Do you have a question? Want to learn more about our products and solutions, the latest career opportunities, or our events? We're here to help. Get in touch with us.
Operational technology environments underpin essential services across critical infrastructure including energy, water, transport and manufacturing. As organisations modernise these systems with cloud connectivity, remote access and AI-driven analytics, the convergence of IT and OT is accelerating, bringing real benefits for efficiency and decision-making, but also changing the cybersecurity risk profile in ways that traditional governance models were not designed for.
We spoke to David Stafford-Gaffney, Associate Director – Cybersecurity Consulting at Datacom, about how AI is reshaping both the threat landscape and the opportunity for critical infrastructure, what IT/OT convergence means for cyber-physical security, and how organisations can build operational resilience without slowing down modernisation.
In critical infrastructure, cyber risk is not really about the cyber. It is about consequence.
Whether a weakness in software can affect the operation of a physical system. Whether an operational issue can escalate into a safety, continuity, environmental, or national resilience problem. That is the context in which artificial intelligence needs to be discussed, not AI in isolation, not OT in isolation, not IT in isolation, but as one connected risk surface. AI is changing the speed at which risk moves across that surface.
In any critical infrastructure environment, separating IT and OT security into distinct domains creates a false boundary. IT helps the organisation navigate, communicate and make decisions. OT drives the operation itself, the physical processes that deliver essential services.
These are different disciplines with different priorities and different expertise. But they should not operate as separate security domains. The concept should be that there is one system and one consequence. With critical infrastructure it is no different: you do not secure IT and OT separately, you secure the whole system.
When organisations do that well, three fundamentals matter: visibility, sound architecture and secure access. That is where maturity starts.
OT has always been cautious about IT methods and often for good reason.
IT tends to optimise for speed, scale and change, while OT tends to optimise for stability, repeatability and safe operation. Those cultures differ because they were built around different consequences. If a data system fails, that is serious, the impact of personal, health or financial data loss should not be diminished. But if a water treatment process or a safety-instrumented system is caused to fail, the consequence is categorically different. Safety of life is a real consideration in critical infrastructure protection.
When OT teams push back on IT approaches, that is not always resistance to change. Sometimes it is operational judgement refined over decades. Organisations should respect that and build from it.
Industrial environments have always evolved. Steam engines gave way to mass production assembly lines, then electronic automation, then smart connectivity that linked the plant to enterprise systems. AI is now bringing decision support and human-machine collaboration onto the plant floor.
The next step may be what some are calling cognitive cyber-physical operations, systems that sense, learn, adapt, and optimise with increasing autonomy. Whether we label that Industry 6.0 or something else is less important than recognising the trajectory. Cyber is no longer a layer sitting above the industrial process. It is becoming part of how that process is monitored, maintained and, increasingly, controlled.
Yet, most critical infrastructure is not being upgraded at the same pace. Legacy control systems often still work, and the barrier is that they are expensive to replace and deeply embedded in operations. So, organisations modernise around them, adding remote access, vendor support portals, cloud analytics, wireless connectivity and data exports into business systems. Much of that is necessary and truly beneficial for efficiency, reliability, reporting and decision-making.
The problem is that a legacy control system may not have changed in twenty years, but its exposure has. When connectivity increases without equivalent increases in visibility and control, risk grows with it. Without visibility, organisations operate on assumption rather than evidence.
AI will punish assumptions. It moves faster than assumption-based governance can respond.
Frontier AI, a term that will eventually just become AI, is reshaping the threat landscape for critical infrastructure in three distinct ways.
AI compresses the time between weakness, exploitability, and consequence. Where traditional exploit development could unfold over months or years, AI-assisted approaches are collapsing that window to hours. Faster reconnaissance, AI-guided exploit selection, automated code generation, and more attack paths tested in parallel. The kill chain compresses, and weak hygiene, exposed access, and poor visibility become far less forgiving.
AI reduces the specialist knowledge needed to operate with greater capability. This does not mean every low-skill attacker suddenly becomes an OT expert. Industrial environments are complex. Physical processes are specific. Engineering knowledge still matters, but the distance between gaining network access and causing a controlled physical effect is shrinking. AI helps attackers move faster through unfamiliar territory, interpreting network traffic, identifying control system patterns, and suggesting next steps without the operator needing years of industrial experience. A significant portion of OT security has historically relied, at least partly, on the assumption that attackers do not understand the environment and that this disconnect creates a barrier, but that assumption is becoming less reliable.
This is the OT-specific concern that should be getting far more attention. The risk is not only that AI can find software vulnerabilities. The risk is that AI can help turn access into operational understanding. It does not need to comprehend an entire plant to be dangerous. It only needs to learn enough of the control behaviour to interfere with confidence, and the most dangerous interference is the kind that looks operational rather than malicious. That is where this stops being a cybersecurity conversation and becomes a safe operations conversation.
While most organisations have adopted AI in some form – personal assistants, efficiency tools, policy development – very few have adapted their security and governance practices to match.
Almost no organisations are documenting agentic AI data flows. Most are not recording AI systems as configuration items. Few know where AI-related credentials are being used or have mapped AI access paths across their environments. Monitoring AI behaviour, distinguishing normal output from something manipulated, adapting vulnerability management programmes to account for AI-assisted discovery, these remain edge cases rather than standard practice.
This matters for OT because the living-off-the-land techniques that sophisticated threat actors already favour now have a force multiplier. AI can help discover OT gateways, learn connection patterns, understand access management configurations, identify partner connections, and map key personnel. None of that requires custom malware, just patience, access and a reasoning engine.
A system that can act autonomously needs boundaries.
The practical priorities for critical infrastructure leaders have not changed: segment high-consequence systems, validate asset inventories and network visibility, confirm controls for secure remote access, and test incident response with every stakeholder from the executive to the engineering floor. But the margin for deferral has narrowed dramatically. AI compresses the window between a vulnerability existing and that vulnerability being exploited.
The most important shift may also be the simplest: cyber-physical security belongs inside health, safety, security, and environment policy. It is not a parallel IT concern that occasionally touches operations. It is operational risk and it always has been.
Guidance, recommendations and reports alone will not get us there. What separates organisations that are prepared from those operating on borrowed time comes down to honest answers to a few uncomfortable questions.
How much of the current security posture is built on evidence, and how much rests on assumptions that have never been tested?
Which cyber access paths, remote access, vendor portals, cloud integrations, could realistically become a safety or operational consequence?
When cyber does affect operations or safety, who actually owns that consequence today?
If those questions do not have clear answers, that is probably the most useful finding of all.
Datacom's cybersecurity consulting team works with critical infrastructure organisations across Australia and New Zealand to assess risk, build resilience and close the gaps between IT and OT security.
