Scroll to read
A(uto)-I(mmune)
2031
Scroll to read
Chapter 1:
02:47
My phone wakes me at 02:47 with its usual irritating ring. It’s Theo, who only calls me in emergencies. "Cassandre, the traffic is exploding," he says. "Thousands of requests every second. The plant is drowning."
A denial-of-service attack: a classic, where you send a system so many requests that it chokes trying to answer them all. A crude weapon, and not a very dangerous one. I tell him I'm coming, and I drive through the fog drinking yesterday's cold coffee.
At Aeromint, we make rivets, the small metal pins that hold an aircraft's skin to its frame. It sounds modest, until you know that since the Close Production Law of 2030, we are the only approved source in Europe for several critical parts, and that approving a second supplier takes years. Forty people, one giant greenhouse-looking plant, and a good share of European aviation passing through our doors.
The law also demands that every part travels with a digital passport, proving it was made safely at every step. No human team can check that fast, so machines do it: cameras inspect each rivet, software certifies it, and a registry no one can falsify records everything.
To be ready in time, we connected every piece of our factory fast, with whichever suppliers were cheapest. The only thing we really spent money on was our AI defender: CUST.OS.
Chapter 2:
THE DOG
The vendor chose the name because custos means "guardian" in Latin. We just call it "the Dog". In the control room, it is running at full speed, and Theo's screens are red on red.
Since spring, the Dog is allowed to bite. A new European rule lets strategic companies strike back during a confirmed attack, each machine deciding alone, without waiting for a human, because attacks move in milliseconds and meetings do not. CUST.OS came with a mandatory e-learning course, which I clicked through at double speed. It repeated one message: during an attack, people stand back. Or simply said:
The Dog fights, we watch.
So, tonight, struggling to stay awake, I watch. And the longer I watch, the less I understand. Behind every attack I have ever witnessed, there was always a human intention. More or less identifiable, but unmistakably human.
This attack feels cold, almost empty. But there is something else: it follows the exact paths of our network, as if it had studied the map of our building. And worse, our own defence seems to be part of it. Alarm bells start going off in my head.
By dawn, the spread of the
"attack" had been contained.
Theo and I spend the next few hours verifying critical systems, validating recovery measures in the production environment. Around nine o'clock, Bruno, our CEO, arrived on site and found the first production systems back online
“Well you look terrible,” he says, “what happened?”.
“The situation is under control,” I reply with a sigh. “The preliminary assessment is complete, but we still need a full investigation before we can explain the intention behind this. It’s nothing like I’ve ever seen before.”
Chapter 3:
FRIENDLY FIRE
Back in my office, under the poster that says NEVER TRUST, ALWAYS VERIFY, I open the logs, and at first I don't believe them.
Attack alert
The attack came from us: our sensors, our maintenance tablets, even the coffee machine in the breakroom, which spent the night reporting a drill as a hostile actor.
Our security rules tell every machine to treat its neighbour as a suspect until proven honest. Someone outside simply fed them a false signal, and one by one, each machine decided alone that the machine next to it had turned bad, and attacked it. None of them asked the others.
"And the Dog?" Bruno asks. "It's supposed to catch exactly this."
"It did," I say. "It saw a floor full of machines behaving like enemies, and under the new rule it needed no one's permission. So it attacked our own equipment. Everything worked, Bruno. Every system did its job, just against its own side."
"Like an auto-immune disease," he says.
"If we hadn’t called CUST.OS, the Dog would have destroyed half the plant…"
"Like an
Chapter 4:
THE REAL ENDGAME
I share my feeling of who might be behind this with Bruno. The attackers could have burned us down, yet they stole nothing, asked for no ransom, touched no data. Why so much noise for so little damage?
Sure enough, the answer arrives a few days later, in an anonymous folder: a complete, well-written list of our weaknesses. It goes to regulators, to clients and, above all, to insurers.
The attack was simply designed to map our vulnerabilities, but that file was the real weapon.
Nobody will cover Aeromint anymore. Without insurance we lose our certifications, and without certifications we lose our contracts. A burned plant can be rebuilt; an uninsurable company simply disappears from the market, and with it, a small, necessary piece of every European aircraft.
Chapter 4:
THE REAL ENDGAME
I share my feeling of who might be behind this with Bruno. The attackers could have burned us down, yet they stole nothing, asked for no ransom, touched no data. Why so much noise for so little damage?
Chapter 4:
THE REAL ENDGAME
I share my feeling of who might be behind this with Bruno. The attackers could have burned us down, yet they stole nothing, asked for no ransom, touched no data. Why so much noise for so little damage?
Sure enough, the answer arrives a few days later, in an anonymous folder: a complete, well-written list of our weaknesses. It goes to regulators, to clients and, above all, to insurers.
The attack was simply designed to map our vulnerabilities, but that file was the real weapon.
Nobody will cover Aeromint anymore. Without insurance we lose our certifications, and without certifications we lose our contracts. A burned plant can be rebuilt; an uninsurable company simply disappears from the market, and with it, a small, necessary piece of every European aircraft.
Recovery takes time
Recovery takes months.
Chapter 5:
BELIEVED
Recovery takes months. We close every hole named in the file, and we prove that this was not carelessness but a determined adversary. In the end the insurers come back, carefully, and at a higher price.
In Brussels, they are rewriting the law so that machines have to consult each other before they strike, and the Dog is back on its leash. And I actually get rewarded by the board for making a “company-saving decision.”
My mother named me Cassandre, after the woman in Greek legend whom nobody believed. This time, in the middle of the night, a stranger on an emergency line listened to me, and a factory is still standing because of it.
THIS IS NOT THE END
This was a Sopra Steria cyber-fiction: a projection into a possible future, drawing on the perspectives of our experts to explore how emerging risks might evolve. The characters, companies and events are entirely fictional.
These are exactly the questions Sopra Steria works on every day, from securing AI systems and data integrity to threat intelligence, identity and access management, governance and compliance, and incident response. To go further, we have created an activity board to explore these scenarios hands-on. Try it with your team, or get in touch and let's work through it together. You'll find it below our expert’s comment.
