AI vulnerability detection in OT security: can teams trust the results?

TL;DR: Frontier-model-assisted vulnerability hunting in OT security software can surface hundreds of candidates, according to Dragos, but 60 to 90 percent of raw findings die before human review because most lack reachability, valid trust boundaries, or proof. The real problem is not discovery volume but verification discipline: without a threat model and refutation gates, signal quality collapses and defenders trust noise.

Editorial analysis by NHI Mgmt Group, based on content published by Dragos: “Refuted by Default: Dragos’ Methodology for AI-Driven Vulnerability Detection in OT Security Software”.

Key questions

Q: What breaks when AI detection has no current threat intelligence?

A: The main failure is false confidence.

Q: Why do AI-generated vulnerability reports create more triage friction than value?

A: They create friction because models can produce fluent attack narratives without confirming target state, exploitability, or version fit.

Q: What are the signs that an AI remediation pipeline is failing?

A: Look for repeated PRs on low-value findings, conflicting severity signals, manual triage after the agent has already acted, and unresolved issues that never make it into the pipeline.

Practitioner guidance

• Build a threat model before large AI-assisted hunts Map trust boundaries, entry points, privileged operations, and existing mitigations before you let agents generate candidates, so verifiers evaluate claims against the same system context.
• Separate recall from verification Use one stage to generate broad candidate coverage and a different stage to refute claims with a bare hypothesis, so persuasive reasoning does not bias the skeptic.
• Require reproducible proof in an isolated environment Only accept findings that reproduce from clean state against pinned builds or replicas, because plausible prose is not evidence of exploitability.

Bottom line: AI-assisted vulnerability discovery in OT security software creates a trust problem as much as a detection problem.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →