AI Cybersecurity Risk: A Practical Prep Checklist for 2025
A grounded checklist for AI-era infrastructure risk: food, water, cash, first aid, local LLMs, and multi-factor authentication explained.
What AI-related infrastructure risk actually means
AI systems are increasingly capable of probing, exploiting, and automating attacks against the systems that run everyday infrastructure, things like grocery store refrigeration networks, water treatment controls, and banking access. Much of this equipment was never designed with modern cybersecurity in mind, and a lot of it is reachable over the open internet. The practical risk isn’t a sci-fi scenario. It’s a short outage, a few days without banking access, or a regional disruption that exposes how little slack most households have built into their daily routines.
This isn’t a call to panic. It’s a case for the same basic preparedness people have relied on for decades (food, water, cash, first aid) updated for a world where digital systems control more physical infrastructure than ever, and where AI tools make probing for weaknesses in those systems faster and cheaper.
TL;DR
- Grocery refrigeration and utility systems are often internet-connected and poorly secured, meaning a cyberattack can cause real-world outages, as seen in a recent incident affecting hundreds of French grocery chains.
- Two weeks of food and water per household member is a cheap, low-effort buffer (roughly 2,000 calories and 1.5 to 2 liters of water per person per day) that costs well under $200 for a family.
- Cash on hand matters because banking access can be disrupted by outages or attacks, and a physical reserve isn’t “lost” money, it’s just money in a different form.
- SMS-based two-factor authentication is weak because phone number spoofing is now common; switching to an authenticator app for multi-factor authentication takes minutes per account and closes a major attack vector.
- A local large language model paired with an offline knowledge base like a downloaded Wikipedia archive gives you access to practical knowledge (first aid, repairs, basic troubleshooting) even if internet access is interrupted.
- None of this requires a bunker mentality. It’s closer to the standard emergency preparedness guidance that predates AI, adjusted for the fact that digital infrastructure now touches nearly everything physical.
- ✕a coding agent
- ✕no-code
- ✕vibe coding
- ✕a faster Cursor
The one that tells the coding agents what to build.
Why is infrastructure suddenly a cybersecurity concern tied to AI?
Industrial control systems for things like refrigeration, water treatment, and utility management were often built for reliability, not security. Many run on older software, use default credentials, or are connected to the internet for remote monitoring without serious protection layered on top. That combination (old systems, internet exposure, weak authentication) has existed for years. What’s changing is the speed and scale at which vulnerabilities can be found and exploited.
AI tools lower the skill floor for discovering and chaining together exploits. Capabilities that used to require a specialized security researcher can increasingly be approximated by automated tools probing for weak points across thousands of targets at once. A real-world example cited in recent reporting: a cyberattack took refrigeration systems offline at roughly 350 grocery store locations in France, disrupting operations across an entire chain. Scale that kind of incident up, or imagine it hitting water sanitation systems or banking infrastructure instead of refrigerators, and the stakes become clearer. None of this requires a dramatic AI takeover narrative. It just requires existing vulnerabilities being found and exploited faster than organizations can patch them.
What should a basic physical preparedness kit include?
The standard emergency preparedness list works here, and it’s not expensive or complicated.
Food and water. Plan for about 2,000 calories per person per day, for roughly two weeks. For a two-person household, that’s somewhere in the range of 50,000 to 60,000 calories total, easily covered with non-perishable staples like rice, canned goods, peanut butter, and similar shelf-stable items. This can be assembled for somewhere around $100 to $150. Pair it with 1.5 to 2 liters of water per person per day for the same two-week window. Large water jugs kept in a pantry or closet cover this cheaply.
Cash reserves. Keep roughly a month’s worth of essential expenses in physical cash, stored somewhere secure at home. This isn’t about distrusting banks broadly, it’s about having a buffer if electronic payment systems or banking access are disrupted for a few days. The money isn’t lost, it’s just converted from a digital balance into a physical form that works even when networks don’t.
First aid basics. A standard first aid kit and a fire extinguisher cover the most likely small-scale emergencies, especially if access to hospitals or urgent care is temporarily constrained.
Offline knowledge access. This is the part that’s genuinely new. Running a local large language model on a personal computer, combined with an offline copy of a reference resource like Wikipedia, gives you a usable knowledge base that doesn’t depend on internet connectivity. If cloud AI services or internet access are interrupted, a local model can still help with practical tasks: basic first aid guidance, repair instructions, troubleshooting steps. Setting this up is a fairly mechanical process these days and can largely be handled by asking an AI assistant to walk through the installation steps for your specific hardware.
Why isn’t SMS-based two-factor authentication good enough anymore?
Seven tools to build an app. Or just Remy.
Editor, preview, AI agents, deploy — all in one tab. Nothing to install.
Text-message based two-factor authentication (2FA) relies on the assumption that only you can receive messages sent to your phone number. That assumption has broken down. Phone number spoofing, SIM-swapping, and related social engineering techniques have become common enough that SMS codes are now one of the more frequently exploited paths into personal accounts, including bank accounts.
The fix is straightforward: switch to multi-factor authentication (MFA) using an authenticator app instead of SMS. Authenticator apps generate time-based codes locally on your device rather than sending them over the cellular network, which removes the phone-number-spoofing attack vector entirely. Setting this up typically takes a few minutes per account: install an authenticator app, scan a QR code or enter a setup key from each service, and confirm the pairing. Doing this across your important accounts (email, banking, primary cloud storage) is one of the most effective security changes available, and it costs nothing.
Is this level of preparation actually necessary?
It depends on how you weigh low-probability, high-impact events against a small amount of upfront effort. None of the steps above require significant money, specialized skills, or a dramatic lifestyle change. Two weeks of food and water, a cash buffer, a first aid kit, and better authentication habits are all things emergency preparedness advocates have recommended for decades, independent of AI. What’s changed is the specific threat model: more of the infrastructure around us is networked, more of that networked infrastructure is a target, and AI tools make it easier to find and exploit weak points at scale.
Framed that way, this isn’t really about AI being uniquely dangerous. It’s about AI speeding up existing risks in systems that were already more fragile than most people assume. A short list of basic precautions is a reasonable response to that shift, regardless of whether a specific worst-case scenario ever materializes.
Frequently Asked Questions
What is the minimum amount of food and water I should store?
Aim for about two weeks of supply: roughly 2,000 calories per person per day in non-perishable food, and 1.5 to 2 liters of water per person per day. For a two-person household, that totals somewhere around 50,000 to 60,000 calories plus around 42 to 56 liters of water for the full period.
Why keep cash if most transactions are digital anyway?
Digital payment systems depend on functioning networks and power. If those systems go down, even temporarily, physical cash still works. Keeping roughly a month of essential expenses in cash is a hedge against short-term disruptions, not a rejection of digital banking.
How do I set up a local LLM for offline use?
Local large language models can be run on a personal computer using available open-source tools, paired with an offline reference archive like a downloaded Wikipedia dataset. The exact setup depends on your hardware, but modern AI assistants can walk you through the installation and configuration process step by step.
Is multi-factor authentication different from two-factor authentication?
Two-factor authentication (2FA) is a subset of multi-factor authentication (MFA): it specifically means two verification steps, often a password plus an SMS code. MFA is the broader term and includes stronger options like authenticator apps or hardware security keys, which are less vulnerable to phone-number spoofing than SMS-based 2FA.
Does preparing for AI-related infrastructure risk require technical expertise?
Remy doesn't write the code. It manages the agents who do.
Remy runs the project. The specialists do the work. You work with the PM, not the implementers.
No. Food and water storage, cash reserves, and first aid kits require no technical skill at all. Setting up an authenticator app or a local LLM takes a bit of guided effort but doesn’t require programming or security experience, especially with AI tools available to walk through the setup.
