By Dr. Srinivas Mukkamala, CEO, Securin Labs.
When people talk about the global AI race, they usually mean a contest over models, chips and data centre capacity. The countries that lead on those measures tend to be described as the ones winning. I think that view misses something that will matter far more as AI moves deeper into public services and critical infrastructure: whether a country can keep those systems running when someone attacks them or when they simply fail.
Across several critical sectors, AI is already well past the experimental stage. The US Food and Drug Administration has authorised more than 1,600 AI-enabled medical devices. Around 81% of North American utilities are already using AI-related technologies. In India, 282 million consultations on eSanjeevani benefited from its clinical decision-support system between April 2023 and November 2025, including 12 million aided specifically by AI-recommended diagnoses.
Each deployment can make an organisation more efficient. But it also creates a dependency. And when that dependency fails, the people affected are no longer simply an internal IT team. They are patients, customers and citizens.
The threats are also different from those most traditional security programmes were designed to address. An attacker does not necessarily need to breach a network to compromise an AI system. They may be able to corrupt its training data, manipulate its inputs or influence how it behaves while the system continues operating as though nothing has changed.
Researchers at Anthropic, working with the UK AI Security Institute and the Alan Turing Institute, demonstrated in an experimental setting that as few as 250 malicious documents could introduce a backdoor across language models ranging from 600 million to 13 billion parameters. The specific attack they demonstrated was narrow, but the broader lesson is important: scale alone does not make a model immune to manipulation.
We see another dimension of this risk in the infrastructure connecting AI agents to real systems. When my team at Securin scanned 2,518 such servers, nearly one in four was assessed at critical risk. As AI agents gain the ability to take actions rather than simply generate text, the security consequences become much more significant.
Concentration adds another layer of exposure. The three largest cloud providers accounted for roughly 67% of global cloud infrastructure services spending in the second quarter of 2026. Menlo Ventures estimates that Anthropic, OpenAI and Google together account for about 88% of enterprise usage of large language model APIs. We have also seen what that concentration can mean operationally: one model provider sharply reduced a coding startup's direct access to its models with less than five days' notice.
Governments and enterprises should therefore plan on the assumption that the interests, availability and policies of their technology suppliers will not always align perfectly with their own.
In my experience, organisations get into trouble when they treat security as something to add after a system is already live. Some of the most important decisions happen much earlier: What data can an AI system access? Where will sensitive data and models be hosted? Who can alter them? What happens if a model begins producing unreliable output? And what is the fallback if that system suddenly becomes unavailable?
Few organisations can answer those questions properly without first understanding the data and technology assets they already have. National AI strategies face exactly the same challenge.
Testing also needs to keep pace with how frequently these systems change. A penetration test or annual audit captures a single point in time. That approach was better suited to software environments that changed relatively slowly between major releases. AI systems can be retrained, connected to new data sources and given new capabilities continuously.
Attackers are moving just as quickly. In our tracking of vulnerabilities affecting the water sector, the median vulnerability is now exploited within just 11 days of disclosure. Periodic testing simply cannot provide enough visibility in that environment.
Continuous adversarial testing and red teaming under realistic attack conditions offer a much more honest picture of how a system is likely to fail.
Governments are beginning to recognise this. The UK AI Security Institute publishes cyber evaluations of frontier AI models, while the European Union's AI Act requires providers of general-purpose AI models with systemic risk to conduct and document adversarial testing. India, too, is establishing an AI Safety Institute whose remit includes model evaluation, red teaming and risk assessment. The government advertised for its director in May 2026.
That direction is encouraging because AI safety cannot be reduced to a checklist completed before deployment. It has to become an ongoing discipline.
The human side deserves more attention as well. Voice cloning, synthetic identities and deepfake video succeed partly because the person receiving the message often does not know what to look for. Teaching employees to recognise suspicious activity, verify unusual requests and know exactly whom to alert remains one of the least expensive security measures available to any organisation or government agency.
But recovery receives perhaps the least attention of all, even though this is where the costs of cyber incidents accumulate most visibly.
Following the Change Healthcare cyberattack, UnitedHealth recorded an estimated $3.09 billion impact in 2024. When ransomware hit AIIMS Delhi in 2022, the hospital was forced to rely on paper-based processes for approximately two weeks.
Our own research found that during the first quarter of this year, a healthcare organisation was hit by ransomware roughly every ten hours. Every vulnerability exploited in those incidents was already present on the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities list.
That tells us something important. The problem is not always that the industry does not know what the weaknesses are. Often, the problem is that organisations cannot identify which weaknesses matter most, remediate them quickly enough, or recover rapidly when prevention fails.
Governments and operators should know which AI-dependent services are genuinely essential, how long those services could function without AI and what would be required to restore them. That may mean redundant systems, manual fallback processes, segmented infrastructure or domestically controlled capabilities for particularly sensitive workloads.
The goal cannot be to assume that nothing will ever fail.
The goal has to be to make failure survivable.
Innovation will continue to determine who gets ahead. Resilience will determine who stays there.
Disruptions are going to happen regardless of how advanced our technology becomes. Over time, I expect the countries that can contain damage, maintain essential services and recover at machine speed will find themselves in a much stronger position than those that were simply first to build.
Srinivas Mukkamala is CEO of Securin, founder of RiskSense (acquired by Ivanti), a member of the Board of Regents at New Mexico Tech and a Board Member at El Paso Electric. He frequently briefs members of the U.S. Congress and multiple U.S. Governors on cybersecurity and AI policy.
