How Emerging Threats Are Changing OT Security

Presented by Booz Allen

Operational technology brings cybersecurity into the physical world. The systems that support infrastructure control processes and equipment whose disruption can affect safety, availability, and the mission itself. As advanced AI changes how attackers discover and exploit weaknesses, the time available to protect those systems is shrinking. In How Emerging Threats Are Changing OT Security, David Forbes, Director, Cyber Physical Defense at Booz Allen, joins Francis Rose to examine what that shift means for government agencies and infrastructure operators.

Forbes describes a threat environment defined by speed, scale, and autonomy. Activities that once depended on specialized teams, multiple tools, and planning can increasingly be pursued by AI agents. The concern is the combination of rapid discovery, persistent execution, and the ability to adjust when an initial approach fails. For defenders responsible for operational systems, those capabilities raise questions about whether established workflows can identify and contain an intrusion before it affects the equipment or processes the organization depends on.

To explore those questions, Booz Allen tested frontier and open AI models in eight scenarios at its OT cybersecurity lab in Northern Virginia. Forbes reports that the agents achieved their objectives in each scenario. He describes agents entering unfamiliar environments, identifying paths to industrial controls, and reaching positions from which they could create physical consequences. These are findings from laboratory scenarios. Their significance in the conversation is what they suggest about the pace and adaptability that OT defenders must prepare to face.

One example illustrates the speed involved. Forbes says an agent reached industrial controls in just over 16 minutes. Another demonstrates the connection between a network intrusion and a physical outcome: an agent gained access to a robotic arm and moved it in front of lab personnel. A third highlights adaptation. After encountering resistance on a supervisory control and data acquisition application, an agent changed its attack path and developed a new payload. Together, the demonstrations show why visibility and containment matter before a threat reaches operational equipment.

That compressed timeline changes the defensive problem. Forbes argues that organizations cannot expect manual triage, vulnerability identification, and response to keep pace with threats operating at machine speed. A team may still be determining what happened while an attacker is already moving toward a consequential action. His argument is that defenders need capabilities and processes suited to the speed of the threat. The practical question becomes how to close the gap between detecting activity, understanding its significance, and interrupting the path to mission impact.

Forbes identifies two priorities: assume breach and contain the attack path. An initial foothold should not provide unrestricted access across an operational environment. Limiting lateral movement can help constrain what an attacker can reach and reduce the chance that a compromise spreads into critical processes. He describes an attack-to-defend approach that uses advanced AI against the same kinds of paths an adversary might exploit. In the interview, he also discusses a Booz Allen capability intended to support that approach while minimizing disruption to the network.

Operational continuity is central to that discussion. OT equipment cannot always be taken offline for a security intervention without creating another problem. A defensive action may affect a process or introduce safety concerns. Forbes therefore connects stronger protection to the need to preserve operations. The goal is to interrupt malicious activity while accounting for the function of the system being defended. That requires attention to how equipment is used, what it supports, and what a disruption would mean for the people responsible for the mission.

Legacy technology adds another constraint. Forbes notes that OT systems can remain in service for 20 to 30 years. Replacing equipment on an enterprise IT timetable may be impractical, making compensating controls especially important. He points to microsegmentation and zero trust as ways to create protective boundaries around systems and limit access to industrial controls. These measures give operators ways to strengthen protection around existing equipment while they consider longer-term modernization. Their usefulness depends on how they support the operational environment and reduce opportunities for an attacker to move.

For government leaders, the discussion connects an emerging threat to immediate planning priorities. Understand where an intrusion could lead, contain movement toward consequential systems, and assess whether defensive processes match the pace of the attack. Forbes presents zero trust and segmentation as foundations for preserving mission effectiveness as advanced AI expands adversary capabilities. The challenge is to bring greater speed and precision to defense while respecting the safety and availability requirements that make operational technology different from conventional information systems.

Three Key Takeaways

• Prepare for faster, adaptive threats. Forbes describes controlled lab scenarios in which AI agents reached industrial controls, moved physical equipment, and adjusted their approach after resistance.
• Contain the path to mission impact. Assume breach and limit lateral movement so an initial compromise does not provide broad access to operational systems.
• Protect legacy equipment while preserving operations. Compensating controls, microsegmentation, and zero trust can strengthen defenses around systems with long service lives.

Explore the Ideas Behind the Program

This interview is part of Reimagining Cyber: At Velocity, presented by Booz Allen and inspired by its Velocity magazine. Continue exploring insights on cybersecurity, emerging technology, and federal missions.

Read Velocity at BoozAllen.com/Velocity.