Securing Industrial AI & OT Systems

Production, safety, and data: what an attack on a plant puts at risk, and why plants are targeted as of September 2026.

In this lesson:

• Name what an attack on a plant puts at risk
• Explain why connected plants attract attackers as of September 2026
• Recognize how an office incident can stop a production line

What's different about operational technology, the layers of a plant, and where IT and OT meet.

In this lesson:

• Contrast IT and OT priorities
• Describe the layers of a plant's systems
• Identify the points where IT and OT connect

Faster reconnaissance, better phishing, and deepfaked instructions, and the signals that still work.

In this lesson:

• Describe how AI helps attackers as of September 2026
• Replace fading red flags with signals that still work
• Respond to a deepfaked instruction with verification

Poisoned data, manipulated models, and hijacked tools, described conceptually, and the controls that protect plant AI.

In this lesson:

• Treat plant AI systems as assets to protect
• Describe AI-specific risks conceptually
• Apply the controls that protect plant AI

Remote access, integrations, and data exposure: the risks that come through trusted people and partners.

In this lesson:

• Identify weak points in vendor remote access
• Distinguish accidental from deliberate insider risk
• Describe a well-controlled vendor remote session

Credentials, removable media, remote access, and updates: the habits every shift owns.

In this lesson:

• Apply credential and account habits on the floor
• Handle removable media and devices safely
• Describe how updates are handled the plant way

The floor versions of social engineering, the urgent call from 'corporate', and the pause-verify-report habit.

In this lesson:

• Recognize the forms social engineering takes in a plant
• Identify the signals in an urgent request
• Apply pause, verify, report

Approved tools, what never goes into a public AI tool, and using AI for troubleshooting without creating risk.

In this lesson:

• Distinguish approved AI tools from public ones
• Identify plant data that never goes into a public tool
• Use AI help for troubleshooting safely

The protocol before anything changes on a line, legitimate changes versus red flags, and why AI recommendations follow the same rules.

In this lesson:

• Apply the four-step protocol before a change
• Separate legitimate change requests from red flags
• Treat AI recommendations as proposed changes

What to report, the first-hour steps, and why a reporting culture beats a blame culture.

In this lesson:

• Recognize what should be reported
• Follow the first-hour steps
• Contribute to a reporting culture

Plant operations, controls engineering, IT, security, vendors, and leadership: who owns what, and how shared ownership works.

In this lesson:

• Describe who owns which part of OT security
• Apply the practices that make shared ownership work
• Spot an ownership gap before it becomes an incident

Safety first, containment, communication, and recovery, and what makes a plant's plan different from an office's.

In this lesson:

• Follow the order of plant incident response
• Explain what makes a plant plan different
• Communicate correctly during an incident

The questions to ask before connecting anything, extra questions for AI and cloud vendors, and a hidden way out.

In this lesson:

• Ask the core questions before equipment connects
• Ask the extra questions AI and cloud vendors require
• Handle unexpected connectivity in new equipment

Three anonymized incidents and the control that mattered in each.

In this lesson:

• Connect each case to the control that mattered
• Recognize prevention that would have been simpler than detection
• Apply the lessons to your own plant

The one-page map, the checklist, and your next shift; the finale.

In this lesson:

• Build a one-page map of your systems, connections, contacts, and fallback
• Run the personal OT security checklist
• Complete Securing Industrial AI & OT Systems