What AI changes in OT security training
Automated attackers, AI-written phishing and assistants inside engineering software change what an OT defender has to practise.
In my previous post I described a three-phase course for OT defenders: control, attack, defend. The hands-on core still works. What has changed is the threat, and the training has to move with it.
Four changes to the curriculum
Automated attackers. In November 2025 Anthropic reported a state-sponsored campaign, tracked as GTG-1002, in which an AI agent performed reconnaissance, vulnerability discovery, exploitation, credential harvesting and lateral movement largely autonomously, with humans stepping in at only a handful of decision points. Google's Threat Intelligence Group reported malware that calls LLMs during execution to generate commands or rewrite itself. Trainees should see, in the lab, how fast an automated attacker moves through a flat network, and why segmentation and monitoring buy time.
AI-generated social engineering. ENISA's Threat Landscape 2025 found that AI-supported phishing made up more than 80% of observed social-engineering activity by early 2025, and that phishing was the leading initial intrusion vector. OT staff, contractors and OEM technicians need exercises built around realistic, well-written lures, not the misspelled examples of a decade ago.
AI inside the plant. As AI assistants and optimizers enter engineering and operations software, trainees need to understand prompt injection, tool misuse and over-trust. The OWASP Top 10 for Agentic Applications, published in December 2025, is a useful syllabus outline. One exercise I recommend: give trainees an AI assistant connected to a simulated HMI, plant a malicious instruction in an alarm description, and see who notices.
Validating AI output. Anthropic noted that the attackers' AI frequently overstated its findings and sometimes fabricated them. Defenders who use AI for log triage or vulnerability analysis face the same problem. Teaching trainees to verify every AI claim against packets, logs and the physical process is now a core skill.
The demand signal is clear
ISC2's 2025 Cybersecurity Workforce Study found that AI was the most-cited skills need among cybersecurity professionals, at 41%. Among AI competencies, AI-enabled threat detection and response was mentioned most often (42%), followed by threat modeling and risk assessment (39%). The December 2025 joint guidance on AI in OT from CISA, the Australian Signals Directorate and partner agencies puts "understand AI," including educating personnel on AI risks, as its first principle.
Training is also a compliance line item
In Europe, AI literacy is now a legal matter. Under the EU AI Act, the obligations on AI literacy have applied since 2 February 2025, so organizations that deploy AI systems must take measures to ensure their staff have a sufficient level of AI literacy. For an operator introducing AI into OT, that literacy has to include the OT-specific risks above. European employers also face NIS2 training duties for management bodies.
In the US, NERC CIP-004-7 requires security awareness at least once each calendar quarter and role-based cyber-security training at least once every 15 calendar months for anyone with access to covered systems. Few utilities use that cycle to teach real control-system attack and defense, let alone AI-assisted attacks. Municipal water and transit operators have no equivalent mandate, which is a reason for state and city governments to fund shared training labs.
A modern OT security curriculum, in brief
- Process and control fundamentals with real controllers and protocols.
- Attack labs, including an AI-accelerated intrusion scenario.
- Defense labs: segmentation, monitoring, host hardening, incident response.
- An AI module: agentic risks, prompt injection, AI-generated phishing, validating AI output.
- A simulated replica of the organization's own plant for drills and patch testing.
- Train-the-trainer, so the knowledge stays in the organization.
Attackers are investing in AI to move faster. The answer is not to give up on hands-on engineering skills. It is to combine them with a clear understanding of what AI changes, on both sides.