Dragos's September 2026 post has a small but striking scene. While responding to a breach at a government body, they watched an attacker with no OT knowledge or intent consult an AI model. The model noticed that the compromised system was an interface down to a water utility; it then listed the vendors in use, the default configurations and the default passwords, unprompted. Dragos, 10 September 2026
AI reduces the effort needed to learn about the site. It does not instantly make the attacker a plant expert, but it can direct them toward an OT network they previously ignored. That is a useful starting point for deciding what the defense needs to change.
This article combines two sources: Dragos's observations on how AI changes the threat, and the SANS five critical controls that have been known for years. My conclusion is this: AI speeds up the attacker, but it does not change the foundation of the defense.
OT (Operational Technology) is the set of systems that run a plant's physical process: PLCs, SCADA, controllers. To understand an OT attack, the ICS Cyber Kill Chain (SANS) separates two stages: stage one is reconnaissance and getting into the network; stage two is actually taking over a device and changing the physical process. The Five Critical Controls are five prioritized OT defenses that SANS instructors Robert M. Lee and Tim Conway drew from real attack analysis. The emphasis is not "prevention" but active defense: not just building walls, but seeing, noticing and being able to respond.
What does AI change?
Dragos points to three effects: more attackers being directed toward OT, faster reconnaissance and vulnerability research, and increased incident frequency.
Dragos's post adds a balanced note: nothing they see today supports the idea that AI will independently reach out and bring down a power plant or a water system. This observation does not settle how AI could be used in every environment. What changes is the attacker's barrier and speed. Dragos, 10 September 2026
Concretely:
- The barrier drops. As in the opening scene, an ordinary IT attacker who knows nothing about OT learns the vendor, the default settings and the password from AI and gets pointed toward OT. What was once the work of a small set of experts opens to a far wider crowd.
- The speed rises. Dragos says AI-assisted vulnerability discovery has found "dozens of strong zero-days" across major OEMs, and that the time to build a working exploit from a vulnerability could shrink from 24-48 hours toward minutes.
- The frequency rises. Because the barrier is lower, Dragos expects more incidents.
Still, none of this is a new kind of attack. The same reconnaissance, the same lateral movement, the same default password. Just faster, and in more hands. That distinction is why the defense does not change.
Dragos's red team shows a further scene: a model given OT context can passively map an automation environment, recognize the vendor and system in use, and select a fitting exploit. This capability is not in today's public models, but it likely will be. In this demonstration, the model moves through the perimeter before mapping the environment passively. Removing internet exposure alone is therefore not a complete answer; access boundaries, monitoring and response need to work together.
What does not change: the five controls
When the attacker speeds up, people assume the defense must be rewritten too. But the SANS five critical controls came precisely from the real analysis of such attacks, and they work together against the threats above. Dragos / SANS, Five Critical Controls
- ICS incident response plan. A plan specific to OT, built around safety and operational continuity.
- Defensible architecture. A DMZ and segmentation between corporate IT and industrial systems.
- Network visibility and monitoring. Passively watching OT protocols to see assets and traffic.
- Secure remote access. Controlling vendor and remote connections, with strong authentication.
- Risk-based vulnerability management. Prioritizing patches by operational impact, not by CVSS score.
These five are not new; they were written years before the AI debate. The mapping below suggests where to start against each threat. The controls work together; one control does not fully resolve one threat.
Enlarge details
The control that answers each threat
Back to the opening scene. AI gave the attacker the water utility's vendor and default password. But for that information to pay off, what had to be open? A direct path from the corporate network to OT, a management interface reachable from outside, an unchanged default password. Each of these is what one control closes.
| What AI accelerates | The control that answers it |
|---|---|
| Pointing an IT attacker at OT, suggesting the IT-to-OT path | Defensible architecture: a DMZ, segmentation and verified access rules restrict the path from IT to OT. |
| Speeding up reconnaissance and mapping the environment | Network visibility: unusual scanning and connections can be detected on monitored network segments; coverage and detection rules matter. |
| Supplying vendor and default-password knowledge | Secure remote access: if the default password is changed and access is controlled, the knowledge alone is not enough. |
| Speeding up vulnerability discovery and exploitation | Risk-based vulnerability management: prioritizing by operational impact tells you what to close first in the flood. |
| Raising the frequency of incidents | ICS incident response plan: a ready, rehearsed plan defines who does what during an incident. |
In this example, access and permission conditions must also be met for the information to produce operational effects. Against a changed password, a segmented network and a monitored OT, the attacker "knowing what to do" does not, by itself, open the door.
In order, not all at once
You do not have to build all five controls at once; that is their strength. Dragos says the controls can be prioritized and sequenced to the organization's risk profile. Usually you start with the first, the incident response plan; a high-risk plant may start with the third, visibility. Even a small, less mature team can move along this path. Dragos / SANS, Five Critical Controls
In the age of AI this prioritization matters even more. Because the first thing AI accelerates is reconnaissance, and the first thing that answers it is visibility. If you cannot see what is talking on your site, how fast the attacker learns with AI is already a secondary question.
Our question
Knowing how these five controls work at your plant is a useful starting point before choosing another tool. This is the question I would ask in the field:
Which of these five controls is weakest at your plant, and what happens if AI points an attacker straight at it?