is that we don't know. The RTOs (Recovery Time Objectives) listed in the continuity plans are usually aspirational, calculated under ideal conditions that rarely occur during a real incident. Operational stress, the lack of available personnel at that time, the complexity of the interdependencies between systems, and media or regulatory pressure completely change the theoretical times.
The only way to know how long it really takes to recover is to practice it. Not once a year as a compliance exercise, but with frequency enough for the team to master it and for the weaknesses in the process to be identified before an attacker takes advantage of them. argument about operational simulation It points exactly in that direction: the exercises that serve are the ones that reveal what doesn't work, not the ones that confirm what is already known.
The human factor, always
The talk closed with something that doesn't usually appear in product presentations: the human cost of ransomware. Dutschmann approached it carefully. When an attack occurs, the consequences don't just fall on the organization as an abstract entity. They fall on specific teams, on the CISO who has to put up with it, on the analyst who worked all night trying to contain the damage, on the person who, in a small company, is the only one responsible for security and also for the rest of the operation.
Pressure, the fear of making mistakes, the burnout caused by always being on the run from the threat are real consequences that do not appear in any economic impact report but that erode the ability to respond in the long term. The resilience proposed by Veeam and Object First is not just technical: it is also organizational. Knowing that there is a clean copy, that the team knows how to use it, that the plan has been tested and that there is a realistic and known recovery time radically changes the human experience of facing an incident.
In industrial cybersecurity, as in any other field, technology without the people behind it who understand and practice it is just infrastructure. The true protection begins when both things work together.
To deepen your knowledge of the defense strategy, read also: Hybris, Achilles and the Trojan Horse: culture and OT security and Operational simulation in cybersecurity: why practicing it once a year is not enough?
