OT Security Breaks the IT Playbook, and AI Agents Make It Worse

On 7 April 2025 somebody logged into the remote control panel for the Risevatnet dam at Bremanger in western Norway, forced a discharge valve fully open and walked away. It ran for about four hours at roughly 500 litres per second before an operator noticed and closed it by hand. Around 7.2 million litres went through. No zero-day. No malware. A control interface reachable from the internet and a password weak enough to guess.

That is OT security compressed into one incident. The failure was not cryptographic and it was not clever. It was architectural, and the architecture had been that way for years before anyone looked at it.

IT security has spent three decades building good instincts. Patch quickly. Encrypt everything. Assume breach. Kill the session when something looks wrong. Carry that kit onto a plant floor and most of it fails or does damage. The priority order is inverted. The equipment outlives the people maintaining it. And the protocols underneath were designed for a world where the network cable was the access control.

Why OT security inverts the IT priority stack

IT ranks confidentiality, integrity, availability, usually without arguing about it. OT flips the order. Safety first, then availability, then integrity, confidentiality a distant fourth. NIST wrote this into SP 800-82 Revision 3 in September 2023: control system incident response has to prioritise maintaining or restoring safe operation above every other objective. Isolating an infected host is textbook IT practice. Do it to a running process without calling operations first and you cause the upset you were trying to prevent.

Patching breaks the same way. A continuous process plant may get one or two planned shutdowns a year, and between them "can we take that controller down for fifteen minutes" is not a negotiation. Dragos reviewed every ICS vulnerability disclosed through ICS-CERT and NVD in 2025 and found 2 percent warranted immediate action. Twenty-six percent of advisories shipped with no patch or mitigation from the vendor. Twenty-five percent carried an incorrect CVSS score. Sort by severity and work down the list, and you generate mostly noise.

Then the clock. A PLC installed this year will plausibly still run in 2046, long after the commissioning engineer retires and possibly after the vendor stops existing. I grew up around Nigerian businesses generating their own power because the grid would not hold, and availability there was never a service level target. It was whether the shift happened. Plant managers reason identically. Downtime has a cost per hour that finance already knows. A breach has a cost nobody has modelled. One of those numbers is already in the spreadsheet.

A PLC has no login prompt because in 1979 the door to the building was the login prompt.

Modbus was never meant for a network you do not own

Modicon published Modbus in 1979 for serial links between a controller and the devices bolted beside it. The specification has no authentication, no encryption and no integrity check on commands. That was not an oversight. The security boundary was the building. Anyone who could write to a holding register had already passed the gate and opened a locked cabinet.

Forty-seven years later the same protocol runs over TCP on networks that touch corporate IT, which touches the internet. Anyone with Wireshark and a route reads every register in plaintext. Anyone with pymodbus and a route writes to one. There is no intermediate step where the device asks who you are, because the device has no concept of who.

In January 2024 that stopped being theoretical for 600 apartment buildings in Lviv. The malware Dragos named FrostyGoop exploited nothing. It spoke Modbus TCP to controllers at a municipal district heating utility and issued valid commands, then downgraded controller firmware to a version without monitoring so operators lost visibility. Remediation took nearly two days in sub-zero temperatures. The protocol behaved exactly as specified throughout.

Secure variants exist: Modbus/TCP Security, DNP3 Secure Authentication, OPC UA with certificate-based sessions. Adoption is slow for an unglamorous reason. The installed field devices do not speak them, and replacing field devices is a capital project rather than a patch.

The Purdue model and why flat networks happen anyway

Theodore J. Williams and the Industry-Purdue University Consortium for Computer Integrated Manufacturing published the Purdue Enterprise Reference Architecture in the early 1990s. ISA-95, later IEC 62264, inherited its numbering. Level 0 is the physical process. Level 1 is sensors and PLCs. Level 2 is HMIs and supervisory control. Level 3 is MES and the historian. Levels 4 and 5 are site and corporate IT. The DMZ everyone calls Level 3.5 was bolted on later by security people, not by Williams.

IEC 62443 turned that picture into requirements: zones and conduits, four security levels defined by the capability of the attacker they resist, and seven foundational requirements running from identification and use control through restricted data flow to resource availability. The series is still moving. A second edition of 62443-2-1 arrived in 2025 restructured around Security Program Elements, ISA published TR62443-2-2 on protection schemes in December 2025, and IEC issued PAS 62443-1-6 because IIoT devices do not fit the level model cleanly.

None of it stops networks going flat, because nobody flattens a network deliberately. It happens by accretion. A vendor needs a tunnel for warranty support. A quality engineer needs historian data on a laptop. The MES needs to write recipes down rather than only read counts up. A vision system arrives with a cellular modem already fitted and the integrator forgets to mention it. Every exception is individually reasonable and individually approved. Five years later the diagram on the wall and the traffic on the wire have nothing in common.

Where flow genuinely only needs to go one way, buy hardware that can only go one way. A unidirectional gateway is a transmitter and a receiver with a physical medium between them and no return path. The US Nuclear Regulatory Commission requires precisely this in Regulatory Guide 5.71: one-way flow from higher to lower security systems, implemented in hardware. Firewalls are not the problem. A firewall rule is a configuration, and configurations get edited at 2am by someone solving a real production problem. A diode has nothing to edit.

Vendor remote access is the door that actually gets used

Colonial Pipeline is the case everyone cites and most people slightly misremember. DarkSide affiliates were inside the network from 29 April 2021 through a dormant legacy VPN account with a leaked password and no multi-factor authentication. Colonial found the ransomware on 7 May and shut down a pipeline moving roughly 2.5 million barrels a day. The control systems were never compromised. The business systems were. The company could not bill, so it stopped pumping. Unloved remote access path, physical consequence.

That path is common. A 2025 study by Cyolo and Takepoint Research found 88 percent of manufacturers allow third-party remote access into OT environments, and 60 percent grant it to more than 100 separate external parties. Marlink's 2026 remote operations report found over half of assessed organisations rely on third-party access that is not centrally monitored, with 69 percent of observed risk tied to exposed or compromised credentials. SANS survey data traces the shape over time. External remote services fell from 36.7 percent of reported initial vectors in 2021 to 23.7 percent in 2024, compromise in IT that opened a route into OT rose to 45.3 percent, and supply chain compromise climbed from 14.3 percent to 30 percent by 2025.

On a line in Dongguan a couple of years ago I watched a maintenance technician debug a palletiser by plugging his laptop into a spare port inside the control cabinet. A remote desktop client was already open in his tray, because the integrator who wrote the ladder logic sat three hours away in another province and letting him drive beat describing the fault by phone. The cabinet had a lock. The key hung on a nail beside the hinge. Nobody there was careless or untrained. The path existed because the alternative was a stopped line, and a stopped line is a number somebody has to explain by Friday.

The fix is procedural before it is technical. Time-boxed sessions requested per job instead of standing tunnels. Access scoped to one asset rather than one subnet. Recording, so review is possible. Credentials belonging to a named person rather than to a vendor company. None of it is hard. All of it is friction, and friction loses to a stopped line unless someone senior decided in advance that it would not.

Asset inventory is the unglamorous prerequisite

Every control above assumes you know what is on the network. Most plants do not. Marlink's 2026 assessment work found 30 to 40 percent of OT assets initially unknown or undocumented, more than 70 percent of sites carrying undocumented or poorly secured connections to external networks and fewer than 25 percent with OT security ownership clearly assigned to anyone.

The payoff is measurable. Dragos put average adversary dwell time in OT at 42 days across 2025. Organisations with comprehensive OT visibility averaged five days. That gap is not a product. It is knowing what normal looks like, which requires knowing what is there.

Passive discovery off a span port gets most of the way without touching a device, which matters because active scanning has knocked over PLCs that were never built to receive unexpected packets. Inventory does not get funded because it produces a spreadsheet. Nobody presents a spreadsheet to a board. Everybody presents a dashboard, and the dashboard is fiction if the spreadsheet was never built.

What changes when an AI system gets write access

Look first at what adversaries already do. Dragos tracked 119 ransomware groups with reach into industrial organisations during 2025, up from 80 in 2024, hitting roughly 3,300 organisations, with manufacturing more than two thirds of victims. The tradecraft matters more than the volume. Dragos reported that the group it calls KAMACITE systematically mapped control loops across US infrastructure between March and July 2025. Mapping control loops is not data theft reconnaissance. It is process manipulation reconnaissance, done by people willing to do engineering homework.

Read-only analytics is the easy case and a genuinely valuable one. Vision inspection at the line. Anomaly detection over historian data. Vibration models for predictive maintenance. The model sits above the DMZ, consumes a one-way feed and writes nothing back. Get the direction right and the worst case is a bad prediction plus some leaked process know-how.

Write access is a different object. An agent reordering the schedule changes what the plant does. An agent adjusting a setpoint changes the process. An agent generating control logic changes what the plant is capable of doing. Siemens ships an Engineering Copilot for TIA Portal that produces SCL and ladder logic from natural language and inserts it into the open project. That shape is defensible, because a human still compiles and downloads. The failure mode is not the tool. It is month ten, when the generated code has been fine often enough that review becomes a scroll and a click.

CISA, NSA and the national cyber agencies of Australia, Canada, New Zealand and the UK published Careful Adoption of Agentic AI Services on 1 May 2026, the first joint Five Eyes guidance aimed at autonomous agents. Five risk categories: privilege compromise, design and configuration flaws, behavioural misalignment, structural cascading failures and supply chain vulnerabilities. Their headline position is deliberately conservative. Keep agentic deployments on low-risk, non-sensitive tasks until controls mature.

The OT version of the problem is sharper than the general debate. An agent's behaviour is a function of its inputs, and in a plant those inputs include text nobody treats as security-relevant: work order descriptions, maintenance notes, supplier emails, tag names typed by a contractor in 2013. Prompt injection against an agent that can write to a scheduler is a control system integrity failure wearing natural language as a costume. The mitigation is not a better prompt. The agent proposes and something deterministic authorises, with the approval logic outside the model, where nothing the model emits can reach it.

The strongest argument against everything above

The objection worth taking seriously is not that air gaps are a myth. It is that Purdue describes a world that stopped existing. Purdue assumed data moves up one level at a time. An IIoT sensor with a cellular modem talks straight to a cloud endpoint and skips levels 2, 3 and 4 in one hop. IEC did not publish PAS 62443-1-6 in 2025 for entertainment. It published because the level model does not cleanly describe IIoT devices and the committee knows it. Enforce strict hierarchical segmentation and you forfeit most of the value that made anyone want to connect the plant.

The competitive form of that argument is stronger, and I watch it run from here. China installed 295,000 industrial robots in 2024, 54 percent of a global total of 542,000, taking its installed base past two million units. Domestic Chinese robot makers held 57 percent of their home market that year, up from 47 percent in 2023. Guangdong set a target of digitally restructuring 50,000 manufacturing enterprises by 2025. The plants I walk through are not debating whether to connect. They connected. They are measuring the result, and the ones that did it carefully are cheaper per unit than the ones that did not.

Hierarchy and direction are different controls and people keep merging them. Depth of hierarchy is negotiable. A modern plant does not need six tiers and a hop count. Direction of flow is not negotiable. Telemetry pushing out and a command pushing in are different risk objects even when one vendor sells both and the diagram draws them as a single line. Collapse the levels and keep the actual claim, which was never about counting tiers: the set of paths capable of writing into the physical process must be small, named and individually defensible. That survives IIoT. It survives agents. It gets harder to honour every year, which is not the same as being wrong.

The twenty-year problem nobody has solved

A controller commissioned this year will still be turning something in 2046. Whatever it accepts as an instruction from anything that reaches it, it will still accept in twenty years, from attackers using tools that do not exist yet. The defence gets designed once, at commissioning, against the threat model of 2026. The attack gets two decades of iteration.

The standard answer is compensating controls, which is correct and insufficient at once, because a compensating control is usually a firewall rule and a firewall rule is a sentence somebody can edit at 2am.

The part I cannot resolve sits at the seam. Every mitigation here ends with a person. A human approves the vendor session. A human reviews the generated logic. A human notices the setpoint drifted. And the reason anyone is putting AI into operations at all is that humans are the bottleneck. Both claims are being made at once, by the same people, in the same budget cycle. The first plant to remove the human from the approval loop will not have an incident. Neither will the tenth. The industry will locate that boundary the way it locates every boundary, and there will be a date attached, and the date will appear in somebody's year in review with a threat group name beside it.

Tools referenced

Siemens Industrial Copilot, reviewed here: Siemens Industrial Copilot review.

LangGraph, reviewed here: LangGraph review.

Temporal, reviewed here: Temporal review.

NVIDIA NeMo Guardrails, reviewed here: NVIDIA NeMo Guardrails review.

Langfuse, reviewed here: Langfuse review.

garak, reviewed here: garak review.

Sources

Dragos 2026 OT Cybersecurity Year in Review (press release): https://www.dragos.com/resources/press-release/dragos-2026-year-in-review-new-ot-threats-ransomware

NIST SP 800-82 Rev. 3, Guide to Operational Technology (OT) Security: https://csrc.nist.gov/pubs/sp/800/82/r3/final

CISA and partners, Careful Adoption of Agentic AI Services: https://www.cisa.gov/resources-tools/resources/careful-adoption-agentic-ai-services

SecurityWeek: FrostyGoop ICS malware left Ukrainian city without heating: https://www.securityweek.com/frostygoop-ics-malware-left-ukrainian-citys-residents-without-heating/

Cybersecurity Dive: Colonial CEO says hackers exploited legacy VPN: https://www.cybersecuritydive.com/news/colonial-Joseph-Blount-ransomware-legacy-vpn/601523/

WaterISAC advisory on the Municipal Water Authority of Aliquippa incident: https://www.waterisac.org/tlpclear-water-utility-control-system-cyber-incident-advisory-icsscada-incident-municipal

ISA: update to the ISA/IEC 62443 series, security protection schemes: https://www.isa.org/news-press-releases/2025/december/update-to-isa-iec-62443-series-includes-guidance-o

IFR World Robotics 2025, China press release: https://ifr.org/downloads/press_docs/2025-09-25-IFR_press_release_China_in_English.pdf