Frontier AI for critical infrastructure needs human judgment

At a glance

What this is: NHI Mgmt Group's analysis, drawing on Nozomi Networks's blog post: Frontier AI can improve OT investigation and defence, but critical infrastructure still depends on human judgment, asset context and operational constraints that IT-style security models do not account for.

Why it matters: This matters because IAM, NHI and broader security teams increasingly need to govern AI-assisted decision-making in environments where safety and availability outrank speed, and where the wrong automated action can interrupt essential services.

Context

Operational technology security is shaped by constraints that are rare in IT: long-lived devices, limited maintenance windows, heterogeneous protocols and a high cost for interruption. Those conditions make standard patch-and-modify security models difficult to apply, especially when assets cannot be fully inventoried or taken offline for investigation.

The identity and governance angle is now broader than user access alone. As frontier AI starts to support investigation and triage in critical infrastructure, teams must decide how to control machine-assisted analysis, what decisions remain human-owned, and how to preserve safety context when tools such as API key management and asset visibility underpin operational trust.

Key questions

Q: How should security teams govern AI-assisted infrastructure automation?

A: Treat AI-assisted automation as a privileged workload with constrained scope, logged actions, and mandatory human review for identity or network changes. The key control is not whether the assistant can generate valid code. It is whether the resulting workflow preserves least privilege, isolates credential state, and fails safely when assumptions are wrong.

Q: Why do OT environments need different risk management than IT environments?

A: OT environments control physical processes, so the security outcome includes safety and operational continuity, not just data protection. Many devices are long-lived, hard to patch, and built around proprietary protocols. That makes standard IT security assumptions unreliable and forces security teams to govern availability, change windows, and process integrity differently.

Q: What breaks when AI recommendations ignore process and safety context?

A: When AI recommendations omit process state, maintenance windows or device dependencies, defenders can act on incomplete signals and make unsafe changes. In critical infrastructure, that can turn a useful alert into an availability or safety problem because the recommendation is technically plausible but operationally wrong.

Q: Who should own decisions when frontier AI is used in critical infrastructure security?

A: Operational decisions should remain with accountable human specialists, while AI supports analysis, correlation and prioritisation. Ownership sits with the team that understands the environment, the failure modes and the cost of getting a live response wrong.

Technical breakdown

Why OT visibility and patching assumptions break down

Industrial environments often contain devices that are decades old, vendor-diverse and built around availability rather than frequent modification. That means defenders cannot rely on the IT assumption that every asset is quickly discoverable, patchable or safely isolated for investigation. Maintenance windows may be annual, not weekly, and many systems cannot be interrupted without affecting physical operations. The security problem is therefore structural: the control environment is constrained by engineering reality, not by a lack of diligence. Practical implication: treat visibility gaps and patch latency as operating conditions that shape control design, not as temporary exceptions. See the OT Security Guide.

Practical implication: Design OT controls around constrained maintenance and incomplete inventory, not around IT patching assumptions.

How frontier AI changes OT investigation workflows

Frontier AI can help analysts correlate documentation, protocol behaviour and threat research faster than a small OT team can do manually, especially when the environment contains unfamiliar devices or custom protocols. The value is not autonomous defence. It is assisted reasoning that helps experts test hypotheses, compare signals and narrow down likely causes without losing context. In practice, this shifts AI from a generic automation layer to an investigative support layer that depends on human oversight. Practical implication: define exactly which triage, enrichment and summarisation tasks AI may perform before it influences operational decisions. See the Threat Actor Groups Guide.

Practical implication: Use AI to accelerate investigation, but keep operational decisions and response authority with human specialists.

What agentic AI means for critical infrastructure governance

Nozomi’s reference to an agentic AI assistant shows that the governance problem is no longer just model output quality. When an AI system participates in alert analysis or remediation guidance, it becomes part of the security control path and must be governed like a privileged operational assistant. That means visibility into what it saw, what it recommended and when a human approved or rejected the output. In critical infrastructure, this is especially important because a mistaken recommendation can affect uptime or safety. Practical implication: govern AI-assisted operations with explicit approval boundaries, logging and accountability for every high-impact action.

Practical implication: Apply approval boundaries and auditability to AI-assisted OT workflows before they influence remediation actions.

Threat narrative

Attacker objective: The objective is to degrade the reliability and resilience of critical infrastructure without triggering timely detection or safe containment.

1. Entry occurs through the operational constraints of legacy OT environments, where defenders have limited inventory, limited patching and limited ability to inspect systems in place.
2. Escalation happens when attackers exploit obscurity, heterogeneity or delayed remediation to move from a weakly understood asset to an environment-wide operational risk.
3. Impact is disruption to safety, availability or resilience in the systems that support energy, water, transportation, manufacturing or similar critical services.

Breaches seen in the wild

• Colonial Pipeline ransomware attack: A dormant VPN account with a leaked password and no MFA let DarkSide shut down a major US fuel pipeline for six days.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Frontier AI in critical infrastructure is a governance problem before it is a tooling problem. The article is strongest when it frames AI as a support layer for specialised defenders, not a substitute for operational expertise. In environments where safety and uptime matter, the real question is who retains decision authority when AI helps interpret unfamiliar systems or attacks. Practitioners should treat AI-assisted triage as controlled augmentation, not delegated control.

OT security still fails first on visibility and change tolerance, not on lack of ambition. The article describes a world where defenders cannot fully inventory, quickly patch or casually take systems offline. That means many common IT security assumptions collapse before controls even start. The field should stop treating these environments as underprotected versions of IT and instead recognise them as a distinct governance model with different operating limits.

Human judgment remains the control that keeps frontier AI safe in cyber-physical systems. Nozomi’s own use of agentic AI points to a broader industry pattern: AI can accelerate analysis, but it also sits closer to the decision path than traditional analytics. In critical infrastructure, that raises the bar for auditability, approval and operator accountability. Practitioners should insist that any AI recommendation can be explained, challenged and overruled before it changes the state of a live environment.

The emerging concept here is operational context preservation. In OT, context is not a nice-to-have layer around alerts, it is the control surface that determines whether a recommendation is safe to act on. AI that strips away maintenance windows, process state or device dependencies creates false confidence. The industry will need to govern AI on whether it preserves context, not just whether it detects patterns. Practitioners should measure AI value by safer decisions, not faster alerts.

Read next: OT Security Guide

What this signals

Operational context preservation: The next governance challenge for AI in critical infrastructure is not model capability, but whether the system preserves maintenance windows, device dependencies and safety state in every recommendation. If those factors are absent from the workflow, AI may accelerate analysis while degrading decision quality. Practitioners should treat context loss as a control failure, not a usability issue.

Critical infrastructure programmes will increasingly need to test AI tools against live-operational constraints rather than laboratory accuracy. That means validating how AI behaves when asset inventories are incomplete, protocols are obscure and remediation carries physical consequences. The organisations that will use frontier AI safely are the ones that can prove it still works when the environment is messy.

For practitioners

• Map OT assets and dependencies before introducing AI-assisted workflows Document the systems, protocols, maintenance windows and safety dependencies that determine what AI can safely analyse or recommend in production environments.
• Define human approval gates for AI-assisted remediation Set explicit thresholds for when an analyst may accept, reject or escalate AI-generated findings, especially where action could affect uptime or physical safety.
• Use AI for enrichment, not autonomous response Limit AI to summarisation, correlation and hypothesis generation until the organisation has tested logging, auditability and operator override paths.
• Build cross-functional operational threat sharing Bring operators, OEMs, integrators and security researchers into a repeatable sharing process so protocol knowledge and attack patterns are not trapped in separate silos.

Key takeaways

• Frontier AI can help OT teams investigate unfamiliar systems faster, but it cannot remove the operational constraints that define critical infrastructure security.
• The hardest problem in this article is not detection accuracy, it is preserving safety and uptime while AI supports analysis and remediation.
• Human approval, auditability and context preservation are the controls that determine whether AI improves resilience or adds operational risk.

Related NHI Mgmt Group resources: OT Security Guide · Threat Actor Groups Guide · Colonial Pipeline ransomware attack

Key terms

• Operational Context Preservation: The practice of keeping the environmental facts that make a security decision safe and valid, such as maintenance windows, process state and device dependencies. In OT and critical infrastructure, a correct technical finding can still be the wrong operational answer if context is stripped away.
• Augmented Investigation: A human-led analysis model where AI helps correlate documentation, protocol behaviour and threat research without making the final decision. It shortens time to understanding, but the analyst remains responsible for interpreting the result in the environment where action will occur.
• Critical Infrastructure Risk: Critical infrastructure risk is the chance that a failure, attack, or disruption will impair essential services such as energy, water, transport, communications, healthcare, or finance. It includes cyber, physical, supply chain, and human factors, and is assessed by impact on safety, continuity, national security, and economic stability.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, agentic AI identity and workload identity. It is a fit for practitioners who need to connect identity control to broader security decisions.