

Expert interview: is robot security keeping up with physical AI?
There is no safety without security, says Andrew Kolisnyk: when you buy a robot, you buy its attack surface. In a car a person holds the steering wheel; in a robot the AI decides what happens next, and VicOne’s research showed that text on a poster can mislead a robot into an unintended action. Andrew names three main risks (misleading the AI through what it sees, unauthorised commands, and tampered models or updates), explains that under the Cyber Resilience Act whoever puts a robot on the market owns its cybersecurity, and gives buyers three questions to ask before they sign.
Watch the full interview with Andrew Kolisnyk and read the transcript
Chapters
- Highlights
- Is security keeping up with physical AI?
- From cars to robots: VicOne's path
- Cars and robots: same DNA, different threat model
- The top three attacks on robots
- Many vendors, one robot: shared responsibility, single accountability
- Automotive foundation, new robotics research
- 2030: a security-mature robot industry
- Lightning round
- Security is not a compliance task at the end
- No safety without security: three questions before you buy
In Andrew’s own words
In a robot, the AI holds the steering wheel, but in a car, it's a person behind the steering wheel.
When you buy a robot, you buy its attack surface.
There is no safety without security.
What Andrew advises buyers before they sign for a robot: ask how the robot and its AI were tested against cyber attacks, how it will be monitored and updated over its lifetime, and whether the supplier is ready for the Cyber Resilience Act, whose vulnerability reporting started this September and becomes mandatory in December 2027. Security belongs in from the start: added too late, manufacturers and operators can pay three times.
Andrew speaks at Humanoid Europe 2026 in Munich on 5–6 November.




























































