Topic starter
11/11/2026 6:01 pm
TL;DR: AI-supported detection in OT remains probabilistic because it interprets symptoms rather than seeing unauthorized change directly, according to Crytica Security. That leaves operators deciding whether to trust an alert before they can safely isolate a device or interrupt a process.
Editorial analysis by NHI Mgmt Group, based on content published by Crytica Security: “AI in Cybersecurity and RDAi™: Faster Uncertainty Is Still Uncertainty”.
Key questions
Q: Why does behavioural AI struggle in OT monitoring?
A: Behavioural AI struggles in OT monitoring because industrial devices and processes are designed to be predictable, so normal operation often looks repetitive rather than richly varied.
Q: How does deterministic detection differ from anomaly detection?
A: Deterministic detection looks for known conditions, rules or state deviations, such as an unauthorised firmware checksum or a prohibited PLC command.
Q: How should teams detect unauthorized change in OT devices?
A: Teams should detect unauthorised change by comparing the device state itself, such as firmware hash, configuration, logic, mode and approved setpoints, against a trusted baseline.
Practitioner guidance
- Monitor for unauthorized instruction-set changes Place detection logic at the device boundary so the alert is triggered by additions, deletions, or modifications that occur outside approved change management.
- Separate triage from isolation decisions Require a deterministic device-level event before taking disruptive response actions in OT or IoT environments, especially where service interruption has physical consequences.
- Test whether current tooling sees state or symptoms Validate whether network logs, status responses, and external telemetry are only inferring compromise, then document where that leaves blind spots in embedded assets.
Bottom line: AI can speed up cybersecurity analysis without eliminating the uncertainty that comes from inferential detection models.
Glossary terms: Operational Technology, Instruction Set, IoT device, Anomaly Detection
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
11/11/2026 6:06 pm
Faster analysis does not remove uncertainty from OT detection: AI can accelerate triage, but when the underlying signal is behavioural it still leaves operators with a probability judgment. In OT and IoT, that is a governance problem as much as a technical one because response decisions can affect physical processes. Security teams need a detection model that turns suspicion into a verifiable event before they act.
A question worth separating out:
Q: What happens when OT alerts are based on external telemetry only?
A: If OT alerts rely only on external telemetry, they can miss what the asset itself is doing, including local logic edits, mode changes, unauthorised firmware loads and operator actions taken outside the monitored network path. External feeds are useful, but they need correlation with device state, controller logs and change records to avoid blind spots.
👉 Read our full editorial: Deterministic device change beats AI inference in OT detection