Four changes to the curriculum

Automated attackers. In November 2025 Anthropic reported a state-sponsored campaign, tracked as GTG-1002, in which an AI agent performed reconnaissance, vulnerability discovery, exploitation, credential harvesting and lateral movement largely autonomously, with humans stepping in at only a handful of decision points. Google's Threat Intelligence Group reported malware that calls LLMs during execution to generate commands or rewrite itself. Trainees should see, in the lab, how fast an automated attacker moves through a flat network, and why segmentation and monitoring buy time.

AI-generated social engineering. ENISA's Threat Landscape 2025 found that AI-supported phishing made up more than 80% of observed social-engineering activity by early 2025, and that phishing was the leading initial intrusion vector. OT staff, contractors and OEM technicians need exercises built around realistic, well-written lures, not the misspelled examples of a decade ago.

AI inside the plant. As AI assistants and optimizers enter engineering and operations software, trainees need to understand prompt injection, tool misuse and over-trust. The OWASP Top 10 for Agentic Applications, published in December 2025, is a useful syllabus outline. One exercise I recommend: give trainees an AI assistant connected to a simulated HMI, plant a malicious instruction in an alarm description, and see who notices.

Validating AI output. Anthropic noted that the attackers' AI frequently overstated its findings and sometimes fabricated them. Defenders who use AI for log triage or vulnerability analysis face the same problem. Teaching trainees to verify every AI claim against packets, logs and the physical process is now a core skill.

The demand signal is clear

ISC2's 2025 Cybersecurity Workforce Study found that AI was the most-cited skills need among cybersecurity professionals, at 41%. Among AI competencies, AI-enabled threat detection and response was mentioned most often (42%), followed by threat modeling and risk assessment (39%). The December 2025 joint guidance on AI in OT from CISA, the Australian Signals Directorate and partner agencies puts "understand AI," including educating personnel on AI risks, as its first principle.

Training is also a compliance line item

In Europe, AI literacy is now a legal matter. Under the EU AI Act, the obligations on AI literacy have applied since 2 February 2025, so organizations that deploy AI systems must take measures to ensure their staff have a sufficient level of AI literacy. For an operator introducing AI into OT, that literacy has to include the OT-specific risks above. European employers also face NIS2 training duties for management bodies.

In the US, NERC CIP-004-7 requires security awareness at least once each calendar quarter and role-based cyber-security training at least once every 15 calendar months for anyone with access to covered systems. Few utilities use that cycle to teach real control-system attack and defense, let alone AI-assisted attacks. Municipal water and transit operators have no equivalent mandate, which is a reason for state and city governments to fund shared training labs.

A modern OT security curriculum, in brief

• Process and control fundamentals with real controllers and protocols.
• Attack labs, including an AI-accelerated intrusion scenario.
• Defense labs: segmentation, monitoring, host hardening, incident response.
• An AI module: agentic risks, prompt injection, AI-generated phishing, validating AI output.
• A simulated replica of the organization's own plant for drills and patch testing.
• Train-the-trainer, so the knowledge stays in the organization.

Attackers are investing in AI to move faster. The answer is not to give up on hands-on engineering skills. It is to combine them with a clear understanding of what AI changes, on both sides.

Originally published at ilanshaya.com.

I wrote an ICS security course that has been taught in Singapore in a three-week version, and that was adapted in Japan to a two-week version taught to DNP, which then trained 84 cyber police officers from every prefecture. That experience gave me a clear view of what works. The structure that has held up best is a sequence of three phases.

Phase 1: control first

Trainees who do not understand the process cannot defend it. The first phase covers ICS architecture and components (PLCs, RTUs, DCS, SCADA, HMI, historians, safety systems) and the I/O and sensor networks underneath them. Trainees work hands-on with controllers from several major vendors and their engineering environments. They compare ladder logic across platforms, locate PLCs on a LAN with ARP and port scanning, and read and force memory registers with a Modbus tool. They capture and parse Modbus TCP and EtherNet/IP traffic in Wireshark, install and configure an OPC server, and build an HMI operator console.

If a trainee has never forced a register on a live controller in a lab, they will not appreciate how little stands between a compromised workstation and the process.

Phase 2: attack

The second phase teaches the common attacks an adversary would use against a victim's control network: protocol abuse, interception of unprotected communications and remote-access links, HMI and OPC manipulation, historian vulnerabilities, and attacks that start in the corporate IT network. A key learning objective is to watch the physical behavior of a control system under attack, not just the packets. A valve that opens at the wrong moment teaches more than a packet capture.

Phase 3: defend

The third phase covers industrial firewalls, IDS and SIEM in an OT context, physical protection of PLCs, HMIs and historians, security policies and standards such as IEC 62443 and NIST SP 800-82, and a structured incident response plan. The one-week format ends with a capstone: each trainee designs and builds a conceptual SCADA network on a training kit, with a security architecture they must then defend.

Labs, ranges and simulation

Physical lab kits are irreplaceable for the feel of a real controller, but they do not scale to a whole plant. A simulation and training platform, often called an OT cyber range, virtualizes the organization's own environment, with its network devices, PLCs, RTUs and SCADA HMIs. It adds three things. Teams can test attack scenarios and run risk assessments without touching production. They can test patches safely before applying them to the plant. And they get realistic material for incident-response drills. For operators that cannot afford a minute of downtime, that last point is often the business case.

Train the trainers

One more lesson matters more than the rest. In Singapore the course is still taught three weeks at a time. In Japan, the DNP instructors we trained went on to teach the police cyber units themselves. That is the outcome to aim for, because it is the only way the skills scale beyond the first class.

If you are planning OT security training for your own team, the ICS security course describes the programme in more detail, and a first call is free.

Next in this series: what AI changes in the curriculum, and why regulators now expect AI literacy too.

Originally published at ilanshaya.com.