Expert interview: is robot security keeping up with physical AI?

0:09 Andrew Kolisnyk: In a robot, the AI holds the steering wheel, but in a car, it's a person behind the steering wheel. In our research, we crafted text on a poster that misled a robot into an unintended action. So the robot should be able to read a message without taking orders from it. If it's done too late, the manufacturers and operators can pay three times. So you cannot certify a robot as safe if anyone can change what it decides. And buyers will expect security evidence in every tender before they sign the contract.

0:50 Interviewer: Defense strategy: trust nothing, or trust with safety nets?

0:52 Andrew Kolisnyk: Zero trust, but safety nets, I would say.

0:56 Interviewer: What does the industry need more: regulators or innovators?

0:58 Andrew Kolisnyk: I think we need more innovators.

1:01 Interviewer: Robot future: utopian or dystopian?

1:02 Andrew Kolisnyk: Utopian, 100% utopian.

1:04 Interviewer: Robot cybersecurity in 2026, in one word?

1:06 Andrew Kolisnyk: Mandatory. Do it now.

1:11 Interviewer: Is security keeping up with physical AI?

1:16 Andrew Kolisnyk: In answering this question, I would say yes, for sure. Security is advancing, but it must keep pace with how robots now interact with the world. At the same time, we are making progress, but the challenge grows as robots leave the cage and share space with people. In our practice, we also use AI to protect AI. That AI helps robots understand their surroundings. What they see or hear can shape what they do next. And if someone, for example, manipulates it in operation, do the robot's safeguards still hold, or not? This is the question we need to answer. And this is why cybersecurity has to be part of robot safety.

2:09 Interviewer: What made VicOne move from cars into robot security?

2:14 Andrew Kolisnyk: We built our expertise over the last two and a half years protecting vehicles. VicOne is a spin-off of Trend Micro. We now protect around 1.5 million devices globally and work with eight of the top 20 passenger vehicle brands. So the cars taught us how to protect connected machines where a digital attack has physical consequences. But a robot, facing the same challenge, acts differently because AI decides how it moves. And that combination is where our expertise matters most.

2:59 Interviewer: Cars and robots: the same security challenges?

3:04 Andrew Kolisnyk: I can say we have the same engineering DNA, but a different threat model and different risks. In a robot, the AI holds the steering wheel, but in a car, it's a person behind the steering wheel. So these two areas are very much related, but not identical. In our research over the last year and a half, we already identified two sorts of risk overlap. But the difference is that in a robot, AI directly decides what happens next. So the robot works right next to people, and most robot makers are only now building security practices. And automotive has done it already for decades.

3:53 Interviewer: What are the top three attacks on robots?

3:57 Andrew Kolisnyk: What a robot trusts can change what it does. So the robot should be able to read a message without taking orders from it. Three main risks. The first: misleading the AI through what it sees. In our research, we crafted text on a poster that misled a robot into an unintended action. Second, sending unauthorized commands that change a robot's movement or task, for example. And third, tampering with the model or a software update, so the robot responds differently, even to legitimate instructions. And the defense question is always the same: does the attack change what the robot physically does? And protecting a robot also means protecting the operation that depends on it. It's not only about the devices.

4:57 Interviewer: Many vendors, one robot: who is responsible when it gets attacked?

5:02 Andrew Kolisnyk: Yes, because it's not only about the manufacturer, operator, regulator or user. The responsibility is shared, but accountability is not. The manufacturer signs the CE mark at the end, and in Europe, the Cyber Resilience Act made it really clear: whoever puts the robot on the market owns its cybersecurity, including every part they integrate. So in practice, every supplier must secure its own piece. But the biggest risk sits in the gaps between vendors, and someone has to cover the whole system. This is where we exactly help at VicOne.

5:50 Interviewer: Same tech stack as automotive, or new R&D for robots?

5:54 Andrew Kolisnyk: I think it's still both. This cannot be separate, because we build on automotive expertise and add new research on how AI risks change robot behavior. Automotive gives us a really proven foundation, but robotics adds new questions about AI and physical consequences. So what matters is turning research into something developers can use. Findings, for example, from our DEF CON robot hacking community in Las Vegas this past August. We launched it together with NVIDIA, and we developed ready-to-run test scenarios so developers can test their own robots earlier, in a simulated environment, for example. It's kind of time-proven technology, already verified and implemented by car manufacturers, but adjusted to real robotics challenges. Before robots go to market, we help validate it during the development and testing process.

7:07 Interviewer: 2030: what does a security-mature robot industry look like?

7:11 Andrew Kolisnyk: I think it's probably similar to what we have already implemented in automotive. But in robotics, I can imagine that in three to five years an unsecured robot will be as unsellable as a car without airbags. And security will be part of every robot's safety case, not a separate topic. Robots, before they go to market, will be tested against attacks in simulated environments before they meet people. And they will be monitored once they are deployed in production, in services or in the public sector. So the industry will share threat intelligence, and buyers will expect security evidence in every tender before they sign the contract.

8:03 Interviewer: Cybersecurity: prevent or respond?

8:06 Andrew Kolisnyk: Both.

8:06 Interviewer: Defense strategy: trust nothing, or trust with safety nets?

8:07 Andrew Kolisnyk: Zero trust, but safety nets, I would say.

8:11 Interviewer: What does the industry need more: regulators or innovators?

8:13 Andrew Kolisnyk: I think we need more innovators.

8:16 Interviewer: Robot future: utopian or dystopian?

8:17 Andrew Kolisnyk: Utopian, 100% utopian.

8:20 Interviewer: Robot cybersecurity in 2026, in one word?

8:21 Andrew Kolisnyk: Mandatory. Do it now.

8:22 Interviewer: Your Munich talk: what should people rethink?

8:27 Andrew Kolisnyk: I want the audience to remember that security is not a compliance task at the end, because it should be built from the start, and it delivers compliance and safety in the end result. Nowadays, many teams treat security as paperwork, something to finish before a launch. But if it's done too late, manufacturers and operators can pay three times. They may need to redesign the system from scratch. They can have delayed certification, and they might face incidents in the field. So you cannot certify a robot as safe if anyone can change what it decides. It actually tells about the topic of my presentation: secure by design, compliant by default, and safe by operation. This is the message I want the audience to remember after this conference.

9:35 Interviewer: What conversation do you want to have in Munich?

9:39 Andrew Kolisnyk: I'm very interested in talking with the broad community to discuss the main topic of our presentation: there is no safety without security. When you buy a robot, you buy its attack surface. And operators in Europe, and not only in Europe, just need to ask for the security evidence before they sign any purchase or implementation contract. I think they need to ask three simple questions before the robot's implementation, before the robot's launch. First one: how will the robot and its AI be tested against potential cyber attacks? Second: how will it be monitored and updated over its lifetime? And third: are you ready for the Cyber Resilience Act, which started this September for vulnerability reporting but will be mandatory from December 2027? And if they cannot answer, factor that into the price or into your shortlist.