AI is dominating conversations in the OT security community. How are the attackers going to use AI? How will AI help in the SOC and other defenders’ tools? Important? Yes, and I’m afraid the OT security community is not working on an equally important issue.
How is AI going to change the environment we need to secure?
I brought this up in my Connect keynote at S4x26, and again last week in The Coming Storm Of Connections at OTCEP in Singapore. Manufacturing is leading the way in using a combination of agentic and generative AI to get business wins quickly and cheaply. Projects that would have taken years are being done in a couple of weeks or months. The ROI is greatly increased, because the I, the investment, is dramatically lower. This will happen in almost every other sector and the company you work in or support.
We, the OT security community, need to get smart very fast on how we will secure agent-to-agent, agent-to-tool, and other AI connections. How will we implement least privilege? How will we determine and implement an information protection policy. (Yes, the C in CIA is now important even in OT.)
We’ve seen what happens if we’re not ready. It gets deployed without security because it’s a proof-of-concept, and then a pilot, and then rolled out without security because OT is a closed environment. The latter is less true than ever because the whole purpose of many industrial AI projects is to share data, and sometimes and someday configuration and control, outside of the classic OT boundaries.
I suggest you go to the Ignition Community Conference or some other similar manufacturing event near you to see these projects, the speed in which they are done, and the benefits they offer. They will happen. Will you be ready to secure them?