Industrial AI drives new approach to OT cyber security

IoT Analytics said industrial companies are reshaping operational technology security as IT and OT networks converge and industrial AI deployments widen cyber attack surfaces.

The research group set out five trends linked to IT/OT convergence and AI integration. It described a move away from closed industrial environments and towards security designs that assume connectivity across plants, cloud services and corporate networks.

Industrial executives have highlighted AI and IT/OT convergence as priorities for operations and investment. IoT Analytics said the same changes increase the range of systems exposed to cyber risk and increase the need for controls that fit industrial constraints such as long asset lifecycles and limited patching options.

It said companies increasingly rely on hybrid security architectures. These mix central oversight with controls that stay on site. The organisation said this approach replaces more monolithic models that either concentrate controls in one place or rely heavily on isolated networks.

IoT Analytics linked the architectural shift to resilience requirements. It said on-site security functions matter when plants face connectivity disruption or when organisations keep certain controls local for operational reasons.

Segmentation focus

One trend highlighted a rise in zero trust microsegmentation. IoT Analytics described this as the use of logically defined communication boundaries around assets. It said organisations use it to reduce risk when they cannot patch older equipment or when downtime restrictions limit maintenance windows.

The organisation also pointed to the renewed role of firewalls at the boundary between enterprise IT and industrial environments. It said firewalls act as a control layer at the IT/OT convergence point, sometimes referred to as Level 3.5 in Purdue model discussions.

IoT Analytics said firewalls in these deployments apply policy enforcement based on inspection of OT protocols. It framed the technology as a practical enforcement point as industrial networks become more connected and data moves between plants and IT systems.

AI in security

The analysis described AI integration inside OT security programmes. IoT Analytics said AI tools increasingly profile network behaviour and correlate plant-level signals with IT telemetry. It said organisations also apply AI in incident response procedures.

It also highlighted a separate shift towards securing AI workloads used in industrial settings. IoT Analytics said security perimeters now extend to AI models and training data. It said organisations consider threats such as data poisoning and model misuse.

The organisation framed this as an expansion of what OT security teams must cover. It said industrial security programmes now track not only devices, networks and engineering workstations, but also the data pipelines and model artefacts used by AI systems.

Regulatory pressure

IoT Analytics tied the changes to European regulatory and governance requirements. It cited the Cyber Resilience Act and the NIS2 Directive as factors shaping investment decisions and reporting expectations.

It said governance obligations and software bill of materials practices have become a board-level topic for organisations with industrial operations and connected product environments.

"For years, OT security depended on staying closed. Now IT/OT convergence and industrial AI are opening industrial environments by design, backed by executive sponsorship and clear operational upside," said Knud Lasse Lueth, CEO, IoT Analytics.

"The attack surface expands materially unless segmentation and governance keep pace. For companies that do not modernize their OT security while investing in Industrial AI and IT/OT converged systems, the consequences could be costly", said Lueth.

European rules have also changed how organisations justify spending on OT cybersecurity, according to IoT Analytics. "Across industrial security, the CRA and NIS2 have moved the focus from 'should we invest' to 'how fast can we prove compliance.' With governance obligations and SBOM transparency now enforced, OT cybersecurity has become a corporate requirement with direct executive accountability", said Justina Alexandra Sava, Analyst, IoT Analytics.

IoT Analytics said the combination of hybrid architectures, microsegmentation, perimeter controls at IT/OT junctions and AI security measures will shape security roadmaps as industrial AI adoption continues and more plants connect operational systems to enterprise and cloud environments.