Topic starter
24/06/2026 10:45 pm
TL;DR: NSA and CISA guidance on integrating AI into OT says organizations need strong authentication, integrity protection, and auditability because AI agents can make autonomous decisions with physical consequences, according to DigiCert. The trust model now has to follow the actor, not just the system, or operational automation becomes an identity problem.
Editorial analysis by NHI Mgmt Group, based on content published by DigiCert: “New Guidance on AI’s Integration into Operational Technology”.
Key questions
Q: How should security teams govern AI systems that can act without human approval?
A: Security teams should govern autonomous AI the same way they govern other high-risk identities, but with runtime enforcement instead of periodic review.
Q: Why do AI agents create more risk than traditional automation?
A: AI agents create more risk because they can interpret context, choose actions, and invoke tools autonomously.
Q: What should teams check first when AI is being added to OT environments?
A: Start with where identity is asserted, how outputs are verified, and whether certificate or trust lifecycle controls can keep pace with the operational tempo.
Practitioner guidance
- Map AI-controlled OT flows to identity checkpoints Identify every place where an AI component influences a machine, sensor, or control decision, then require a verifiable identity assertion before that action can take effect.
- Bind AI agents to cryptographic credentials Assign certificates or equivalent trust anchors to AI models, agents, and decision engines so actions can be authenticated and traced across OT workflows.
- Automate certificate lifecycle controls Use renewal, revocation, and policy enforcement automation so trust does not depend on humans keeping pace with AI-driven operational timelines.
Bottom line: AI in OT changes the trust problem from system control to actor identity, because models and agents can now make operational decisions with physical consequences.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
25/06/2026 7:34 am
Cryptographic identity is the missing control plane for AI in OT: This article is not really about automation efficiency. It is about whether an AI actor can be proven trustworthy before it affects a physical process. When AI can interpret inputs, choose actions, and trigger responses, OT governance needs a verifiable identity layer, not just orchestration logic. The practitioner conclusion is that trust must become actor-scoped, not system-scoped.
A question worth separating out:
Q: What is the difference between automation controls and cryptographic identity in OT?
A: Automation controls manage how work happens, while cryptographic identity proves which actor is allowed to do it and lets the organisation verify that the action is authentic. In AI-enabled OT, the second control is what keeps automation from becoming an ungoverned decision-maker.
👉 Read our full editorial: AI in OT needs cryptographic identity, not just automation