Artificial Intelligence in Critical Infrastructure SOCs: Force Multiplier – Attack Surface and Operational Resilience Through 2030

Strategic Cybersecurity, Operational Technology and Critical Infrastructure Intelligence Assessment

Scope: This assessment examines the operational, technological, adversarial and regulatory consequences of integrating artificial intelligence into Security Operations Centres protecting energy, maritime, subsea, transport and industrial-control infrastructure, with a verified baseline through 3 November 2026 and three prospective pathways for 2028–2030, covering the European Union, Italy, France, Germany, the United Kingdom and relevant international security frameworks.

Executive Summary / Bottom Line Up Front

Principal judgment — Medium confidence: Artificial intelligence is already a demonstrable force multiplier for selected cybersecurity tasks, particularly software vulnerability discovery, information processing and analytical support. It is not yet established as a net improvement in end-to-end operational resilience across safety-critical infrastructureSOCs (Security Operations Center). The distinction is consequential: faster processing of security information does not necessarily produce faster, safer or more accurate intervention in physical operations.

The strongest controlled evidence concerns automated vulnerability identification and remediation. In DARPA’s August 2025 AI Cyber Challenge, competing systems discovered 54 of 63 synthetic vulnerabilities (86%) and produced patches for 43, while also identifying 18 real vulnerabilities. These figures establish measurable technical capability under competition conditions, not validated reductions in production SOC detection or response times. AI Cyber Challenge Marks Pivotal Inflection Point for Cyber Defense — DARPA — Aug 2025.

Field incident data remain less conclusive. Mandiant’s March 2026 assessment of 2025 investigations reports 14 days of global median attacker dwell time, compared with 11 days in the previous reporting period, while the proportion of incidents first detected internally increased from 43% to 52%. Neither finding isolates AI’s causal contribution, and neither provides an OT-specific AI performance benchmark. M-Trends 2026 — Google Cloud/Mandiant — Mar 2026.

Adversarial judgment — High confidence: AI simultaneously increases offensive capability and creates new defensive dependencies. The UK National Cyber Security Centre’s 2026 assessment identifies AI-enabled acceleration of reconnaissance, vulnerability exploitation and attacks against legacy critical infrastructure as significant emerging risks. Its analysis also warns that AI deployments inside critical infrastructure introduce additional exploitable surfaces. Artificial Intelligence and Cyber Intrusion — UK NCSC — 2026.

Operational consequence: The defensible deployment model is bounded automation, independently validated detection, retained human authority over safety-significant actions and continuous assurance of the AI pipeline itself. Regulatory compliance supplies a necessary governance baseline but cannot substitute for demonstrated detection coverage, containment capability or safe physical recovery.

Decisive uncertainty — High confidence: Publicly accessible evidence does not establish a representative, independently verified improvement in mean time to detect, mean time to respond or false-negative rates attributable specifically to AI-enabled SOC deployments across energy, maritime and industrial-control environments.

Artificial Intelligence in Critical Infrastructure: Faster Cyber Defence, Greater Systemic Exposure and the Cost of Unverified Automation

Artificial intelligence is accelerating cybersecurity operations without yet demonstrating that it makes critical infrastructure more resilient. The distinction is becoming consequential for governments, regulators and operators responsible for electricity networks, industrial facilities, ports, subsea communications and transport systems. Controlled evaluations have established measurable advances in automated vulnerability discovery and remediation, while documented adversarial operations demonstrate that attackers are exploiting similar capabilities to accelerate intrusion. Yet independently verified evidence of sustained improvements in detection, safe containment and physical recovery remains insufficient. The resulting contradiction is institutional as much as technological: Europe is expanding cybersecurity and critical-infrastructure obligations while operators face growing pressure to automate systems whose failure can interrupt essential services. By 2030, the decisive advantage will belong not to organisations deploying the most artificial intelligence, but to those capable of proving that automation reduces operational risk without concentrating new vulnerabilities.

The Numbers Demonstrate Technical Progress, Not Infrastructure Resilience

The strongest quantitative evidence concerns capabilities developed under controlled conditions rather than independently observed results from production Security Operations Centres. In August 2025, the US Defense Advanced Research Projects Agency reported that systems participating in its AI Cyber Challenge identified 54 of 63 synthetic vulnerabilities, approximately 86%, and patched 43, while also discovering 18 real vulnerabilities and providing patches for 11. Automated patch generation averaged 45 minutes. These results establish substantial progress in software-security engineering, but they do not demonstrate equivalent improvements in live industrial monitoring, where incomplete telemetry, proprietary protocols, operational constraints and the consequences of erroneous intervention complicate detection and response. AI Cyber Challenge Final Results — DARPA, August 2025.

The distinction becomes clearer when controlled technical results are compared with incident-investigation evidence. In M-Trends 2026 — Google Cloud/Mandiant, March 2026, global median attacker dwell time reached 14 days in 2025, compared with 11 days in 2024, while the proportion of investigated intrusions initially detected internally increased from 43% to 52%. Exploitation accounted for 32% of initial infection vectors, and highly interactive voice phishing for 11%. These figures document changes in investigated attacks and detection practices, but their case population does not isolate artificial intelligence as the cause of improved or deteriorating performance.

The institutional consequence is a persistent measurement gap. Neither DARPA’s competition nor Mandiant’s incident investigations establish a representative, AI-attributable reduction in mean time to detect, mean time to respond or false-negative rates across energy, maritime and industrial-control SOCs. These are not secondary indicators: they determine whether earlier analytical recognition creates a usable interval for protective intervention. Procurement justified by faster triage or reduced analyst workload therefore remains economically incomplete unless the operator demonstrates that those gains translate into more effective containment and restoration.

Physical Infrastructure Exposes the Limits of Automated Cyber Decisions

The difference between enterprise cybersecurity and industrial resilience arises from the consequences of intervention. In a conventional information-technology environment, isolating a compromised endpoint can be an effective containment measure; within electricity generation, industrial production or maritime operations, interrupting a communications path may affect equipment supervision, legitimate engineering activity or essential operational functions. An accurate alert can therefore lead to an unsafe response if the system initiating containment lacks authoritative knowledge of the physical process. The Guide to Operational Technology Security, Revision 3 — National Institute of Standards and Technology, September 2023 establishes safety, reliability and operational performance as controlling considerations, while the initial public draft of Revision 4, published in September 2026, extends the treatment of contemporary industrial and transport environments.

The energy sector demonstrates why cybersecurity speed cannot be separated from engineering authority. An AI-supported SOC may correlate an unusual remote-access session with a controller configuration change, but the significance of that relationship depends on the equipment involved, the authorised maintenance procedure and the current operating state. Even successful containment does not establish recovery if configurations remain altered or process integrity cannot be independently confirmed. In June 2026, NIST’s Operational Technology Backup Quick Start Guide, SP 1339 addressed the importance of tested backups, configuration management and operational recovery, reinforcing the distinction between restoring digital availability and restoring a validated industrial system.

Maritime and subsea infrastructure extend this problem across organisational and geographic boundaries. Ports depend on terminal equipment, logistics platforms, contractors and communications providers, while subsea cables depend on landing stations, terrestrial networks, specialised maintenance and alternative routes. The European Commission’s EU Action Plan on Cable Security, adopted on 21 February 2025, was followed by the Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission, February 2026. This framework addresses prevention, detection, response and recovery across telecommunications and electricity cable infrastructure. Its significance for AI-enabled monitoring is that identifying abnormal digital conditions cannot substitute for physical fault confirmation, infrastructure redundancy or repair capability.

The industrial transmission mechanism is therefore straightforward: better cybersecurity analysis creates value only when it can be translated into an authorised intervention that preserves the physical service. An operator whose monitoring system depends on a shared cloud model, but whose local personnel cannot reconstruct the evidence or maintain essential functions during provider failure, may gain analytical efficiency while increasing operational dependence.

Offensive AI Is Compressing Intrusion Timelines While Defensive AI Creates New Targets

The emerging attacker–defender competition is characterised by the acceleration of established intrusion techniques rather than verified universal autonomy in attacks against industrial systems. In November 2025, Anthropic disclosed an AI-orchestrated espionage campaign involving approximately 30 targeted organisations, with successful compromises affecting a smaller number. The company’s investigation described agent-supported reconnaissance, vulnerability identification, exploitation and post-compromise activity, while attributing the operation to a suspected Chinese state-sponsored group. The findings provide first-party evidence of offensive automation, although the attribution and level of autonomy remain provider assessments rather than an independent measure of global adversarial capability. Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign — Anthropic, November 2025.

In September 2026, the Google Threat Intelligence Group documented an incident in which adversaries used agent-enabled processes to plan and execute mass credential harvesting in under six hours following cloud compromise. The same reporting examined attempts to manipulate AI-assisted coding and security-analysis workflows associated with software supply-chain activity. The operational implication is not that industrial systems can now be compromised within a universal six-hour period, but that attackers can compress selected stages of intrusion while defenders remain constrained by verification, remediation and engineering approval. GTIG AI Threat Tracker: From Prompting to Autonomy — Google Threat Intelligence Group, September 2026.

The defensive response introduces its own exposure. Training-data poisoning can alter analytical baselines; adversarial evasion can manipulate classification; prompt injection can redirect language-model-assisted investigations; and compromised model-serving infrastructure can affect multiple monitoring functions simultaneously. The Adversarial Machine Learning Taxonomy — NIST, March 2025 identifies these mechanisms while leaving their prevalence against production industrial SOCs unresolved. The risk becomes systemic when alert prioritisation, investigation and response depend on the same model, supplier or contaminated evidence source.

The commercial dimension is already observable. On 2 November 2026, Google Threat Intelligence Group and Mandiant reported incidents involving compromised access to language-model services, with fraudulent usage exceeding US$100,000 in one day in some cases and cumulative charges reaching US$1 million at certain organisations. These figures concern cloud and model-resource exploitation, not physical infrastructure damage. They nevertheless demonstrate that the AI services increasingly incorporated into defensive operations are themselves economically attractive targets. The Rise of LLMJacking — Google Threat Intelligence Group/Mandiant, November 2026.

European Regulation Expands Accountability Without Guaranteeing Detection

The European Union’s regulatory architecture creates overlapping but distinct responsibilities. Directive (EU) 2022/2555, or NIS2, establishes cybersecurity risk-management, management-accountability and incident-reporting obligations. Directive (EU) 2022/2557, concerning critical-entity resilience, addresses the continuity of essential services under broader physical and organisational threats. Regulation (EU) 2024/1689, the Artificial Intelligence Act, introduces requirements determined by an AI system’s intended purpose and legal classification. None establishes a universal obligation to purchase AI-enabled SOC technology, and compliance with one instrument does not demonstrate effectiveness under the others. NIS2 Directive — European Parliament and Council, December 2022; Critical Entities Resilience Directive — European Parliament and Council, December 2022; AI Act, Consolidated Text — European Parliament and Council, July 2026.

Implementation also differs across Europe’s principal industrial economies. Italy transposed NIS2 through Legislative Decree No. 138 of 4 September 2024, in force since 16 October 2024, with the Agenzia per la Cybersicurezza Nazionale serving as the competent national NIS authority. Germany’s NIS2 Implementation Act entered into force on 6 December 2025, followed by the KRITIS-Dachgesetz on 17 March 2026, creating a parallel framework for physical critical-infrastructure resilience. France maintains established national arrangements for protecting systems of vital importance while pursuing the legislative implementation of European cybersecurity and resilience requirements; the operative status of individual provisions must be distinguished from the contents of legislative proposals. Italian Legislative Decree No. 138/2024 — Repubblica Italiana; German NIS2 Implementation — Bundesamt für Sicherheit in der Informationstechnik; French Critical Infrastructure and Cybersecurity Legislative Dossier — Légifrance.

The United Kingdom operates under a separate framework established by the Network and Information Systems Regulations 2018, as amended, while pursuing further cybersecurity and resilience reform. The distinction matters commercially: multinational operators face differing reporting, governance and supervisory arrangements, but their shared suppliers and security platforms may create common operational dependencies across national boundaries. Regulatory convergence cannot eliminate that exposure without technical assurance of the underlying systems. Network and Information Systems Regulations 2018 — UK Legislation.

The Next Investment Cycle Will Reward Verified Resilience, Not Maximum Automation

Critical-infrastructure investment through 2030 will be shaped by three possible outcomes: governed AI producing a net defensive advantage, offensive and defensive capabilities advancing in rough parity, or poorly assured automation increasing systemic exposure. The Artificial Intelligence and Cyber Intrusion Assessment — UK National Cyber Security Centre, November 2026 identifies comparable conditional trajectories through 2028, including the risks associated with legacy infrastructure and newly deployed AI systems. The evidence does not support reliable numerical probabilities for these outcomes, but it identifies the operational conditions that distinguish them.

For procurement, the immediate consequence is that expenditure on AI models and automation licences cannot be evaluated independently of telemetry integrity, adversarial testing, supplier continuity, specialist personnel and recovery capacity. The US Department of Energy’s Cybersecurity Capability Maturity Model, Version 2.1, developed with input from 145 cybersecurity specialists representing 77 organisations, provides a framework for assessing these capabilities across operational and information-technology environments. Its significance lies in examining cybersecurity as an interconnected organisational capability rather than a collection of products. Cybersecurity Capability Maturity Model, Version 2.1 — US Department of Energy, June 2022.

The cost of inadequate assurance can also extend beyond the purchasing organisation. A shared provider failure can weaken monitoring across multiple operators, while an inappropriate automated intervention can affect transport, communications or energy services relied upon by external users. The European Commission’s 2026 Submarine Cable Security Toolbox and NIST’s 2026 OT Backup Quick Start Guide reflect the importance of dependencies and recovery, but neither provides evidence that AI deployment alone reduces these consequences. The investment test must therefore be based on measured security outcomes and demonstrated continuity during failure, not on the proportion of operations delegated to software.

The Cost of Inaction Will Fall on Operators, Essential-Service Users and Public Authorities

Over the next 12–24 months, from November 2026 through November 2028, the immediate financial and operational consequences will concentrate on three groups. Critical-infrastructure operators will bear the cost of maintaining vulnerable systems, validating new AI capabilities and correcting poorly designed integrations. Essential-service users and industrial customers will absorb the consequences of interruptions that effective monitoring, containment or recovery might otherwise have limited. Regulators and public authorities will face the cost of supervising increasingly interconnected systems without representative evidence that compliance-driven AI adoption has improved operational resilience.

The decisive choice is therefore not between artificial intelligence and conventional cybersecurity. DARPA’s 2025 AI Cyber Challenge demonstrated substantial progress in automated security engineering, while the documented adversarial activity of 2025–2026 established that similar technological advances can accelerate hostile operations. Europe’s cybersecurity and critical-entity legislation creates a stronger framework for accountability, but it cannot transform unverified automated decisions into reliable protection. Operators that fail to invest in independent detection validation, engineering oversight, supplier continuity and tested recovery may find that their SOCs become faster at producing conclusions without becoming more effective at protecting essential services. The resulting costs will appear in prolonged operational disruption, duplicated remediation expenditure, contractual exposure and the transfer of infrastructure risk to the wider economy.

Navigational Index

PILLAR I — OPERATIONAL EFFECTIVENESS AND ADVERSARIAL COMPETITION

• Chapter 1 — The Operational Baseline: AI Integration, Detection Physics and Verified Performance : Production SOC architectures, operational-technology telemetry, alert volumes, detection latency, response latency, automation boundaries, field measurements and evidentiary limits.
• Chapter 2 — The AI-Enabled Threat Environment: Dual-Use Capabilities and Attacker–Defender Balance : AI-assisted intrusion, exploit discovery, social engineering, living-off-the-land activity, telemetry manipulation, adversary adaptation and the relative operational advantage of offensive and defensive AI.

PILLAR II — SYSTEMIC EXPOSURE, HUMAN AUTHORITY AND REGULATORY ASSURANCE

• Chapter 3 — AI-Specific Attack Surfaces and Physical-Cyber Risk Transmission : Training-data poisoning, adversarial evasion, prompt injection, model extraction, model-serving compromise, dependency concentration, control-system interactions and consequences for physical safety.
• Chapter 4 — Human–Machine Decision Architecture and Institutional Maturity : Analyst allocation, autonomous triage, escalation protocols, skill retention, validation, accountability, automation complacency and operational organisational models.
• Chapter 5 — Regulatory Compliance Versus Demonstrated Operational Resilience : NIS2, critical-entity resilience, AI governance, maritime cybersecurity, sector-specific obligations, assurance evidence and separately assessed implementation capacity in Italy, France, Germany and the United Kingdom.

PILLAR III — STRATEGIC RESILIENCE, FUTURE PATHWAYS AND DECISION REQUIREMENTS

• Chapter 6 — Sector-Specific Resilience: Energy, Maritime, Subsea and Industrial Control Systems : Physical-process constraints, operational continuity, legacy installations, maritime and subsea dependencies, segmentation, supply chains and cross-sector consequences.
• Chapter 7 — Three Strategic Scenarios for 2028–2030 : Governed AI as a net force multiplier; attacker–defender capability parity; and systemic deterioration under poorly governed automation, with sectoral effects and observable transition indicators.
• Chapter 8 — Strategic Investment, Regulatory Options and Final Net Assessment : Technical validation, procurement assurance, skilled personnel, defensive architecture, regulatory supervision, performance thresholds, accountability, investment priorities and the final assessment.

Master Abstract

AI Is Improving Cybersecurity Tasks Faster Than Its Contribution to Infrastructure Resilience Can Be Independently Demonstrated

The strategic significance of artificial intelligence in critical-infrastructure cybersecurity is not reducible to improved alert classification or greater computational throughput. It concerns whether machine-assisted security operations can detect hostile activity, determine its operational significance and support effective intervention before digital compromise produces unacceptable physical consequences. The available evidence establishes substantial progress in automating discrete analytical tasks, including vulnerability discovery, code inspection and elements of incident investigation. It does not establish that these advances have produced a comparable, measurable improvement in the overall resilience of electricity networks, industrial plants, ports, maritime systems or subsea infrastructure. This distinction reflects differences between the speed of computational analysis and the operational conditions under which security interventions must be executed, validated and, where necessary, reversed.

The 2025 DARPA AI Cyber Challenge provides a particularly useful benchmark because its results were assessed under a defined competition structure, rather than relying solely on self-reported enterprise performance. The participating autonomous systems analysed more than 54 million lines of code and generated vulnerability patches in an average of 45 minutes. The results demonstrate an important improvement in automated security engineering while leaving unresolved the separate question of performance under live production telemetry, competing alerts, imperfect asset inventories and constrained operational authority. AI Cyber Challenge Marks Pivotal Inflection Point for Cyber Defense — DARPA — Aug 2025.

The Principal Operational Constraint Is the Relationship Between Detection, Decision Authority and Physical Consequence

In conventional enterprise networks, certain containment actions can be automated with relatively limited operational consequences. In industrial-control environments, however, isolating a system, terminating a session or interrupting communications may affect production continuity, equipment integrity, essential services or personnel safety. An AI-enabled SOC can therefore improve the identification of suspicious events while degrading resilience if its response authority exceeds the reliability of its situational understanding. The relevant performance measure is not simply the quantity of alerts processed or the time saved during initial triage, but the proportion of consequential intrusions detected early enough for safe intervention, together with the effectiveness and collateral effects of that intervention.

This creates a structural asymmetry between cyber detection and operational control. AI can correlate network communications, endpoint telemetry and identity behaviour without necessarily understanding whether an observed industrial deviation reflects malicious manipulation, planned maintenance, an equipment fault or an unusual but legitimate operating state. The difficulty becomes greater in legacy installations with incomplete telemetry, highly specialised protocols and limited opportunities for disruptive testing. Operational maturity therefore depends on combining machine-scale analysis with engineering knowledge, independently maintained process baselines and explicit human authority over actions affecting safety-critical systems.

AI Expands Both Adversarial Capability and the Infrastructure That Must Be Defended

The emerging threat environment is characterised less by entirely new categories of cyberattack than by changes in the cost, speed and repeatability of existing techniques. The UK National Cyber Security Centre’s 2026 reporting identifies artificial intelligence as an increasingly important multiplier for reconnaissance, vulnerability identification, social engineering and exploit development, while distinguishing these developments from fully autonomous, reliable end-to-end intrusion capability. The same assessment identifies the growing exposure of legacy critical infrastructure and the additional attack surface created by deploying AI systems inside those environments. NCSC Annual Review 2026 — UK National Cyber Security Centre — 2026.

This dual-use environment requires treating the defensive model, its data supply chain, its retrieval mechanisms, its external integrations and its execution permissions as security-relevant infrastructure. The US National Institute of Standards and Technology’s March 2025 adversarial-machine-learning taxonomy identifies evasion, poisoning, privacy-related attacks and generative-AI misuse as distinct risk classes. Those categories provide a technical basis for evaluating failure mechanisms, although their inclusion in a formal taxonomy must not be misinterpreted as proof that every technique has been successfully deployed against production industrial SOCs. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — NIST — Mar 2025.

Regulatory Convergence Does Not Eliminate Operational Divergence

The European Union’s cybersecurity and critical-entity resilience frameworks establish organisational duties relevant to essential services, supply-chain exposure, incident handling and continuity planning. The Artificial Intelligence Act introduces a separate, risk-based system whose applicability depends on the intended purpose, classification and legal status of the particular AI system. These instruments cannot be treated as imposing identical requirements on every SOC application, nor can the procurement of an AI-based monitoring product be regarded as evidence of compliance or resilience. The European Union’s critical-entity framework also recognises cross-sector dependencies and physical disruptions that may arise from natural, accidental or hostile causes, reinforcing the distinction between cybersecurity governance and the broader continuity of essential services. Directive (EU) 2022/2555 — European Parliament and Council — Dec 2022; Directive (EU) 2022/2557 — European Parliament and Council — Dec 2022.

The strategic outlook through 2030 consequently depends on the quality of operational governance rather than on the rate of AI adoption alone. Under robust assurance, bounded automation could extend detection coverage, strengthen analytical capacity and support earlier intervention. Under an approximate attacker–defender balance, defensive improvements could be offset by cheaper exploitation, more adaptive intrusion methods and persistent weaknesses in legacy assets. Under poorly governed automation, increasingly interconnected models and response systems could amplify common-mode failures, conceal residual compromises and produce unsafe responses. These pathways are conditional scenarios, not statistical forecasts. Their distinguishing variables are observable: independent detection tests, process-aware false-negative measurements, assurance of model updates, protection of the AI supply chain, recovery performance and the preservation of qualified human operational authority.

Key Evidence Table

The following evidence distinguishes verified technical performance, observed incident characteristics, regulatory obligations and unresolved operational outcomes. The absence of a defensible numerical estimate is treated as an evidence limitation rather than as evidence of no benefit.

Evidence classification: DARPA measurements are controlled technical results; Mandiant measurements are observational incident-investigation results from a nonrandom case population; Anthropic’s disclosures are first-party incident findings. The three missing SOC metrics cannot be reconstructed from the other measurements. DARPA+2

Comparative Assessment of AI-Enabled SOC Functions

The following assessment distinguishes established benefits from plausible operational applications. Maturity refers to the evidentiary strength of the relevant function in safety-critical SOC environments, not to its commercial availability.

These distinctions are consistent with the technical limits identified in DARPA’s controlled evaluations, NIST’s adversarial-machine-learning taxonomy and the UK government’s security requirements for AI systems, including human responsibility, security testing and ongoing monitoring. AI Cyber Challenge — DARPA — Aug 2025; NIST AI 100-2 — Mar 2025; Code of Practice for the Cyber Security of AI — UK Government — Jan 2025. DARPA+2

Competing Strategic Pathways Through 2030

Three plausible pathways describe how current capabilities could affect critical infrastructure protection. They are neither exhaustive predictions nor independently measurable probabilities. Their comparative standing concerns evidentiary support for the underlying mechanisms, not numerical likelihood.

The scenarios are informed by documented technical capabilities and threat assessments, particularly the UK National Cyber Security Centre’s 2026 assessment of AI-enabled intrusion trends and the risk posed by deploying AI inside critical infrastructure. Artificial Intelligence and Cyber Intrusion — UK NCSC — 2026. National Cyber Security Centre

No single pathway is established as the universal outcome. The evidence supports a conditional judgment: the same technological progress can improve defensive effectiveness or magnify systemic exposure depending on the reliability of the underlying monitoring architecture, the authority delegated to automation and the quality of independent assurance.

Principal Gaps and Watch Indicators

Detection Effectiveness and Operational Performance

The most consequential missing evidence concerns whether AI changes the probability of identifying harmful activity before an attacker can produce operational consequences. Commercially reported reductions in investigation duration cannot resolve this question without comparable baselines, consistent incident definitions, sufficiently complete ground-truth data and attribution of the improvement to the AI component rather than to simultaneous changes in staffing, architecture or detection rules.

The priority measurement should be AI-attributable improvement in detection and response under controlled operational comparison, supported by measurements of false negatives, false positives, analyst effort and time to safe containment.

Adversarial Manipulation and Model Assurance

NIST’s adversarial-machine-learning taxonomy establishes a structured basis for evaluating evasion, poisoning, privacy attacks and model misuse. The unresolved question is how often these techniques succeed against live, properly configured SOC systems, particularly when attackers can influence the telemetry or documents being analysed. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — NIST — Mar 2025.

Relevant indicators include the reproducibility of adversarial test outcomes, the proportion of model updates subjected to independent regression testing, detection of contaminated data, unauthorised tool execution and the frequency of model failures that escape ordinary security monitoring.

Physical-System Consequences

The principal unresolved safety issue is the relationship between automated cyber response and physical process stability. Detection effectiveness cannot be assessed independently of the operational consequences of intervention where security systems interact with industrial automation, energy management, maritime equipment or other essential service infrastructure.

Relevant evidence includes operator incident reports documenting cyber-induced process interruptions, engineering evaluations of automated containment, safety-system event logs and controlled exercises demonstrating whether a compromised SOC can be isolated without impairing essential operations.

Sectoral Dependence and Cross-Border Exposure

The maritime sector illustrates why cyber monitoring must be integrated with physical operational risk. The International Maritime Organization’s maritime cybersecurity framework addresses risks to shipping safety and operational continuity across interconnected digital and operational systems. Its published guidance is expressly concerned with risk identification, protection, detection, response and recovery, rather than any particular AI product or architecture. Maritime Cyber Risk — International Maritime Organization.

A corresponding evidence gap concerns the security dependencies between offshore installations, subsea communications infrastructure, port systems, industrial networks and externally managed monitoring services. The decisive monitoring indicators are common-provider concentration, resilience of communications under degraded conditions, independent recovery capability and the ability to maintain safe operations when AI-supported monitoring becomes unavailable.

Human Competence and Accountability

The organisational question is whether automation preserves the investigative knowledge required when an incident falls outside the model’s training distribution or available operating context. Decreasing routine workload can free analytical capacity, but may also reduce opportunities for analysts to exercise the skills needed during uncommon, high-consequence events.

Useful monitoring measures include human override effectiveness, analyst performance in blind adversary-emulation exercises, escalation accuracy, time required to reconstruct AI-generated investigative decisions and the frequency of unsafe recommendations detected before execution.

Regulatory Implementation and Operational Assurance

A relevant institutional distinction exists between the adoption of cybersecurity governance procedures and evidence that those procedures remain effective during sustained attack or operational disruption. ENISA’s June 2025 guidance provides practical implementation support for particular categories of entities subject to the NIS2 implementing regulation; it should not be assumed to apply identically to all sectors covered by NIS2. NIS2 Technical Implementation Guidance — ENISA — Jun 2025.

The principal indicators are independent exercise results, time to remediate critical findings, recovery performance under simulated compromise, supply-chain assurance and documentary evidence linking regulatory controls to observed security outcomes.

Initial Strategic Determination

Overall assessment: Conditional defensive advantage, without sufficient evidence for a universal net-resilience finding.

The decisive strategic distinction is between automation that improves the interpretation of security evidence and automation that assumes authority over consequential operational decisions. The former has an increasingly credible technical foundation. The latter requires substantially stronger proof of reliability, adversarial robustness and operational safety before it can be treated as an established

Investment decisions, regulatory assessments and operational procurement should therefore distinguish the demonstrated efficiency of individual AI functions from evidence of improved security outcomes across complete physical-cyber systems. The governing criterion is not whether an operator possesses AI-enabled monitoring, but whether that operator can independently demonstrate that the deployment detects consequential attacks, supports safe intervention, withstands adversarial manipulation and preserves essential services when the AI component fails.

01 / Executive Intelligence Judgment

A Conditional Defensive Advantage

AI has demonstrated measurable improvements in selected
cybersecurity engineering functions. The available
evidence does not establish a representative,
independently verified improvement in end-to-end
resilience across safety-critical operational
technology environments.

Strategic distinction:
Accelerated detection and triage do not automatically
translate into safe containment, successful recovery
or uninterrupted physical operations.
Overall assessment confidence: Medium.
02 / Verified Measurements

Operational Evidence

Controlled testing and observed incident data
Synthetic vulnerabilities discovered
54 / 63DARPA AI Cyber Challenge · 2025
Synthetic vulnerabilities patched
43 / 63Controlled competition results
Global median attacker dwell time
14 dMandiant · 2025 investigations
Incidents discovered internally
52%Mandiant · 2025 investigations
03 / Interactive 3D Evidence Comparison

Measured Capability Versus Operational Outcomes

Switch between datasets. Each graph uses its own
explicitly labelled scale and population.
Values must not be interpreted as directly comparable
AI-SOC performance indicators.

How AI Introduces New Operational Dependencies

The following is a conceptual risk-transmission
architecture, not a reconstruction of a specific
documented incident.

Telemetry and Data Supply Chain

Network flows, endpoint observations,
event logs, identity data, industrial telemetry,
retrieved documents and external threat feeds.

AI Models and Security Orchestration

Anomaly detection, prioritisation,
cross-mediated workflows

Human Decisions and Physical Systems

Escalation, containment, operational
continuity, engineering validation,
safety controls and recovery.

Potential propagation of compromised evidence
Data PoisoningCorrupted or manipulated observations alter
training, calibration or operational inference.
Adversarial EvasionMalicious patterns are modified to evade
model-based classification.
Prompt InjectionUntrusted content attempts to redirect
language-model-assisted investigations.
Model and Pipeline CompromiseModel artifacts, serving systems or
integrations become additional attack paths.
Automation Over-RelianceHuman oversight becomes ineffective when
outputs are accepted without verification.
Unsafe ContainmentAutomated interventions create potential
process disruption or physical consequences.
Required architectural boundary:
Model-generated assessments should not independently
authorise safety-significant operational interventions.
Critical responses require explicit decision authority,
validated playbooks and independent safety constraints.
05 / Interactive Strategic Scenario Explorer

Critical Infrastructure Security Through 2030

Select a scenario to examine its underlying conditions,
sectoral consequences and indicators.
These are conditional pathways, not probability forecasts.

AI as a Governed Force Multiplier

Independently validated detection and bounded
automation strengthen analytical coverage while
human operators retain authority over
safety-significant interventions.

Independent validationHuman authorityOT-aware monitoring

Critical sectors:
Energy, maritime, subsea and industrial systems
benefit from improved visibility, provided that
safe containment and recovery are verified.

Observable signposts:
Reproducible improvements in detection accuracy,
time to safe containment, model assurance and
physical recovery performance.

Conditional pathway · Confidence: Medium
06 / Governance and Decision Architecture

From Formal Compliance to Operational Resilience

NIS2 and sector-specific frameworks establish
risk management, incident handling, oversight
and resilience obligations. Applicability
depends on jurisdiction and entity classification.

Adversarial testing, change control,
telemetry integrity, segmentation,
model monitoring and independent
operational validation.

Verified detection coverage, safe containment,
qualified human oversight, continuity under
degraded conditions and effective recovery.

Compliance evidence is not a substitute for
operational outcome evidence. Procurement of an
AI-enabled SOC tool does not, by itself, demonstrate
better detection or response.
07 /

Verified Results and Critical Measurement Gaps

Filter the evidence by category or search for a metric.
Controlled technical tests and observational incident
statistics are deliberately kept separate.

Performance and assurance evidence available
at the November 2026 assessment cut-off.

Indicator	Value / Status	Source / Period	Interpretation
Synthetic vulnerabilities discovered	54 / 63	DARPA · Aug 2025	Controlled evaluation
Synthetic vulnerabilities patched	43 / 63	DARPA · Aug 2025	Controlled evaluation
Real vulnerabilities discovered	18	DARPA · Aug 2025	Competition findings
Real vulnerability patches submitted	11	DARPA · Aug 2025	Competition findings
Global median attacker dwell time	14 days	Mandiant · 2025 cases	Nonrandom investigated population; no isolated AI effect
Internally discovered intrusions	52%	Mandiant · 2025 cases	Internal discovery share; no AI-specific attribution
Exploitation as initial vector	32%	Mandiant · 2025 cases	Investigated intrusion population
AI-attributable production SOC MTTD	Not established	Cross-sector assessment	Representative independent estimate absent
AI-attributable production SOC MTTR	Not established	Cross-sector assessment	Safe operational response not quantified
OT AI detection false-negative rate	Not established	Cross-sector assessment	Representative ground-truth benchmark absent

08 / Documentary Reference Base

Primary and First-Party Sources

1. DARPA, August 2025:
   AI Cyber Challenge Final Results.
   Controlled autonomous vulnerability discovery
   and patching benchmarks.
2. Google Cloud / Mandiant, March 2026:
   M-Trends 2026.
   Investigated intrusion characteristics and
   dwell-time observations.
3. National Institute of Standards and Technology,
   March 2025:
   Adversarial Machine Learning: A Taxonomy
   and Terminology of Attacks and Mitigations.
4. UK National Cyber Security Centre, 2026:
   Artificial Intelligence and Cyber Intrusion.
5. European Parliament and Council, December 2022:
   Directive (EU) 2022/2555 — NIS2.
6. European Parliament and Council, December 2022:
   Directive (EU) 2022/2557 —
   Critical Entities Resilience.
7. International Maritime Organization:
   Maritime Cyber Risk.

OPEN-SOURCE ANALYTICAL ASSESSMENT

Assessment date: 3 November 2026
Strategic horizon: 2028–2030
Geographic and operational scope: European Union, United Kingdom, United States and internationally interconnected critical infrastructure, with particular attention to energy, maritime, subsea, transport and industrial-control environments.

Chapter 1 — The Operational Baseline: AI Integration, Detection Physics and Verified Performance

Principal Judgment: Analytical Acceleration Is Not Equivalent to Operational Resilience

Artificial intelligence is changing the technical organisation of cybersecurity monitoring, but the operational significance of that transformation remains considerably more differentiated than the general expansion of automated detection, language-model-assisted investigation and machine-driven security orchestration would suggest. In critical infrastructure, the principal analytical distinction concerns the difference between processing a security observation, recognising a hostile sequence of events, establishing its relevance to an industrial process and executing an intervention that preserves the continuity and safety of essential services. These functions operate under different constraints, require different evidence and cannot be measured through a single indicator of artificial-intelligence performance. A Security Operations Centre may reduce the time required to classify an alert while failing to identify the underlying compromise, or it may detect an intrusion correctly while remaining unable to intervene because containment would interrupt an industrial process whose operating state cannot safely be modified. Accordingly, the defensible measure of effectiveness is the ability to convert timely and reliable detection into an operational decision that reduces the probability or severity of a consequential incident without creating an additional physical hazard.

This distinction is supported by the established engineering characteristics of operational technology. The US National Institute of Standards and Technology identifies safety, reliability, performance and the physical consequences of system activity as essential considerations when securing industrial-control and related operational systems. Its September 2023 operational-technology security guide remains a final publication, while the September 2026 fourth-revision document is an initial public draft, not a superseding final standard. The draft expands the sectoral treatment of maritime systems, freight rail, industrial internet-of-things infrastructure and cloud convergence, and adds further emphasis to asset management, monitoring architecture and the protection of management functions. These developments establish a relevant technical baseline for assessing AI deployment: monitoring capabilities must be evaluated against the underlying operational architecture, rather than against the isolated accuracy of an algorithm. Guide to Operational Technology (OT) Security, Revision 3 — NIST — September 2023; Guide to Operational Technology (OT) Security, Revision 4, Initial Public Draft — NIST — September 2026. CSRC+1

The principal judgment is therefore conditional, with medium confidence: AI can increase the capacity of SOCs to process heterogeneous information, identify suspicious relationships and support technical investigation, but the available public record does not establish that AI-enabled SOCs have achieved a consistent, independently verified improvement in end-to-end detection and safe response across critical-infrastructure operations. The limitation concerns the quality and comparability of performance evidence rather than an assumption that the technology provides no operational benefit.

Production Architecture: Where AI Enters the Security Decision Chain

A production SOC protecting critical infrastructure does not operate as a single analytical system. Its operational capability depends on the combination of sensors, data transport, event collection, asset identification, analytical rules, security information and event management, incident investigation, orchestration platforms, engineering support and response authority. AI may be introduced at several points along that chain, but the consequences of its deployment differ substantially depending on whether the system merely presents information, recommends action, modifies security configurations or acquires the authority to interact directly with operational assets. This differentiation becomes especially important where information-technology monitoring is integrated with operational-technology environments, because the latter may include programmable logic controllers, supervisory control and data acquisition systems, distributed control systems, engineering workstations, remote terminal units, industrial gateways, safety-related equipment and external maintenance connections.

The physical position of a monitoring component is as important as its analytical sophistication. A sensor observing traffic at the boundary between enterprise information technology and industrial operations may identify unauthorised connections or suspicious command sequences, but it may have little visibility into legitimate control activity occurring entirely within an isolated operational segment. Endpoint detection on an engineering workstation can expose malicious processes and credential use, while remaining unable to establish whether an authorised software application has issued an operationally inappropriate controller command. Conversely, passive industrial-protocol monitoring may identify unusual device communications without determining whether the activity originated from a compromised user account, a legitimate maintenance intervention or an upstream supervisory-system error. The integration of AI can improve correlation among those observations only to the extent that the relevant observations exist, retain their integrity and can be associated with reliable information about the assets and processes concerned.

A mature architecture must therefore preserve the distinctions between data collection, interpretation and execution. The security-monitoring environment should be capable of combining enterprise identity and endpoint information with industrial network observations, controller configuration changes, engineering activity and relevant process measurements, but the resulting analytical outputs should remain distinguishable from independently established facts. A model-generated explanation of an incident is not a substitute for a verified record of communications, commands, equipment states or operator actions. Equally, a high-confidence machine classification must not acquire authority over safety-significant controls merely because its software provider describes the classification as accurate. The architectural requirement follows directly from the operational-technology security principles developed by NIST, which emphasise tailoring security countermeasures to the safety, reliability and operating requirements of the protected environment. Guide to Operational Technology (OT) Security, Revision 3 — NIST — September 2023.

Operational Monitoring Layers and the Evidentiary Value of Their Data

The architecture described here is an analytical reference model rather than a claim that every operator has deployed all seven monitoring layers. Its purpose is to distinguish the evidence that each layer can supply, the attacks that remain partially invisible and the additional proof required before an AI-generated judgment can be translated into operational action.

Detection Physics: Latency, Completeness and the Problem of Missing Observations

The effectiveness of an AI-enabled SOC depends on the relationship between the observable progression of an attack and the time required to generate, validate and act upon a security finding. Conventional mean time to detect (MTTD) and mean time to respond (MTTR) are useful only when their definitions are explicit. MTTD may refer to the interval between initial compromise and detection, between the first observable malicious event and alert generation, or between alert generation and analyst confirmation; MTTR may refer to acknowledgement, containment, remediation or full restoration, even though these events represent fundamentally different stages of incident management. For industrial infrastructure, those distinctions are material because an alert generated after an unauthorised controller command has already altered an industrial process may be technically accurate without providing an opportunity to prevent its consequences. Likewise, rapid isolation of a compromised engineering workstation could be operationally effective in one environment but hazardous in another if the workstation is performing an authorised procedure necessary to maintain safe operations.

A rigorous operational measurement must therefore establish a complete sequence of timestamps, including the earliest detectable malicious event, availability of the relevant telemetry, initial analytical finding, validated security determination, authorised response decision, execution of the response, confirmation of containment and restoration of the affected service. The distinction between event occurrence and event visibility is especially important because network buffering, limited logging, disconnected segments, inconsistent device clocks and selective collection can create delays before information becomes available to the SOC. AI cannot compensate for an event that produces no observable evidence, and it cannot reconstruct the physical meaning of a process deviation without adequate information about the relevant equipment, operating conditions and control relationships. Improvements in model inference speed consequently have diminishing operational value once telemetry collection, analyst validation or engineering intervention becomes the dominant source of delay.

For evaluation purposes, the following measurement architecture separates the stages of the incident lifecycle without reducing them to a misleading single efficiency figure.

Table 1.1 — Detection and Response Measurement Architecture

These metrics should be measured separately for enterprise information technology, OT network boundaries and process-aware industrial detection. Their aggregation into a single average risks concealing the very vulnerabilities that matter most to critical-infrastructure operators. A monitoring system that performs well against ordinary credential misuse could remain almost blind to unauthorised changes executed through an otherwise legitimate engineering tool, while an anomaly detector optimised for abnormal industrial traffic might generate excessive alerts during legitimate maintenance or changes in production configuration. It follows that the benchmark population, operational state and definition of a successful detection must accompany every published performance result.

A further methodological problem concerns censored incidents and the interpretation of incident-investigation statistics. Investigations generally begin because an incident has already become visible or has been referred for specialist support. Attacks that remain undetected do not enter the same dataset, while unusually complex or disruptive incidents may be overrepresented. This is why the 2025 incident observations reported in M-Trends 2026 — Google Cloud/Mandiant — March 2026 should not be converted into an AI performance claim. The study offers evidence about investigated compromise patterns and organisational detection but does not isolate AI-enabled SOC adoption or provide a representative comparison between AI-supported and non-AI-supported industrial security operations. Google Cloud Blog

Alert Volumes, Analytical Capacity and the Limits of Automated Triage

The economic attraction of AI-enabled SOCs arises partly from the increasing volume and heterogeneity of security information. An industrial operator may receive events from enterprise identity services, remote-access systems, endpoint agents, firewalls, industrial network sensors, equipment management applications and specialist operational monitoring platforms, each operating with different levels of reliability and contextual information. Automated triage can reduce repetitive analysis by grouping related observations, producing preliminary investigative hypotheses and presenting relevant evidence to human analysts; nevertheless, the reduction of visible alerts is not itself proof that security coverage has improved. The operational question is whether the system has removed redundant or unimportant information while preserving the evidence required to recognise consequential attacks.

A detection architecture optimised to suppress routine notifications may reduce the number of cases assigned to analysts even as the probability of missing rare, sophisticated or process-aware attacks increases. This is particularly problematic when models learn from incident histories in which successful intrusions were never identified, where legitimate operational changes are inadequately labelled or where records are dominated by ordinary business-network activity. In these circumstances, apparently satisfactory classification performance may reflect the composition of the evaluation dataset rather than the ability to identify dangerous deviations in production. The problem is compounded when abnormal but legitimate operating conditions, including emergency maintenance, unusual production schedules and degraded communications, resemble the patterns a model has been trained to associate with malicious activity.

The operational value of automated triage consequently depends on the existence of independently maintained detection rules, representative ground-truth tests, sampling of suppressed alerts and a documented process for evaluating the consequences of model updates. Analysts should be able to determine why an alert was prioritised, which original evidence supports the classification and whether an alternative explanation remains plausible. An AI-generated investigation summary can usefully accelerate the reconstruction of a complex event, but its value is substantially reduced if original source references are inaccessible, evidence is silently omitted or the model presents inferred relationships as established facts. The UK National Cyber Security Centre’s November 2026 treatment of the changing nature of operational cyber defence explicitly anticipates machine-assisted investigation, correlation and reversible action while emphasising reliable telemetry, rehearsed procedures and clearly defined authority. The Changing Nature of Operational Cyber Defence — UK NCSC Annual Review 2026 — November 2026. National Cyber Security Centre

Detection Coverage Across Distinct Attack Classes

The technical characteristics of the underlying intrusion determine whether AI can offer a material advantage. Known malware and established malicious communication patterns are frequently detectable through signatures, endpoint controls and conventional behavioural rules without requiring advanced generative models. AI may improve their prioritisation or correlation across large environments, but a measurable advantage must be demonstrated over a properly configured conventional baseline. Living-off-the-land activity presents a different problem because an attacker can exploit legitimate administrative tools, approved credentials or normal management channels, requiring the SOC to identify suspicious relationships between otherwise permissible operations. Supply-chain compromises introduce additional difficulty because apparently legitimate software or vendor access may provide the initial route into the protected environment, while process-aware attacks can manipulate operational variables without generating the execution artifacts associated with traditional malware.

The industrial threat taxonomy maintained by MITRE is useful precisely because it differentiates initial access and conventional intrusion activity from activities intended to impair process control, inhibit protective functions or manipulate the operator’s view of physical operations. These distinctions establish why high detection performance against ordinary endpoint threats cannot be assumed to translate into comparable detection of industrial hazards. MITRE ATT&CK for ICS — Tactics; MITRE ATT&CK for ICS — Techniques. MITRE ATT&CK®+1

Table 1.2 — Threat Detection by Attack Class

The appropriate interpretation of this matrix is not that each AI application has been validated in production, but that the likely mechanism of advantage and the evidence required to demonstrate it differ by threat class. The first-order task is to identify the visibility and analytical requirements of the threat, then determine whether a machine-learning component improves detection over a conventional baseline without introducing unacceptable error, operational disruption or dependence on compromised inputs.

Field Validation and the Difference Between Tested Capability and Deployed Effectiveness

The transition from controlled evaluation to operational deployment involves several independent sources of uncertainty. Laboratory environments often provide more complete ground truth, stable instrumentation and repeatable events than an operating industrial facility, while production environments may include undocumented configurations, heterogeneous device generations, proprietary protocols and restrictions on intrusive testing. Even when a model performs well in a laboratory, changes in sensor placement, communications patterns, software versions, production schedules or equipment maintenance can alter its behaviour. The resulting difference between evaluated and operational data distributions is particularly important for anomaly detection, since a model that identifies unusual activity through statistical deviation may interpret legitimate operational change as hostile conduct while failing to identify carefully constructed malicious activity that remains within learned operating patterns.

In September 2026, NIST issued the initial public draft of Revision 4 of its operational-technology security guidance, expanding its treatment of network monitoring, detection, management functions, maritime vessels and cloud-connected industrial environments. The significance of this development is architectural rather than statistical: it provides an increasingly detailed framework for identifying operational constraints and selecting controls, but does not establish measured AI-specific improvements in detection latency, false-negative rates or the safety of automated intervention. The relevant regulatory and technical conclusion is that acceptance testing for AI-enabled SOC capabilities must reproduce the operating conditions and threat pathways of the infrastructure being protected. Guide to Operational Technology (OT) Security, Revision 4, Initial Public Draft — NIST — September 2026. CSRC

A defensible validation programme should therefore compare an AI-supported monitoring configuration with an appropriate conventional baseline using the same telemetry, attack scenarios and operational constraints. The evaluation should distinguish detection accuracy from investigation quality, and should document whether false negatives arise from missing sensors, incomplete training data, analytical misclassification or deliberate adversarial evasion. In safety-critical environments, testing must also determine whether automated recommendations remain correct when equipment is operating outside its normal configuration and whether the intervention mechanism can be safely disabled, overridden or isolated. Without these measurements, procurement evaluations risk rewarding speed and demonstration quality rather than the ability to identify and contain consequential threats under realistic operating conditions.

Interactive SOC Detection and Decision Architecture

The following component is designed for insertion immediately after Chapter 1’s operational architecture and performance analysis. It is a self-contained interactive scheme, not an HTML version of the chapter. It provides three selectable operational phases, a three-dimensional layered design, an interactive evidence path and a detailed decision table. It deliberately contains no invented performance values or arbitrary risk scores.

CYBER-PHYSICAL INTELLIGENCE / SYSTEM ARCHITECTURE

From Machine Observation to Safe Operational Response

Select an operational phase to examine its inputs, failure modes, assurance requirements and decision authority. The architecture is conceptual and does not represent a specific installation.

Evidence Acquisition

Identity records, endpoint activity, industrial communications, control configurations and physical measurements.

AI-Supported Assessment

Behavioural analysis, evidence correlation, investigative hypotheses, threat classification and uncertainty.

Authorised Intervention

Engineering confirmation, containment authority, safety constraints, operational continuity and recovery.

EVIDENCE → VALIDATION → AUTHORISED ACTION

Evidence Acquisition

Operating function: Collect sufficient, time-consistent and trustworthy security and process observations.

Primary limitation: Missing telemetry, compromised sensors, logging failures and incomplete asset inventories can make a consequential event invisible to downstream AI.

Assurance requirement: Independent sensor validation, collection completeness, provenance and clock integrity.

Control point	Failure mechanism	Required assurance	Decision authority
Event collection	Missing or corrupted observations	Coverage testing and telemetry provenance	Security and OT engineering
AI classification	False negatives, model drift or misleading correlations	Ground-truth testing and independent review	SOC analyst and incident lead
Incident investigation	Incomplete reconstruction or unsupported model inference	Original-event traceability and case verification	Incident commander
OT containment	Service interruption or unsafe process changes	Safety-approved procedures and independent constraints	Authorised operational controller
Recovery	Persistent compromise or unstable process restoration	Engineering acceptance and confirmed safe-state recovery	Operations and safety management

Chapter 1

The operational baseline supports three conclusions. First, the utility of AI-enabled monitoring is constrained by telemetry availability, data integrity and the ability to associate observations with the physical and organisational context of the protected infrastructure; no amount of analytical acceleration can eliminate those requirements. Second, conventional security performance statistics are insufficient when they exclude undetected attacks, collapse distinct incident-response stages or omit the consequences of incorrect interventions. Third, the adoption of AI does not remove the need for conventional detection, independently validated process monitoring or engineering authority; it creates an additional analytical layer whose contribution must be established through comparative testing.

The assessment would become materially more favourable if independent evaluations demonstrated lower false-negative rates, earlier recognition of process-aware intrusions, reduced time to verified containment and no increase in unsafe interventions under realistic operational conditions. Conversely, evidence of systematic suppression of relevant alerts, compromised model inputs or hazardous automated containment would weaken the force-multiplier judgment. The principal outstanding official records are independently evaluated deployment results, comparable baseline measurements, validated OT adversary-emulation exercises and operator after-action reports that disclose the complete detection-to-recovery sequence.

Chapter 2 — The AI-Enabled Threat Environment: Dual-Use Capabilities and Attacker–Defender Balance

Principal Judgment: Offensive AI Is Compressing the Time Available for Defensive Intervention

The emerging adversarial significance of artificial intelligence lies principally in its capacity to reduce the human effort, specialised knowledge and elapsed time required to execute established cyberattack techniques, rather than in the verified emergence of a universally autonomous class of infrastructure-destroying cyber weapons. This distinction is central to an accurate assessment of the present attacker–defender balance, because the technical advantage supplied by AI is distributed unevenly across reconnaissance, vulnerability discovery, exploitation, credential acquisition, internal discovery, persistence and operational manipulation. An attacker can obtain substantial value from accelerating several individually conventional activities without achieving complete automation of an intrusion, while the defender must still maintain continuous visibility across heterogeneous systems, distinguish authorised from malicious activity and intervene before operationally consequential actions are completed. The resulting strategic problem is one of temporal asymmetry: automation can shorten the interval between attacker decisions and successive intrusion stages, whereas the defender’s response remains constrained by evidence collection, confirmation, operational authorisation and the physical limitations of protected systems.

The UK’s National Cyber Security Centre addressed this development explicitly in its 3 November 2026 Annual Review, assessing that AI would increasingly function as a force multiplier across the cyber-threat environment by improving the scale, speed and efficiency of existing operational methods. The assessment identifies reconnaissance, social engineering, vulnerability discovery and exploit-development assistance as important areas of change, while recognising that adoption remains uneven and that skilled human operators continue to contribute direction, validation and adaptation. Its conclusion is particularly relevant to critical infrastructure because it distinguishes greater attacker efficiency from the creation of entirely new attack categories, while warning that known vulnerabilities, poorly protected assets and weaknesses in essential-service environments remain attractive targets. The Impact of AI on Cyber Threat — UK National Cyber Security Centre — November 2026. National Cyber Security Centre

The principal judgment is assessed with high confidence for the acceleration of established offensive workflows and medium confidence for its net operational consequences in critical infrastructure. Government and first-party incident evidence establishes that AI is already being incorporated into genuine adversarial operations and can substantially compress selected activity sequences, but does not establish that attackers have achieved a general, persistent advantage against all well-managed SOC environments, nor that AI-assisted intrusion routinely enables reliable manipulation of safety-critical industrial processes.

Documented Adversarial Activity: From Assisted Operations to Agentic Execution

An important development in the public evidence base is the transition from observations of adversaries using language models as research or drafting assistants to documented cases in which AI agents executed multiple stages of an attack workflow. In November 2025, Anthropic disclosed an espionage campaign identified in September of that year in which an attacker manipulated its Claude Code system to support intrusion activity against approximately thirty organisations, including technology companies, financial institutions, chemical manufacturing businesses and government agencies. Anthropic attributed the activity to a suspected Chinese state-sponsored group, reported that a smaller number of targets were successfully compromised and described extensive use of autonomous tooling across reconnaissance, vulnerability identification, exploitation and post-compromise activities. The account is significant because it provides first-party evidence of offensive AI being integrated into a coordinated campaign involving real targets rather than merely demonstrating isolated technical capability in a benchmark. Nevertheless, the attribution, level of autonomy and effectiveness remain claims derived from the investigating provider’s visibility and should not be presented as an independently established census of AI-enabled espionage operations. Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign — Anthropic — November 2025. Anthropic

The operational significance of the incident is not that human direction became irrelevant, but that the relationship between human supervision and machine execution changed. An attacker capable of delegating a sequence of bounded technical tasks to an agent can potentially maintain concurrent investigative and exploitation processes while reserving specialised human attention for target selection, strategic decisions and difficult operational obstacles. This may reduce the effective cost of pursuing multiple targets, increase the frequency with which newly identified weaknesses can be tested and complicate conventional defensive assumptions about the time separating reconnaissance from exploitation. At the same time, agentic operations introduce their own failure mechanisms, including inaccurate interpretation of the environment, unreliable exploitation, mistaken target identification and actions that reveal an intrusion prematurely. These limitations explain why isolated reports of agentic success do not establish that offensive cyber operations have become reliably autonomous.

A second, more recent case provides a distinct measure of operational acceleration. In a report published on 8 September 2026, the Google Threat Intelligence Group described an observed incident during the second quarter of 2026 in which adversaries compromised a cloud resource and subsequently planned, built and executed an agent-enabled mass credential-harvesting operation in under six hours. The reporting also described activity involving UNC6780, whose techniques included attempts to mislead AI coding assistants and language-model security scanners in connection with open-source software supply-chain compromise. These observations are important because they connect agentic assistance with both rapid malicious execution and efforts to manipulate defensive AI-related workflows. They do not establish a six-hour benchmark for all cyberattacks, demonstrate industrial-process compromise or prove that the same activity would evade a properly configured SOC protecting energy or maritime infrastructure. GTIG AI Threat Tracker: From Prompting to Autonomy — Google Threat Intelligence Group — September 2026. Google Cloud Blog

The combined evidentiary implication is that the acceleration of cyber operations should be treated as an observed technical and operational phenomenon, while its scale across the overall threat population remains uncertain. A small number of detailed cases may establish capability without establishing prevalence. National cybersecurity authorities and infrastructure operators should consequently avoid two incompatible errors: dismissing agentic intrusion as speculative because available cases remain limited, or treating selected high-profile incidents as proof that all adversaries can now conduct sophisticated, unattended attacks against complex industrial environments.

Vulnerability Discovery and the Changing Economics of Exploitation

AI-assisted vulnerability discovery creates a particularly consequential competitive relationship because the same technological progress can benefit both software maintainers and adversaries. For defenders, increasingly capable automated analysis can identify security defects, propose fixes, improve software coverage and help prioritise remediation. For attackers, similar methods can reduce the cost of examining exposed services, identifying insecure implementations, developing proof-of-concept exploits and adapting existing tools to specific environments. The balance depends less on abstract model capability than on the relative speed with which defenders can discover, verify and remediate weaknesses compared with the speed at which adversaries can exploit them. Industrial environments are especially exposed to this timing problem because vulnerability remediation may require equipment testing, vendor approval, scheduled maintenance, operational shutdown or other procedures that cannot safely be accelerated to match software-development cycles.

The November 2026 UK NCSC assessment explicitly identifies AI-assisted vulnerability discovery and exploit development as a significant threat, recognising that more capable models can expose weaknesses in large codebases and systems that have previously received limited security examination. It also warns that the ability to identify vulnerabilities may increase exploitation pressure before system owners can complete remediation. The crucial distinction is between discovery and exploitation: a weakness identified by AI does not automatically become an operational exploit, and successful exploitation of an information-technology component does not automatically confer control of industrial processes. A credible operational assessment must account for exploitability, required privileges, network accessibility, defensive controls and the presence of physical or engineering safeguards. The Impact of AI on Cyber Threat — UK NCSC Annual Review 2026 — November 2026. National Cyber Security Centre

The relative advantage available to an attacker may become greater when a newly discovered vulnerability affects a widely deployed product and exposed installations can be identified at scale. A defender responsible for one infrastructure estate must determine which systems are affected, whether they can be patched without compromising operations and which compensating controls can reduce exposure in the interim. An attacker may instead search across many organisations for the subset of installations that remain accessible and inadequately protected. AI can potentially accelerate that selection process without changing the underlying technical weakness. This creates a competitive disadvantage for organisations whose asset inventories are incomplete, whose industrial systems cannot be routinely updated or whose monitoring architecture cannot distinguish legitimate maintenance activity from exploitation attempts.

Conversely, mature operators can use automation to reduce the time between disclosure, asset identification, testing, remediation planning and verification. The relevant measure is therefore not the number of vulnerabilities identified by either side, but the elapsed period during which a consequential weakness remains exploitable and the proportion of affected assets that can be protected before hostile access is achieved. This interpretation shifts the analytical emphasis from individual model performance to the relationship among software assurance, operational asset management, compensating security controls and attacker capability.

Social Engineering, Identity Compromise and the Industrial Supply Chain

The significance of generative AI for social engineering extends beyond the ability to produce more fluent phishing messages. Its principal operational effects arise from reducing the cost of adaptation, enabling the rapid preparation of multilingual material, supporting the impersonation of organisational roles and helping attackers process publicly available information about targeted individuals, suppliers and operational relationships. Critical infrastructure creates a comparatively rich environment for such activity because its personnel and suppliers often participate in technically specialised communications involving maintenance, procurement, equipment support, access authorisation and emergency coordination. An attacker does not need to persuade a target to disclose an entire industrial architecture if a credible request can instead induce the approval of a remote-access session, the transfer of a configuration file or the execution of a familiar administrative procedure.

The observed attack environment supports attention to these mechanisms, although it does not justify attributing every development in social engineering to generative AI. Mandiant’s investigations of 2025 incidents identified highly interactive voice phishing as a significant initial infection vector, accounting for 11% of investigated intrusions, behind exploitation of vulnerabilities. This figure describes the investigated population and the reported intrusion method, not the proportion of incidents generated or improved by AI. It is nevertheless operationally relevant because voice-mediated deception can exploit the same organisational assumptions that govern supplier access, identity verification and emergency technical support. M-Trends 2026 — Google Cloud/Mandiant — March 2026. Google Cloud Blog

For energy, maritime and industrial operators, the relevant vulnerability is frequently the combination of digital identity and trusted operational context. A maintenance technician may possess legitimate credentials but be connecting from an unexpected system; a vendor may provide a correctly signed software package that has been compromised upstream; an engineer may receive instructions that appear to originate from an authorised operational manager but have been generated or altered by an adversary. AI can improve defensive recognition of unusual access sequences, but reliable identification still depends on independent validation of authorisation and provenance. If all suspicious communications are assessed using the same compromised identity or messaging infrastructure, apparently independent observations may reinforce one another without providing genuine corroboration.

Supply-chain compromise also creates opportunities for adversarial manipulation of AI-assisted security development and review. The September 2026 Google Threat Intelligence Group report is significant in this respect because it documents attempts to deceive coding assistants and security scanners associated with open-source software activity. The implication for infrastructure operators is that AI-assisted code review, security analysis and dependency evaluation must be regarded as components of the software assurance process rather than as authoritative substitutes for provenance, reproducibility and independent technical validation. GTIG AI Threat Tracker: From Prompting to Autonomy — Google Threat Intelligence Group — September 2026. Google Cloud Blog

Living-off-the-Land Techniques and the Problem of Legitimate Behaviour

Living-off-the-land intrusion techniques exploit the fact that many security-relevant actions can be executed through legitimate software, administrative interfaces and approved operating-system functions. This limits the usefulness of detection methods based exclusively on malicious file signatures or unfamiliar executable names, since the attacker may use applications and commands that are routinely employed by authorised administrators. AI-assisted behavioural analysis can potentially identify suspicious sequences, unusual account relationships or deviations from historical operating patterns, but the distinction between malicious and legitimate intent remains dependent on context that may not be encoded in the available telemetry. An industrial engineer conducting emergency maintenance may perform an uncommon but authorised action, while an attacker with valid credentials may execute a command sequence that resembles ordinary operational work.

This ambiguity is especially important in industrial-control environments because legitimate engineering tools can interact with controllers and supervisory systems. An unauthorised change may involve a genuine engineering application, a real operator account and protocol-compliant communications, making it difficult to identify through conventional indicators of malware execution. Effective detection requires correlating the technical command with the identity of the person or system responsible, the authorised maintenance procedure, the expected controller configuration and the physical operating state. Even a sophisticated AI model cannot reliably infer authorisation where the underlying organisation has failed to maintain authoritative records of permitted changes or where operational procedures are undocumented.

MITRE’s industrial-control threat model distinguishes activities involving discovery, lateral movement, control manipulation and interference with protective functions, providing a useful reference for the technical behaviours that a SOC must recognise. The model describes adversarial objectives and documented techniques rather than assigning operational success probabilities or demonstrating that AI can consistently identify them. MITRE ATT&CK for ICS — Tactics. MITRE ATT&CK®

An important implication is that some of the highest-value defensive improvements may result from strengthening authoritative operational context rather than increasing the complexity of the AI model. Accurate asset ownership, verified maintenance schedules, privileged-access controls, configuration histories and independent engineering approval can make suspicious behaviour easier to distinguish from legitimate activity. Where these controls are absent, advanced behavioural classification may generate elaborate explanations without resolving the underlying uncertainty.

Synthetic Telemetry, Manipulated Observations and the Deception of Defensive Analytics

The manipulation of security observations is a distinct issue from ordinary alert evasion. An attacker may attempt to avoid detection by suppressing logs, modifying observable activity, exploiting unmonitored communications paths or presenting a misleading account of operational conditions. The introduction of AI-supported anomaly detection potentially creates additional opportunities for such deception, because the model’s conclusions depend on relationships among recorded variables and on the integrity of the data used to establish normal operating behaviour. If those variables can be manipulated, the system may accept a false representation of the environment even while its internal calculations remain consistent with the information received.

The industrial-control consequences are particularly significant when reported equipment states diverge from actual physical conditions. MITRE identifies manipulation of the operator’s view, loss of visibility, modification of alarm settings and interference with protective functions as distinct industrial attack techniques. These behaviours provide a documented technical basis for assessing how compromised observations can conceal an ongoing incident or undermine the operator’s understanding of the process. They do not, however, establish that production attackers have routinely generated synthetic industrial telemetry using generative AI or successfully defeated deployed process-aware SOC models through adversarial machine learning. That narrower proposition requires incident-specific evidence that is not established by the technique taxonomy alone. MITRE ATT&CK for ICS — Techniques; Inhibit Response Function — MITRE ATT&CK for ICS. MITRE ATT&CK®+1

The theoretical risk is nevertheless operationally important because a monitoring model can fail in two different ways. It may incorrectly classify authentic malicious observations as benign, or it may correctly process deliberately misleading observations that no longer represent the true state of the protected system. The second failure is not necessarily remediable through improvements in statistical classification, since the problem resides in the trustworthiness of the evidence. Independent sensing, authenticated data acquisition, integrity monitoring and cross-validation against engineering relationships therefore remain important safeguards even where AI provides advanced anomaly detection.

The distinction also has implications for incident attribution. AI-generated investigative summaries may produce coherent explanations that are not supported by sufficiently independent evidence, especially when an attacker has altered logs, inserted deceptive documents or influenced the context presented to an investigative agent. An attribution assessment requires corroborated indicators, technical chronology and explicit recognition of alternative explanations. Machine-generated confidence does not establish source authenticity, adversary identity or intent, and the volume of correlated observations does not establish independence if those observations originate from the same compromised system.

The Commercialisation of AI Resources as an Additional Attack Surface

A further adversarial development concerns attacks against the infrastructure used to access and operate large language models. On 2 November 2026, Google Threat Intelligence Group and Mandiant reported multiple incidents in which adversaries exploited compromised enterprise access to language-model services, an activity described as LLMJacking. The investigation identified affected organisations across financial services, retail, technology and transportation in several regions, and reported that fraudulent use of cloud and model resources exceeded US$100,000 in a single day in some incidents, with cumulative charges reaching US$1 million at certain organisations before access was revoked. These amounts represent observed billing exposure in the investigated cases, not a sector-wide estimate or an assessment of physical infrastructure damage. The Rise of LLMJacking: How Threat Actors Monetize Compromised Cloud and Model Resources — Google Threat Intelligence Group/Mandiant — November 2026. Google Cloud Blog

This development matters to the defender’s operating model because AI-enabled SOCs may increasingly depend on external model services, cloud credentials, inference endpoints, specialised compute capacity and integrated investigative agents. A compromise involving these dependencies could produce financial loss, information exposure, analytical disruption or unauthorised use of organisational resources without directly compromising an industrial controller. The relevance to critical infrastructure arises from the dependency relationship: if a SOC relies on an external AI service for essential analytical work, the security and availability of that service become part of its operational resilience. The incident record does not justify treating LLMJacking as equivalent to physical-process sabotage, but it establishes that AI service credentials and infrastructure are genuine targets of financially motivated adversarial activity.

The broader consequence is that AI increases the number of technical and commercial dependencies that must be secured. In addition to defending sensors, investigation platforms and response tools, operators must understand how model access is authenticated, which information may leave the organisation, how usage is monitored and whether loss of an external service impairs the SOC’s essential functions. These issues are developed further under Pillar II’s analysis of AI-specific attack surfaces, while the immediate conclusion for adversarial competition is that defensive adoption itself supplies additional infrastructure that attackers may seek to exploit.

The Present Attacker–Defender Balance: Capabilities, Constraints and Structural Asymmetries

An assessment of the attacker–defender balance must distinguish the ability to generate a cyber capability from the ability to employ it successfully against a specific protected system. Attackers and defenders may use similar foundation models, coding assistants, software analysis methods and automated investigative techniques, but the conditions under which these technologies operate are not symmetrical. Attackers may select targets according to accessibility and known weakness, distribute experimentation across numerous installations and accept unsuccessful attempts when the cost of retrying is low. Defenders are responsible for maintaining the integrity and availability of particular assets, including systems that cannot be readily replaced, patched or interrupted. In critical infrastructure, this asymmetry is intensified by requirements for operational continuity, physical safety, contractor coordination and the management of equipment whose service lives may substantially exceed those of conventional enterprise software.

The defender nevertheless possesses important advantages unavailable to most external attackers. Operators can maintain authoritative asset inventories, engineering configurations, historical process data, approved maintenance procedures and physical measurements that provide context beyond external reconnaissance. They can monitor authenticated internal relationships, compare observed commands with authorised operational states and enforce restrictions on the mechanisms by which software can interact with equipment. These advantages are conditional on accurate documentation, sufficient instrumentation and effective organisational coordination. Where operators lack asset visibility, retain obsolete remote-access arrangements or depend on unverified external service providers, AI-assisted attackers may exploit conventional weaknesses more rapidly than AI-assisted defenders can identify them.

The evidence published by the UK NCSC in its November 2026 Annual Review supports this differentiated interpretation. The agency’s review of 337 incidents emphasises known vulnerabilities, poorly secured systems, internet-facing exposure, social engineering, credential theft, supply-chain dependencies and the importance of early detection and containment. Its incident-management assessment states that the observed incorporation of AI into attacks had not generated a new class of attack within the incidents examined. This provides a useful counterweight to claims that artificial intelligence has already displaced established cybersecurity principles, while reinforcing the possibility that the speed and scale of familiar attack methods will increase. Seven Things We Learned — UK NCSC Annual Review 2026 — November 2026; Incident Management — UK NCSC Annual Review 2026 — November 2026. National Cyber Security Centre+1

Table 2.1 — Evidence-Based Attacker–Defender Capability Comparison

This comparison indicates that the current balance is better characterised as uneven, task-dependent competition than as a universal advantage for either side. The existence of documented offensive automation establishes that defenders face an evolving operational environment, but it does not prove that the defensive benefits of AI have been neutralised. Equally, successful demonstrations of defensive automation do not establish that attackers have lost the ability to exploit weakly protected assets or manipulate the observations on which advanced detection relies.

The critical variable is whether the infrastructure operator can reduce the time between the first observable hostile activity and an effective, safe response more rapidly than adversaries can shorten the time required to progress through their attack sequence. This relationship cannot currently be quantified through a representative cross-sector dataset, but it can be evaluated at the organisational level through controlled adversary emulation, authenticated evidence collection and incident-response exercises that measure the complete sequence from initial intrusion to containment.

Implications for Energy, Maritime, Subsea and Industrial-Control Environments

The effects of offensive AI differ across critical infrastructure because each sector presents distinct operating architectures, physical dependencies and intervention constraints. In energy infrastructure, the relevant threats may involve enterprise-to-operational network movement, engineering access, supervisory-system interference or attacks against supporting services, with consequences determined by the affected assets and the availability of independent protection. Maritime operators must consider the interaction of shipboard systems, port communications, terminal operations, logistics platforms and external technology providers. Subsea installations and communications infrastructure introduce additional problems of remote access, distributed monitoring, limited physical accessibility and dependence on supporting networks. Industrial-control environments present highly specialised configurations in which a technically valid command may have consequences determined by the current process state rather than by its syntactic conformity with a communications protocol.

These differences constrain attempts to generalise AI-enabled intrusion performance. A model capable of identifying a vulnerable internet-facing application cannot be presumed capable of understanding the operational relationships among sensors, actuators, protection systems and control logic. Similarly, an agent that successfully conducts cloud credential harvesting has not thereby demonstrated the ability to manipulate a safety-critical industrial process. The technical pathway from initial access to physical consequence includes additional requirements involving system discovery, relevant privileges, engineering context, process knowledge and interaction with physical constraints. Each requirement creates possible opportunities for detection or interruption, but each also represents a potential weakness where the operator lacks adequate monitoring or assurance.

The UK NCSC’s 2026 assessment of AI and cyber intrusion identifies legacy critical national infrastructure and the new attack surfaces associated with AI deployment as important future targets. Its assessment extends through 2028 and differentiates plausible scenarios rather than presenting a single deterministic forecast. That framework supports treating increased attack speed and growing infrastructure exposure as material planning concerns without inferring that advanced AI has eliminated the technical barriers to physical-process compromise. Artificial Intelligence and Cyber Intrusion — UK National Cyber Security Centre — November 2026. National Cyber Security Centre

Table 2.2 — Sector-Specific Transmission of AI-Enabled Adversarial Capability

The sectoral consequences in this table are potential causal pathways, not claims that AI-enabled campaigns have already produced each listed outcome. Their operational significance lies in showing where the general acceleration of cyber intrusion would intersect with existing physical and organisational dependencies.

Strategic Outlook of the Attacker–Defender Relationship

The strongest available evidence indicates that AI is already accelerating selected cyber-offensive activities, while the degree to which these gains alter the resilience of critical infrastructure depends on deployment architecture, operational visibility and defensive maturity. The September 2026 Google Threat Intelligence Group findings demonstrate that agentic assistance can substantially compress a specific intrusion-related workflow, while the November 2026 UK NCSC reporting establishes that established weaknesses remain central to many successful attacks. Together, these records support the conclusion that the most immediate danger is not necessarily an entirely new autonomous cyber weapon, but the increasing ability of adversaries to exploit familiar vulnerabilities at a speed and scale that may exceed the monitoring, validation and remediation capacity of poorly prepared organisations. GTIG AI Threat Tracker — Google Threat Intelligence Group — September 2026; The Impact of AI on Cyber Threat — UK NCSC — November 2026. Google Cloud Blog+1

The corresponding defensive opportunity is substantial but conditional. An operator that combines reliable telemetry, validated anomaly detection, conventional security controls, accurate operational records and effective human intervention can potentially identify suspicious relationships earlier and allocate specialist attention more efficiently. The result cannot be assumed merely because AI tools are installed, because model accuracy, data authenticity, adversarial robustness and response safety remain separate determinants of effectiveness. The principal strategic requirement is therefore to ensure that machine-assisted defensive acceleration is not offset by degraded evidence quality, excessive autonomous authority or dependence on infrastructure that the adversary can compromise.

Chapter 2

The evidence supports a high-confidence judgment that AI is increasing the efficiency of selected cyber-offensive activities and a medium-confidence judgment that this acceleration will create greater operational pressure on critical-infrastructure defenders whose monitoring, asset management and response procedures remain inadequate. Documented incidents demonstrate agentic intrusion support, rapid credential-harvesting operations, attempts to mislead AI-assisted security tooling and exploitation of model-service infrastructure. These cases are sufficiently concrete to establish that AI-related offensive capability extends beyond hypothetical misuse, but they do not provide a representative measure of successful attacks against industrial SOCs or establish that AI-assisted adversaries can routinely defeat independent engineering safeguards.

The present balance is consequently neither uniformly defender-favouring nor uniformly attacker-favouring. It is determined by the interaction of attacker capability, exposure of the target environment, integrity of the defender’s observations and the ability to undertake timely, safe intervention. Organisations that preserve authoritative operational context and independently verifiable security controls have defensive advantages that cannot be reduced to model capability alone. Those relying on incomplete inventories, weak monitoring or poorly controlled AI integrations face the possibility that technological acceleration will increase the speed at which existing vulnerabilities become consequential.

The assessment would shift towards a stronger offensive advantage if independently documented campaigns demonstrated repeated, reliable compromise of industrial monitoring systems or physical processes through AI-directed activity, particularly where mature conventional controls and qualified operators had been present. It would shift towards a stronger defensive advantage if controlled production evaluations established durable improvements in the detection of sophisticated intrusion sequences, independently verified reductions in missed events and effective containment without additional operational disruption.

The decisive unresolved records concern the prevalence of agentic intrusion among successful incidents, the actual effectiveness of AI-assisted evasion against production SOCs, the proportion of offensive workflows that can operate reliably without human correction and independently documented cases of AI-supported attacks against operational technology. These records are necessary to distinguish the demonstrated acceleration of particular offensive tasks from a sustained change in the strategic balance of critical-infrastructure cybersecurity.

Pillar I — Consolidated Assessment: The technical capacity of artificial intelligence is advancing faster than the public evidence establishing its net effect on critical-infrastructure resilience. Defensive improvements are demonstrable in selected tasks, offensive acceleration is documented in real incidents, and the broader operational outcome remains dependent on detection coverage, evidence integrity, engineering constraints and human decision authority. The principal question for subsequent assessment is whether the systems introduced to improve defensive capability create vulnerabilities or correlated dependencies capable of negating those gains.

Chapter 3 — AI-Specific Attack Surfaces and Physical-Cyber Risk Transmission

Principal Judgment: AI Creates a Second Security Perimeter Inside the Defensive Architecture

The integration of artificial intelligence into security operations changes the object of cybersecurity protection because the defensive system itself becomes a collection of potentially exploitable software, data, model and execution dependencies. Unlike conventional monitoring technologies whose primary purpose is to acquire and present evidence, contemporary AI-supported systems may interpret untrusted observations, retrieve external material, generate investigative conclusions, invoke software tools and initiate actions across interconnected security platforms. Each additional capability introduces a corresponding trust relationship, and the compromise of one relationship can affect the reliability of subsequent security decisions even when the underlying industrial-control equipment remains technically uncompromised. The resulting vulnerability is not limited to the possibility that an algorithm produces an incorrect prediction; it includes the possibility that an adversary deliberately manipulates the information, instructions, model artifacts, execution privileges or external services on which the SOC depends, thereby turning part of the monitoring architecture into a mechanism for concealing intrusion, misdirecting analysts or initiating an inappropriate response.

The distinction between attacking a defended system and attacking the mechanism that evaluates its security is fundamental. An attacker who compromises an industrial workstation may obtain access to the operational environment, but an attacker who manipulates the SOC’s analytical pipeline may also influence how that compromise is perceived, whether it is investigated and which corrective actions are recommended. In a highly automated environment, the consequences can extend beyond the suppression of individual alerts because multiple detection and response functions may consume the same model-generated interpretation or rely on the same compromised data source. This creates the possibility of correlated analytical failure: several components appear to produce consistent conclusions, but their agreement results from a common defective dependency rather than from independent confirmation. Such a failure can be particularly damaging in critical infrastructure, where the absence of a security warning may be interpreted as evidence of normal operation and where inappropriate containment may itself produce service disruption.

The US National Institute of Standards and Technology’s March 2025 adversarial-machine-learning report provides a formal technical taxonomy for this problem, distinguishing evasion, poisoning, privacy attacks and other forms of model misuse according to attacker objectives, capabilities and the stages of the AI lifecycle exposed to manipulation. The report supplies a credible basis for classifying attack mechanisms, although its identification of a technique does not establish the frequency with which that technique has succeeded against production industrial SOCs. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — NIST AI 100-2 E2025 — March 2025. CSRC

Principal judgment — High confidence: AI deployment expands the set of assets and trust relationships requiring protection. Consequential judgment — Medium confidence: Poorly isolated model, data and orchestration dependencies can produce correlated defensive failure or unsafe response decisions. The scale of actual physical consequences attributable to adversarial manipulation of production AI-SOC components remains insufficiently documented for a defensible cross-sector numerical estimate.

Training-Data Poisoning and the Corruption of the Defensive Baseline

Training-data poisoning occurs when an adversary manipulates information used to develop, adapt or update a machine-learning system, with the objective of changing its subsequent behaviour. In a security-monitoring context, this may involve contaminating labelled examples, altering records used to establish normal operating patterns, introducing misleading relationships into security knowledge repositories or influencing information selected for fine-tuning and retrieval. The consequences depend on the learning architecture and the degree of adversarial control. A model trained predominantly on historical data may be exposed during periodic retraining, whereas a continuously adapting anomaly detector may encounter hostile observations during routine operation. A retrieval-augmented language-model system presents a related but technically distinct exposure because untrusted documents can influence immediate answers without changing the underlying model parameters. These mechanisms should not be conflated, since persistent model poisoning, temporary contextual manipulation and direct compromise of configuration files require different defensive controls.

The practical risk is particularly significant where a model learns the distinction between authorised and suspicious behaviour from operational histories containing incomplete labels. Industrial processes change through maintenance, equipment replacement, production variation and controller reconfiguration, and any system that updates its baseline must distinguish those legitimate changes from hostile attempts to normalise malicious behaviour. An attacker who can influence the source observations or the mechanism that approves new baseline data may attempt to make an unauthorised command pattern appear routine. The resulting weakness may not become visible until a later incident because ordinary monitoring could continue producing apparently plausible classifications, while the model’s reference distribution has already been modified. This is a persistence problem at the analytical layer: the attacker may no longer need to control the monitored asset continuously if the corrupted model or baseline survives after the initial manipulation.

NIST’s taxonomy identifies poisoning according to the attacker’s control over training inputs, labels or other parts of the learning process, while recognising that attack feasibility depends on the model, available data and attacker objectives. For critical-infrastructure operators, this requires treating training datasets, feature-generation pipelines, approved model artifacts and baseline updates as controlled security assets rather than as routine analytical resources. Provenance records should identify where training material originated, who authorised its inclusion, which transformations were performed and whether the resulting model has passed tests using independently protected reference data. Approval of a new model version should also preserve the ability to restore a previously validated version, particularly where unexpected changes in detection behaviour could conceal an intrusion. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — NIST — March 2025.

A crucial distinction concerns the measurement of poisoning resistance. Ordinary classification accuracy on a historical test dataset cannot establish that a model will withstand an attacker capable of manipulating future training inputs. The appropriate evaluation requires controlled poisoning exercises, independent clean reference samples, examination of changes in detection performance and testing of whether malicious patterns become accepted after model updates. Such exercises should also establish whether the SOC can identify the source and date of the contaminated data, withdraw the affected model and reconstruct security decisions made during the compromised interval. The additional validation burden is therefore not simply computational; it includes dataset governance, investigation of provenance, preservation of model versions and retrospective reassessment of alerts generated by potentially contaminated systems.

Adversarial Evasion, Model Extraction and the Protection of Decision Boundaries

Adversarial evasion differs from training-data poisoning because the attacker attempts to manipulate a model’s output during inference rather than permanently altering its learned parameters. A security classifier may receive observations deliberately constructed to resemble legitimate activity, while a language-model-based investigator may encounter documents designed to influence its interpretation of a suspicious event. The relevance of such attacks depends on the defender’s observable features and on how much the adversary knows about the model. Where a model uses information that an attacker can directly alter, its conclusions may be susceptible to manipulation even without access to its internal parameters. Where independent sensors or protected evidence sources constrain the attacker’s influence, evasion becomes more difficult, although it cannot be excluded solely because the model is proprietary.

Model extraction introduces a related but different concern. An adversary who can repeatedly query an exposed model or inference interface may attempt to reconstruct aspects of its behaviour, decision boundaries or underlying intellectual property, depending on the nature of the service and the information returned. In a SOC environment, detailed knowledge of detection behaviour could help an attacker identify which activities generate alerts and which remain unclassified, while extraction of sensitive training information could expose details about internal infrastructure or security observations. These outcomes must be differentiated: model extraction does not automatically disclose training data, and a model-inversion or privacy attack requires particular technical conditions that may not be present in a given deployment. The NIST taxonomy distinguishes the relevant privacy and inference threats and their dependence on attacker knowledge, available access and model characteristics. Adversarial Machine Learning: A Taxonomy and Terminology of Attacks and Mitigations — NIST AI 100-2 E2025 — March 2025.

From an architectural perspective, the essential question is whether an AI-enabled SOC exposes its detection mechanisms through interfaces that allow excessive querying, unnecessary disclosure of analytical detail or unauthorised access to model-serving infrastructure. Security validation should therefore examine access authentication, output restrictions, rate limitations, separation of operational environments and the protection of model artifacts. More importantly, it must determine whether knowledge of a model’s behaviour can permit an attacker to evade all available security controls or whether independently implemented monitoring continues to provide defensive coverage. The strongest defence against a common-mode analytical failure is not necessarily greater model secrecy, but the preservation of security controls that do not share the same assumptions, inputs and execution dependencies.

Prompt Injection and the Subversion of Security Investigation

Prompt injection is particularly consequential for language-model-assisted SOCs because it attempts to convert untrusted content into operational instructions. A security investigator may use an AI system to interpret endpoint logs, summarise external threat intelligence, examine suspicious documents, analyse software repositories or produce investigative queries. These sources are evidence to be evaluated, not authorities entitled to direct the investigation. If the model treats instructions embedded in a malicious document or event field as authoritative, an adversary may be able to influence the resulting summary, alter investigative priorities, request disclosure of sensitive information or induce unauthorised tool use. The resulting security boundary is between instructions supplied by the organisation and potentially hostile content supplied by the environment under investigation.

The failure mechanism can occur without compromising the model’s underlying software or changing its parameters. A model may operate as designed, receive valid credentials from its application and nevertheless produce an unsafe result because the application permits lower-trust content to influence higher-trust actions. This is one reason that conventional software authentication and network segmentation, although necessary, do not by themselves establish that an AI agent is secure. The relevant control must limit which information can influence tool execution, what permissions an agent possesses and whether the effects of its actions are independently checked. In a SOC, potentially dangerous actions include changing detection configurations, suppressing alerts, modifying investigation records, exporting sensitive telemetry or executing containment instructions. A language model that can recommend such actions presents a different risk from one that can carry them out.

The appropriate assurance approach requires explicit separation of data and instructions, restrictions on tool permissions, confirmation of high-impact actions, integrity checks for retrieved material and adversarial tests using malicious documents and event records. Importantly, a general-purpose instruction to the model to disregard hostile content is not equivalent to a technical enforcement mechanism. Where the application has access to privileged tools, the effective security boundary must be enforced outside the model through ordinary authorisation controls, constrained interfaces and independently verifiable execution policies. This interpretation is consistent with NIST’s broader treatment of generative-AI misuse and lifecycle risks, and with its July 2024 Generative AI Profile, which addresses information integrity, security and the consequences of inappropriate reliance on generated outputs. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile — NIST AI 600-1 — July 2024; Adversarial Machine Learning — NIST — March 2025. NIST+1

Model-Serving Infrastructure, Supplier Concentration and Common-Mode Failure

The security of an AI-enabled SOC also depends on infrastructure that may not be visible within its ordinary detection architecture. Model artifacts, inference servers, application programming interfaces, orchestration platforms, container images, software dependencies, identity services, external data sources and administrative consoles create a series of operational dependencies that must remain available and trustworthy. The failure of a model-serving component may reduce analytical capacity, but compromise can have more serious consequences if the attacker can modify model outputs, manipulate investigation workflows or obtain access to information processed by the SOC. Unlike a conventional isolated monitoring sensor, a centrally deployed model may support multiple functions simultaneously, so a single compromised service could affect alert triage, incident summarisation, threat hunting and automated response recommendations across several security domains.

Supplier concentration intensifies the issue when multiple infrastructure operators use the same managed detection service, model provider or orchestration component. A shared model vulnerability or compromised update mechanism could produce similar failures across organisations whose networks and operating procedures would otherwise be independent. This does not mean that concentration necessarily increases overall risk; centrally managed services can benefit from specialised expertise, rapid maintenance and consistent security engineering. The risk arises when common dependence is not recognised, when alternatives have not been tested or when essential security functions cannot continue if the external service becomes unavailable. A credible resilience assessment must therefore distinguish the security benefits of managed services from the systemic exposure created by shared technology and operational dependencies.

The European Commission’s October 2024 implementing regulation under NIS2 includes detailed measures addressing supply-chain security, network monitoring, vulnerability management, testing and the procurement of information and communications technology products and services for the categories of entities within its scope. The regulation does not prescribe a universal AI-SOC architecture, but its requirements provide a relevant legal and technical foundation for evaluating externally supplied analytical services and their operational dependencies. Commission Implementing Regulation (EU) 2024/2690 — European Commission — October 2024. EUR-Lex

Table 3.1 — AI-Specific Attack Surface and Assurance Requirements

This table describes mechanisms and assurance requirements. It does not assign artificial numerical risk scores because comparable exposure frequencies, exploit-success rates and loss distributions have not been established for the assessed infrastructure environments.

Physical Consequences and the Limits of Software-Based Containment

The principal strategic concern is that the compromise of an analytical system can affect decisions about physical operations even when the attacker never obtains direct control of industrial equipment. If an AI model incorrectly concludes that a critical engineering connection is malicious, an automated response may interrupt communications necessary for maintenance or process supervision. If a compromised model suppresses evidence of an intrusion, the operator may fail to intervene before the attacker reaches a more consequential stage. If several monitoring functions depend on the same corrupted data, apparently independent alarms may fail together. These mechanisms demonstrate why the security of an AI-enabled SOC must be assessed in relation to the physical system it supports rather than solely through conventional software confidentiality, integrity and availability criteria.

The consequences vary according to industrial design and should not be generalised into assumptions of immediate physical damage. Independent safety instrumentation, local control logic, manual operating procedures and engineering interlocks may prevent a cyber incident from producing dangerous physical effects, while other failures may result in reduced visibility, delayed restoration or partial service interruption. The resilience question is whether the operator can recognise when the digital representation of a process is unreliable and continue managing the underlying physical system through sufficiently independent mechanisms. Consequently, engineering validation of AI-linked containment should include abnormal operating states, lost communications, equipment maintenance, sensor disagreement and failures of the monitoring infrastructure itself.

The European Union’s Critical Entities Resilience Directive provides a relevant institutional basis for this broader approach. Article 12 addresses risk assessment, including cross-sectoral and cross-border dependencies, while Article 13 requires proportionate resilience measures. The Commission’s July 2026 guidance further emphasises an integrated approach to prevention, physical protection, incident response and recovery, rather than treating individual security measures as independently sufficient. Directive (EU) 2022/2557, Articles 12–13 — European Parliament and Council — December 2022; Guidelines on Article 13(5) of Directive (EU) 2022/2557 — European Commission — July 2026. EUR-Lex+1

The operational requirement is therefore to maintain a demonstrable separation between security recommendations and safety-critical control authority. An AI system can contribute to incident investigation and suggest containment options, but the authority to isolate industrial segments, modify controller configurations or interrupt essential operational functions should depend on independently enforced procedures and qualified operational responsibility. This is not a rejection of automation; it is a distinction between actions whose consequences are sufficiently bounded for pre-authorisation and actions requiring direct assessment of the physical operating state.

Quantifying the Additional Assurance Burden

There is no defensible universal percentage by which adversarial testing, model validation or monitoring costs increase when AI is introduced into a critical-infrastructure SOC. Such a percentage would depend on the number of models, update frequency, data dependencies, execution permissions, operating environment and required level of assurance. A more useful approach is to specify the additional work packages created by the deployment and the measurements through which their cost and effectiveness can be established. This allows operators and regulators to compare deployment models without manufacturing a cross-sector financial estimate unsupported by procurement or operating records.

Table 3.2 — Incremental Assurance Requirements

Chapter 3 assessment: AI creates additional exploitable dependencies whose significance depends on the architecture and authority assigned to the model. The evidence establishes the existence and technical credibility of the relevant attack classes, but representative field measurements of AI-specific compromise rates and physical consequences remain insufficient. A high-assurance SOC must therefore protect its analytical infrastructure as a distinct security domain, preserve independent monitoring and restrict high-impact execution capabilities through controls that do not depend solely on model behaviour.

Chapter 4 — Human–Machine Decision Architecture and Institutional Maturity

Principal Judgment: Operational Maturity Depends on the Quality of Human Control, Not the Quantity of Human Intervention

The introduction of autonomous and semi-autonomous AI into security operations changes the allocation of work among analysts, incident commanders, industrial engineers, system owners and executive management. Its organisational consequences cannot be assessed exclusively through the number of alerts processed per analyst or the proportion of investigations completed without direct human intervention, because those measurements may reward automation even where the resulting decisions are less reliable or more difficult to challenge. The central governance problem concerns the preservation of qualified human authority over consequential decisions while allowing automated systems to perform activities for which their speed, consistency and computational capacity provide demonstrable advantages. This requires identifying the decisions that can safely be delegated, the evidence necessary for effective supervision and the organisational capabilities that must remain available when a model fails, encounters an unfamiliar operating condition or produces an incorrect recommendation.

There is a material distinction between nominal human oversight and effective human control. A system may technically require an analyst to approve a proposed action while presenting the evidence in a form that makes independent review impracticable. Where the analyst receives a model-generated conclusion without access to original observations, alternative hypotheses or the anticipated consequences of the action, the approval process may become a procedural formality. The human participant remains accountable for the decision but has insufficient information to exercise meaningful judgment. Conversely, a workflow in which an analyst can inspect evidence, reject an unsupported conclusion, obtain engineering consultation and prevent execution can preserve substantive control even when much of the preliminary investigation has been automated.

NIST’s July 2024 Generative AI Profile explicitly recognises the risk of automation bias, in which users place excessive confidence in machine-generated content, potentially amplifying errors and weakening independent judgment. The report also recognises that excessive distrust can prevent organisations from obtaining legitimate benefits. The operational implication is that mature governance must avoid both uncritical acceptance and categorical rejection of AI outputs, replacing either response with structured verification, proportional human involvement and observable decision-quality measurements. Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile — NIST AI 600-1 — July 2024. NIST

Principal judgment — High confidence for the relevance of automation bias and human oversight; medium confidence for the comparative effectiveness of specific SOC organisational models: The strongest institutional architecture separates evidence acquisition, machine-generated assessment, security decision authority and industrial safety responsibility, while preserving explicit escalation procedures and the ability to challenge or reverse automated conclusions.

Functional Delegation and the Design of Authority Boundaries

The appropriate allocation of responsibilities depends on the reversibility, reliability and physical consequences of the activity concerned. Automated systems can often perform initial evidence enrichment, duplicate-event identification, historical correlation and routine case preparation without acquiring authority to alter operational systems. These tasks are suitable candidates for extensive automation because their outputs can be reviewed, corrected or discarded before affecting the protected environment. Investigative hypothesis generation and incident classification require greater attention because incorrect conclusions may cause analysts to overlook relevant evidence or escalate an incident inappropriately. The authority to alter security controls, disable accounts, isolate devices or affect industrial communications requires a separate assessment of the potential consequences, while interventions involving physical process control demand qualified engineering and operational approval.

These distinctions make a single, organisation-wide classification of AI autonomy inadequate. A model may be permitted to execute certain low-consequence investigative queries without individual approval while being prohibited from changing detection configurations or accessing sensitive engineering systems. Similarly, a response platform may be authorised to block a clearly malicious external connection under predefined conditions while lacking the authority to isolate a controller or interrupt a safety-related communications channel. What matters is that these boundaries are technically enforced, documented and independently tested rather than merely described in organisational policy.

The allocation should also account for uncertainty about the underlying event. A routine detection supported by multiple independent observations may justify a predefined response, whereas an unfamiliar combination of industrial commands and process deviations may require additional engineering interpretation before any intervention. It is therefore inappropriate to define human involvement solely according to the confidence score returned by a model. Such scores may not be calibrated for the relevant operating conditions, and high confidence does not establish that the model possesses the context required to evaluate physical consequences. The decision architecture should incorporate independent evidence quality, expected operational effect, reversibility and the availability of alternative containment measures.

Table 4.1 — Operational Authority Matrix for AI-Enabled SOCs

The matrix is a recommended control model, not a claim that all operators currently employ this structure. Its purpose is to prevent uncertainty about delegated authority from becoming a separate

Automation Complacency, Skill Retention and the Changing Analyst Profession

An important organisational consequence of automated triage is that the distribution of work remaining for human analysts may become more difficult even as the total number of cases decreases. Routine events can provide opportunities for developing familiarity with endpoint behaviour, administrative activity, network relationships and the practical limitations of detection tools. If AI removes much of this work, less experienced analysts may encounter a smaller but more demanding set of incidents without acquiring the investigative experience traditionally developed through repeated exposure to ordinary cases. This potential change in the training environment should not be interpreted as an inevitable loss of competence, because automation can also free time for structured investigation, adversary emulation and specialist learning. The outcome depends on whether the organisation deliberately converts released capacity into higher-value analytical work or simply reduces staffing without preserving investigative expertise.

The retention of adversarial thinking is especially significant. An AI-supported investigation may present a coherent chronological explanation that encourages an analyst to accept one hypothesis prematurely, even when the evidence also supports alternative interpretations. Mature incident analysis requires an ability to question what has not been observed, identify dependencies among apparently corroborating sources and recognise when an investigation is being constrained by the tools available. These capabilities are difficult to evaluate through conventional productivity indicators and are not necessarily preserved by a workflow in which human analysts approve machine-generated recommendations without reconstructing the evidentiary basis.

The organisational response should include deliberate practice under conditions of incomplete information, degraded monitoring and potentially compromised AI output. Analysts should periodically investigate selected cases using original telemetry and conventional tools, participate in exercises where machine recommendations are intentionally inaccurate and demonstrate that they can identify missing evidence or reject misleading conclusions. Industrial engineers should be included in exercises involving process-aware activity, because the physical meaning of a suspicious event may depend on system configuration or operating procedures outside the SOC’s normal expertise. Such exercises should evaluate actual decision quality rather than merely record attendance or the successful completion of a training module.

The distinction between formal training and demonstrated competence is consistent with the European Union’s approach to cybersecurity governance. Article 20 of NIS2 addresses management-body responsibilities and training, while Article 21 requires proportionate risk-management measures that include incident handling, business continuity, supply-chain security and assessment of security effectiveness. These obligations do not prescribe a universal AI staffing model, but they provide a regulatory foundation for treating organisational competence and management oversight as essential elements of cybersecurity rather than optional supplements to technical infrastructure. Directive (EU) 2022/2555, Articles 20–21 — European Parliament and Council — December 2022. EUR-Lex

The Organisational Models: From Tool-Centric Automation to Integrated Operational Authority

Three organisational patterns are useful for comparing AI deployment maturity. The first is a tool-centric model in which AI products are introduced into existing monitoring workflows without substantial changes to authority, evidence governance or incident-response procedures. Such deployments can generate immediate productivity improvements in routine tasks, but their effectiveness may remain difficult to establish because operational metrics are not designed to isolate the AI contribution. The second is an automation-centric model in which an organisation delegates increasingly substantial investigative and response functions to AI-enabled platforms, potentially reducing analyst workload while creating dependence on model reliability and external service availability. The third is an integrated assurance model in which automation is introduced alongside independent testing, explicit decision permissions, engineering participation and measures of actual operational outcomes.

The third model is more defensible for safety-critical environments because it recognises the different responsibilities of cyber analysts and industrial operators, but its superiority as a universal empirical proposition has not been established through representative, independently published comparisons. Its advantages arise from identifiable control mechanisms: a compromised model has less authority to execute harmful actions; an analyst retains access to original evidence; engineering expertise informs response decisions; and the organisation can test whether security functions continue when automated services fail. These are technical and institutional reasons for preferring the model, not evidence that every organisation employing it has achieved lower incident rates.

Table 4.2 — Comparative Institutional Maturity Models

The practical challenge for senior management is to ensure that automation-related cost savings do not undermine the specialist capacity needed to investigate uncommon incidents. A reduction in routine case volume can be economically valuable, but an organisation that eliminates its ability to conduct independent threat hunting, validate engineering assumptions or manage prolonged cyber-physical disruption may exchange visible operating efficiency for less visible exposure to high-consequence failures.

Escalation, Accountability and the Requirements of Effective Human Oversight

An operational escalation framework should establish who can validate the meaning of security evidence, who can authorise containment, who is responsible for assessing physical consequences and who can declare restoration complete. These responsibilities may reside in different teams and organisational reporting structures, but they must be coordinated before an incident occurs. The framework should also specify which automated actions are permitted under ordinary conditions, which require escalation and which remain prohibited without engineering approval. The purpose is to prevent a model’s technical access from becoming an implicit delegation of decision authority.

Accountability becomes more complex when the SOC relies on external AI services or managed security providers. The supplier may operate the model and underlying infrastructure, while the critical-infrastructure operator remains responsible for service continuity and compliance with applicable obligations. A contract describing a service as fully managed does not establish that the provider has authority to make physical-operational decisions, and technical access to a response platform should not be treated as equivalent to authorisation to interrupt essential services. The organisational model must therefore specify responsibility for model changes, adverse-event investigation, access control, incident escalation, evidence retention, supplier failure and recovery.

A meaningful human-oversight mechanism should be evaluated through exercises in which the model is unavailable, confidently incorrect or deliberately exposed to misleading information. Success requires more than the existence of an override control. The authorised human decision-maker must receive sufficient information, understand the potential consequences, possess the necessary technical competence and have a practical opportunity to intervene before the action occurs. In this respect, effective oversight is an operational capability that can fail independently of the underlying AI model.

Measuring Organisational Maturity Without Artificial Scores

A common weakness in organisational assessments is the substitution of maturity labels, numerical scores or technology adoption indicators for evidence of effective control. An organisation may report a high percentage of automated investigations while lacking reliable data on incorrect classifications, missed incidents or intervention safety. Another organisation may maintain substantial human involvement while achieving superior detection quality, but the difference cannot be established without comparable test conditions. Accordingly, a credible institutional assessment should use independently observable measurements rather than assigning arbitrary maturity percentages.

Table 4.3 — Human–Machine Governance Indicators

Chapter 4 assessment: AI-supported SOC maturity is principally an institutional capability involving decision authority, technical validation, analyst competence and operational accountability. The most defensible organisational architecture preserves independent evidence, restricts model execution permissions and incorporates industrial engineering expertise into consequential response decisions. Public evidence supports the relevance of automation bias and the necessity of governance, but does not justify claims that a particular commercial staffing or automation model has produced universally superior critical-infrastructure outcomes.

Chapter 5 — Regulatory Compliance Versus Demonstrated Operational Resilience

Principal Judgment: Regulation Establishes Responsibility, but Operational Assurance Must Establish Effectiveness

The European regulatory environment has reached a stage at which cybersecurity, critical-entity resilience and artificial-intelligence governance increasingly intersect, yet their respective legal obligations address different risks and cannot be treated as a single certification framework for AI-enabled Security Operations Centres. The Network and Information Security Directive, known as NIS2, establishes a framework for cybersecurity risk management, management accountability and incident notification across designated sectors and entities. The Critical Entities Resilience Directive addresses the continuity of essential services under a broader range of physical, technological and organisational threats. The Artificial Intelligence Act establishes obligations determined by the characteristics, intended purposes and legal classification of AI systems. Maritime cybersecurity is also subject to international safety-management requirements and guidance whose application depends on vessel operations, applicable conventions and national implementation. These frameworks can reinforce one another, but they do not demonstrate that an operator using AI for security monitoring detects attacks more accurately, intervenes more safely or restores essential services more effectively than an operator relying on conventional security systems.

The distinction between legal conformity and demonstrated resilience becomes particularly important where procurement decisions are motivated by compliance obligations. An organisation can establish policies, appoint responsible officials, maintain incident-response procedures, purchase monitoring technology and produce audit evidence without independently proving that its security controls can recognise an unfamiliar intrusion or withstand the compromise of their own analytical components. Such measures may satisfy relevant procedural or technical requirements while leaving material residual vulnerabilities. The appropriate regulatory objective is consequently not the installation of AI products, but the maintenance of proportionate, demonstrably effective security and resilience measures whose performance can be evaluated under conditions relevant to the services being protected. The legal duty and the evidentiary test should remain distinguishable: the former determines what an entity must do, while the latter determines whether its arrangements provide the intended protection.

Articles 20 and 21 of NIS2 establish management responsibilities and cybersecurity risk-management requirements, including incident handling, business continuity, supply-chain security, vulnerability management, training and the assessment of security measures. Article 23 establishes incident-reporting obligations for significant incidents, including an early warning within 24 hours and an incident notification within 72 hours, subject to the directive’s applicable conditions. None of these provisions creates a general obligation to deploy AI within a SOC. Instead, operators must determine whether their chosen technologies and arrangements satisfy the applicable risk-management requirements, taking into account their exposure, size, operational circumstances and potential societal consequences. Directive (EU) 2022/2555, Articles 20, 21 and 23 — European Parliament and Council — December 2022. EUR-Lex+1

Principal judgment — High confidence: Regulatory adoption and measured security effectiveness are distinct variables. There is no sufficiently representative public evidence establishing that compliance-driven procurement of AI-enabled SOC tools produces a quantifiable, causal improvement in detection and response across European critical infrastructure.

NIS2: Cybersecurity Governance, Management Accountability and the Measurement Problem

The structure of NIS2 places substantial responsibility on the organisation operating or providing the relevant service, rather than prescribing one uniform technological solution. This matters because an essential-service operator can adopt very different monitoring arrangements depending on its infrastructure, technical dependencies, supplier relationships and operating conditions. A multinational electricity operator, a regional port authority, a data-centre provider and an industrial supplier may all encounter cybersecurity obligations, but their exposure to physical disruption and the suitability of automated response mechanisms differ. A technology-neutral regulatory framework can accommodate these differences, provided that implementation is supported by risk analysis and evidence that the selected controls are effective.

Article 21 is particularly important because its requirements extend beyond incident detection to encompass the organisational and technical conditions necessary to prevent and minimise consequences. For an AI-enabled SOC, this implies that the security of the model’s data sources, external suppliers, execution permissions and supporting infrastructure should be evaluated within the broader cybersecurity risk-management system. An operator cannot establish sufficient protection by demonstrating that a detection algorithm performs well under ideal conditions while ignoring its susceptibility to compromised inputs, unavailable external services or unsafe automated actions. Similarly, the ability to submit incident notifications within statutory periods does not establish that the intrusion was detected early enough to prevent disruption. Reporting compliance and detection performance are related but analytically separate.

Commission Implementing Regulation (EU) 2024/2690 provides more detailed technical and methodological requirements for specified categories of digital infrastructure, ICT service management and digital service providers. Its scope is important: it must not be represented as applying identically to every electricity, maritime or industrial operator covered by NIS2. The regulation addresses measures such as network monitoring, risk assessment, security testing, supplier relationships and continuity, providing concrete mechanisms by which particular entities can demonstrate implementation. ENISA’s June 2025 technical guidance assists the corresponding entities with practical examples of evidence and mappings of applicable requirements. These sources establish a foundation for evaluating AI-related supplier dependencies and monitoring controls, while leaving the actual performance of individual installations to be demonstrated through operational assessment. Commission Implementing Regulation (EU) 2024/2690 — European Commission — October 2024; NIS2 Technical Implementation Guidance — ENISA — June 2025. EUR-Lex+1

Critical Entities Resilience: The Continuity of Essential Services as the Controlling Outcome

The Critical Entities Resilience Directive changes the analytical perspective by treating resilience as the ability of designated entities to prevent, resist, mitigate, respond to and recover from incidents affecting essential services. Its provisions require attention to natural and human-induced threats, cross-sector dependencies, external service relationships and continuity planning, making it particularly relevant to the physical consequences of cyber decisions. An AI-enabled SOC may constitute an important supporting capability within this framework, but the resilience obligation concerns the broader essential service rather than the performance of the monitoring platform alone. A security system that identifies an intrusion correctly but initiates a response that unnecessarily interrupts electricity distribution or industrial safety functions cannot be regarded as operationally successful merely because its detection algorithm met a predefined accuracy threshold.

The directive requires Member States to identify critical entities according to the applicable legal criteria, and Article 12 requires risk assessments addressing relevant threats and dependencies. Article 13 requires appropriate technical, security and organisational measures, including arrangements intended to protect essential services and support recovery. The European Commission’s July 2026 guidelines further develop this integrated approach, emphasising that the effectiveness of an individual measure depends on its interaction with other protective, response and recovery mechanisms. The guidance is non-binding and must not be confused with additional directly applicable regulatory obligations. Directive (EU) 2022/2557 — European Parliament and Council — December 2022; Guidelines on the Application of Article 13(5) of Directive (EU) 2022/2557 — European Commission — July 2026. EUR-Lex+1

The consequential difference for AI governance is that an operator must evaluate the system’s contribution to maintaining the essential service under adverse conditions. This includes circumstances in which security monitoring is degraded, an external AI supplier becomes unavailable, contradictory information is received or an apparently correct cybersecurity action would interfere with an ongoing industrial procedure. A resilience-focused assessment should therefore require evidence of degraded-mode operations, manual recovery capability, supplier substitution where feasible and the preservation of independent process safeguards. These requirements do not imply that every critical entity must maintain an identical backup architecture; they establish the necessity of relating technological dependencies to the actual consequences of service disruption.

The EU Artificial Intelligence Act: Classification Depends on Intended Purpose and Safety Function

The Artificial Intelligence Act introduces a different legal question: whether the particular AI application falls within a category subject to specific regulatory requirements. An AI-enabled SOC is not automatically classified as a high-risk AI system merely because its customer operates critical infrastructure. Annex III, point 2, identifies AI systems intended to be used as safety components in the management and operation of specified critical infrastructure, including critical digital infrastructure, road traffic and the supply of water, gas, heating or electricity. Article 6 and its applicable classification provisions determine how that designation operates, while other high-risk classifications may depend on the AI system’s relationship with products covered by specified Union harmonisation legislation. Consequently, the purpose and function of the AI component, its relationship to safety and the consequences of its failure are material to the legal assessment.

This distinction is especially important for security-monitoring systems whose outputs may indirectly influence operational decisions. An AI tool that produces optional investigative summaries does not necessarily perform the same legal function as an AI system intended to operate as a safety component. Conversely, an AI component integrated into a mechanism that directly protects physical integrity or human safety requires assessment according to its actual intended purpose and applicable provisions, rather than being described as ordinary business-process automation because it is marketed as a cybersecurity product. The consolidated legislative text dated 27 July 2026 contains relevant classification provisions, including clarifications regarding non-safety-related assistance and the circumstances in which failure or malfunction endangers health and safety. The applicable duties and their commencement dates must be assessed against the legislation as amended and the particular deployment. Regulation (EU) 2024/1689, Consolidated Text of 27 July 2026, Article 6 and Annex III — European Parliament and Council. EUR-Lex+1

Where a system is legally classified as high-risk and the relevant provisions apply, the regulatory architecture addresses matters including risk management, data governance, technical documentation, record-keeping, transparency, human oversight, accuracy, robustness and cybersecurity. These obligations can strengthen institutional assurance, but legal classification alone cannot demonstrate that a deployed SOC correctly identifies a process-aware intrusion or responds without physical disruption. The required technical evidence must remain specific to the system’s intended purpose, real operating environment and reasonably foreseeable misuse. A general claim of compliance with the AI Act should therefore be evaluated alongside the actual classification decision, the applicable legal commencement dates, the conformity or other assurance process and records showing that the system performs reliably within its authorised operating conditions.

Maritime Cybersecurity and the Governance of Integrated Operational Systems

Maritime cybersecurity is governed through a combination of international safety-management arrangements, national implementation and applicable cybersecurity legislation. The International Maritime Organization’s approach recognises that corrupted, compromised or unavailable information and systems may produce operational, safety and security failures affecting shipping. This formulation is especially relevant to AI-supported monitoring because maritime cyber risk is not limited to confidentiality breaches or unauthorised data access; it includes the consequences of digital malfunction for the safe operation of vessels and associated activities.

The IMO’s current maritime cyber-risk material identifies MSC-FAL.1/Circ.3/Rev.4 as the relevant guidelines on maritime cyber risk management. The guidelines provide high-level recommendations rather than creating a universal requirement for maritime operators to deploy AI-enabled SOCs. The operative significance of IMO cybersecurity guidance must also be considered in relation to the International Safety Management Code, applicable Maritime Safety Committee decisions, flag-state requirements and the relevant safety-management system. The jurisdiction, vessel or facility type and regulatory status must therefore be established before determining whether a particular technical measure is mandatory. Maritime Cyber Risk — International Maritime Organization. Organizzazione Marittima Internazionale

For maritime operators using AI-supported security monitoring, the principal requirement is to demonstrate that cyber-risk management remains compatible with safe navigation, cargo operations, vessel systems, communications and operational continuity. This includes maintaining accountability when monitoring is supplied by external providers, ensuring that security personnel understand which systems may be affected by their actions and establishing communication procedures between cybersecurity functions and responsible maritime operators. The precise legal framework will differ among shipboard systems, port facilities, terminals and supporting digital infrastructure, making a uniform maritime AI-compliance label legally and operationally inadequate.

National Implementation: Italy, France, Germany and the United Kingdom

Italy: Established Legislative Transposition and the Challenge of Operational Verification

Italy transposed NIS2 through Legislative Decree No. 138 of 4 September 2024, which entered into force on 16 October 2024 and established the national framework for the relevant cybersecurity requirements. The decree identifies the Agenzia per la Cybersicurezza Nazionale as the competent national NIS authority and provides for institutional responsibilities, reporting and the implementation of cybersecurity obligations. Its significance for critical-infrastructure operators is that it establishes a domestic legal framework under which organisational and technical risk-management arrangements can be supervised, rather than leaving the directive’s requirements as an unimplemented European objective. Decreto Legislativo 4 Settembre 2024, n. 138 — Repubblica Italiana — October 2024. Normattiva

The analytical challenge is to determine whether regulated operators have translated these obligations into independently demonstrable improvements in security and resilience. Legal transposition establishes authority and duties, but it does not provide a national dataset demonstrating AI-attributable reductions in detection latency, safer industrial containment or improved recovery performance. For Italian energy, transport and industrial operators, the practical issue is the coordination of cybersecurity governance with engineering, procurement and continuity-management functions. An AI-enabled monitoring system procured to support compliance should be accompanied by evidence identifying its protected assets, authorised functions, external dependencies, testing conditions and mechanisms for preserving safe operations if the model becomes unreliable.

France: Established National Security Structures and the Importance of Legislative Status

France approaches critical-infrastructure cybersecurity through an established national security architecture involving the Agence nationale de la sécurité des systèmes d’information and arrangements for protecting systems of vital importance, alongside the legislative programme intended to implement the European cybersecurity and critical-entity resilience directives. The official legislative material identifies a government bill addressing critical-infrastructure resilience and cybersecurity, while the National Commission on Informatics and Liberty’s 2024 opinion discusses the proposed NIS2 implementation arrangements, including the distinction between essential and important entities and the competence envisaged for ANSSI. The accessible legislative record supports the existence and design of this programme, but does not by itself establish that every proposed provision had become operative law by the assessment date. Projet de loi relatif à la résilience des infrastructures critiques et au renforcement de la cybersécurité — French Legislative Dossier; Délibération 2024-038 du 23 mai 2024 — CNIL. Vie publique+1

The French implementation question is therefore twofold. The first concerns the exact operative requirements, competent authorities and transitional provisions applicable to a particular operator; these must be derived from promulgated legal texts rather than from the policy intentions contained in a bill. The second concerns whether implementation produces effective security outcomes across environments that may already be subject to demanding national arrangements. AI adoption should be evaluated against existing protective capabilities and operational responsibilities, avoiding the assumption that compliance with a new European framework requires replacement of established monitoring systems or deployment of unvalidated automated response functions.

Germany: NIS2 Implementation and the Parallel Development of Physical-Resilience Obligations

Germany’s regulatory position provides an example of the interaction between cybersecurity legislation and critical-infrastructure resilience. According to the Federal Office for Information Security, the German NIS2 Implementation Act entered into force on 6 December 2025, activating applicable registration and reporting requirements and providing a framework for regulated entities to use the BSI’s registration and incident-reporting infrastructure. The BSI also documents the transition arrangements applicable to operators of critical facilities and the distinction between established reporting channels and the newer portal. These records establish concrete implementation measures, rather than merely an announced legislative intention. About NIS-2 — Bundesamt für Sicherheit in der Informationstechnik — 2026. mip2.bsi.bund.de

Germany also brought its critical-infrastructure umbrella legislation, the KRITIS-Dachgesetz, into force on 17 March 2026, establishing a further national framework for the physical resilience of critical facilities. The BSI’s official information distinguishes the competent registration arrangements and identifies the Federal Office of Civil Protection and Disaster Assistance as responsible for relevant critical-facility registration. The coexistence of cybersecurity and physical-resilience obligations is significant because it gives regulators and operators a framework for examining dependencies between digital protective measures, facilities and essential services, but it does not resolve the technical question of whether particular AI-enabled SOC tools improve resilience. Information on the KRITIS-Dachgesetz — Bundesamt für Sicherheit in der Informationstechnik — 2026. mip2.bsi.bund.de

For German operators, the principal implementation challenge is to align cybersecurity control evidence with physical-resilience assessments without allowing the existence of parallel compliance systems to obscure operational gaps. AI-model assurance, supplier concentration and the safety consequences of automated security actions should be assessed as dependencies of the protected service, while the legal allocation of responsibilities must reflect the applicable cybersecurity, physical-resilience and sector-specific frameworks. The existence of registration, reporting and resilience obligations establishes the regulatory basis for oversight, but does not constitute measured proof of a particular improvement in SOC detection or response.

United Kingdom: Risk-Based Security Duties and a Developing Legislative Reform Programme

The United Kingdom operates outside the European Union’s NIS2 transposition system and retains a separate legal framework under the Network and Information Systems Regulations 2018, as subsequently amended. Regulation 10 requires operators of essential services to implement appropriate and proportionate technical and organisational measures to manage risks and minimise the consequences of incidents, while the framework provides for competent authorities and sector-specific oversight. The legislation continued to apply in its amended form during 2026, independently of any proposed further reforms. The Network and Information Systems Regulations 2018 — UK Legislation; Regulation 10 — UK Legislation. legislation.gov.uk

The Cyber Security and Resilience (Network and Information Systems) Bill represents an additional legislative development, with official Northern Ireland Assembly records documenting legislative-consent proceedings during 2026, including an October 2026 debate. Such parliamentary activity demonstrates progress in the legislative process but should not be confused with proof that every proposed reform had entered into force. The operative obligations for a particular operator must be determined from the law in force and any applicable statutory changes, rather than from the objectives of the reform programme. Cyber Security and Resilience (Network and Information Systems) Bill — Northern Ireland Assembly — 2026. niassembly.gov.uk

The UK’s significance for AI-enabled infrastructure security also arises from its national technical guidance and cyber-threat assessment capabilities. These provide a basis for identifying AI-related intrusion risks and appropriate defensive measures, but they do not establish a legal requirement that infrastructure operators delegate incident-response decisions to AI. The relevant test remains whether the adopted monitoring and response architecture satisfies applicable security duties and provides reliable performance under realistic operating conditions.

Table 5.1 — Jurisdictional Regulatory Comparison

The Compliance–Resilience Gap: What Regulators Should Actually Verify

A mature supervisory assessment must distinguish the existence of controls from the observed ability of those controls to reduce the consequences of hostile activity. Policies and procedures remain necessary because they establish authority, accountability and expected behaviour, but a security programme cannot demonstrate effectiveness solely through documentation. For AI-enabled SOCs, this means examining whether the organisation has validated the analytical component against relevant threats, maintained independent evidence, prevented unauthorised execution and demonstrated that security functions continue during model failure or external-service disruption. These tests should be proportionate to the protected service and the potential consequences of an incorrect decision.

The regulatory value of technical assurance is greatest when it tests the interfaces between organisational responsibilities. A cybersecurity team may prove that its response platform can isolate a compromised endpoint, while an industrial engineering team may establish that the endpoint participates in a process that must not be interrupted under certain operating conditions. Neither conclusion is independently sufficient. The supervisory question is whether the organisation possesses a coordinated decision mechanism capable of reconciling both requirements during a real incident. The same principle applies to supplier dependence: a managed AI service may satisfy contractual security provisions, but the infrastructure operator must still demonstrate how essential monitoring will continue if the service is compromised or unavailable.

Table 5.2 — Regulatory Evidence Versus Operational Assurance

The European Commission’s July 2026 critical-entity guidance reinforces the need to examine resilience measures as elements of an integrated system, rather than as independent administrative achievements. The practical implication is that regulatory supervision should request evidence demonstrating how different controls operate together under realistic disruptive conditions. Guidelines on the Application of Article 13(5) of Directive (EU) 2022/2557 — European Commission — July 2026.

Chapter 5

The regulatory assessment establishes that European and British legal frameworks increasingly recognise cybersecurity governance, supply-chain exposure, operational continuity and management responsibility as essential elements of infrastructure protection. The European Artificial Intelligence Act introduces additional requirements where a system falls within its legally defined classifications, including particular safety-related critical-infrastructure applications. These frameworks are complementary but not interchangeable, and none should be interpreted as proof that the deployment of AI automatically improves detection, incident response or physical resilience.

National implementation differs materially. Italy and Germany have verified NIS2 transposition frameworks in force, Germany has also enacted a dedicated critical-infrastructure resilience statute, France’s exact operative obligations must be established from promulgated domestic measures rather than legislative proposals alone, and the United Kingdom maintains its own risk-based statutory regime while pursuing further reform. These differences affect supervision and compliance obligations, but there is insufficient comparable public evidence to rank the four countries by AI-enabled SOC effectiveness or to attribute changes in critical-infrastructure security outcomes to regulatory adoption.

The decisive requirement is to move from evidence that a security measure exists to evidence that it remains effective under realistic hostile conditions. Independent testing, authenticated operational data, control of model updates, restricted execution authority, supplier continuity and verified recovery provide a more meaningful basis for assessing resilience than AI procurement levels or procedural compliance alone.

AI Trust Boundaries, Decision Authority and Regulatory Assurance

The following component integrates the three dimensions of Pillar II into an interactive institutional intelligence dashboard: AI-specific attack surfaces and physical-cyber risk transmission; human–machine decision authority and organisational maturity; and regulatory compliance versus independently demonstrated operational resilience. It incorporates animated three-dimensional architecture, selectable attack mechanisms, an authority matrix, jurisdictional regulatory comparisons for the European Union, Italy, France, Germany and the United Kingdom, and detailed assurance requirements. All relationships are qualitative and evidence-based; no artificial risk scores, fabricated performance statistics or unsupported probabilities are introduced.

Three Independent Conditions for Operational Trust

CONDITION 01
Evidence Integrity

Observations, model inputs and investigative records must retain verifiable provenance and remain independently accessible.

CONDITION 02
Bounded Decision Authority

AI may support analysis, but safety-significant intervention requires explicit permission and engineering-compatible safeguards.

CONDITION 03
Operational Assurance

Compliance evidence must be supplemented by adversarial testing, safe-containment validation and recovery exercises.

01 / THREE-DIMENSIONAL TRUST ARCHITECTURE

From Data Compromise to Physical Consequence

This scheme shows a possible propagation mechanism. It does not claim that every stage necessarily follows from a prior compromise.

TRUST BOUNDARY 01
Data and Telemetry

Industrial observations, event records, engineering context, retrieved documents and external intelligence.

TRUST BOUNDARY 02
Model and Inference

Training data, model artifacts, feature processing, anomaly detection and language-model interpretation.

TRUST BOUNDARY 03
Tools and Execution

Orchestration privileges, investigation tools, detection changes and containment instructions.

TRUST BOUNDARY 04
Physical Operations

Process continuity, engineering authority, safety constraints, essential-service delivery and recovery.

INPUT → INFERENCE → EXECUTION → PHYSICAL CONSEQUENCE

A compromise becomes operationally significant when it crosses an insufficiently protected trust boundary. Independent controls can interrupt this pathway.

02 / INTERACTIVE ADVERSARIAL MECHANISMS

Explore AI-Specific Failure Pathways

Select a mechanism to display its exploitation prerequisite, potential operational consequence and assurance requirements.

Training-Data Poisoning

Attack prerequisite: Influence over approved training inputs, labels, feature-generation processes or model-update datasets.

Failure pathway: Contaminated examples change learned behaviour, potentially normalising unauthorised activity or reducing detection sensitivity.

Operational consequence: An intrusion may remain undetected after the contaminated model becomes part of production monitoring.

Assurance: Provenance controls, immutable reference data, adversarial regression testing, change approval and rollback.

Data integrityModel lifecycleIndependent validation
03 / HUMAN–MACHINE AUTHORITY

Decision and Execution Permissions

Decision authority must be aligned with operational consequence and reversibility, rather than with a model’s reported confidence alone.

Function	AI role	Human authority	Control boundary
Telemetry enrichment	Automated data processing	Security engineering oversight	Read-only analytical access
Alert classification	Prioritisation and correlation	SOC analyst reviews consequential findings	Original evidence must remain accessible
Threat hunting	Approved queries and evidence retrieval	Investigation lead defines scope	Restricted investigative permissions
Enterprise containment	Pre-authorised bounded execution	Incident commander	Verified action scope and rollback
Industrial network isolation	Evidence and response recommendation	OT engineer and authorised operator	No unrestricted autonomous execution
Controller configuration	Change analysis and anomaly identification	Qualified industrial engineering authority	Independent operational change control
Safety-critical intervention	Decision support only	Designated safety and operations authority	Independent safety mechanisms retained
Recovery acceptance	Evidence reconciliation	Incident command and operational management	Verified security and process restoration

04 / INTERACTIVE REGULATORY COMPARISON

Legal Frameworks and Operational Evidence

Select a jurisdiction to distinguish operative regulatory requirements from the additional assurance evidence needed to establish actual resilience.

European Union

NIS2 establishes cybersecurity risk-management and incident-reporting obligations; the Critical Entities Resilience Directive addresses essential-service continuity; the AI Act applies according to system classification and applicable provisions.

Union frameworks require distinct analyses of entity scope, national implementation, intended AI purpose and relevant implementation dates.

Required Operational Assurance

Independent detection testing, safety-compatible response procedures, supplier continuity, model assurance and demonstrated recovery capability.

Regulatory conformity does not by itself establish improved production SOC detection or response outcomes.

Documentation Versus Demonstrated Resilience

Formal evidence	Established fact	Additional assurance requirement
Security policy	Approved responsibilities and procedures	Tested incident decisions and operational outcomes
AI risk assessment	Documented evaluation of specified risks	Adversarial testing against relevant failure modes
Monitoring platform	Deployed analytical capability	Ground-truth detection and missed-event evaluation
Supplier agreement	Contractual allocation of responsibility	Outage exercises, access assurance and recovery tests
Incident notification	Formal reporting capability	Validated detection-to-containment performance
Staff training	Participation and recorded completion	Demonstrated competence under degraded conditions
Business continuity plan	Documented recovery intentions	Observed restoration of essential functions

Technical and Regulatory Documentation

NIST, March 2025:
Adversarial Machine Learning — AI 100-2 E2025.

NIST, July 2024:
Generative AI Risk Management Profile.

Italy:
Legislative Decree 138/2024.

France:
Critical Infrastructure and Cybersecurity Legislative Dossier.

Germany:
BSI NIS2 Implementation Information.

United Kingdom:
Network and Information Systems Regulations 2018.

Pillar II — Final Assessment: The decisive question is not whether artificial intelligence increases the volume or speed of security analysis, but whether the complete defensive system remains trustworthy when its evidence, model, supplier or execution mechanism is compromised. Technical assurance must preserve independent observations and bounded execution; institutional governance must preserve qualified human authority; regulatory supervision must verify operational outcomes rather than treating formal compliance as sufficient evidence of resilience. The three requirements are mutually reinforcing and should be evaluated together when determining whether AI deployment materially improves the protection of critical infrastructure.

Chapter 6 — Sector-Specific Resilience: Energy, Maritime, Subsea and Industrial Control Systems

Principal Judgment: Physical Interdependence Determines the Strategic Value of AI-Enabled Cyber Defence

The resilience of critical infrastructure cannot be evaluated through the performance of its cybersecurity monitoring systems independently of the physical processes, external services and engineering constraints that determine whether essential functions can continue during an intrusion. Energy networks, maritime transport, subsea communications, industrial manufacturing and transport-control environments share a dependence on digital systems, but their exposure to cyber disruption is not uniform, and the relationship between a detected anomaly and an appropriate response differs according to the operating characteristics of each sector. Artificial intelligence can contribute to the protection of these environments by improving the analysis of complex relationships, identifying unusual combinations of events and supporting decisions involving dispersed technical information; nevertheless, its contribution becomes strategically meaningful only when it improves the operator’s ability to prevent or limit a consequential interruption, preserve safe operating conditions and restore services within acceptable operational constraints. A monitoring system that accurately identifies suspicious behaviour but cannot distinguish safe from unsafe containment actions provides information rather than operational resilience, while an automated system that responds rapidly without understanding the physical consequences of its intervention may introduce an additional failure mechanism into infrastructure that is already exposed to external dependencies.

The most consequential structural characteristic of modern critical infrastructure is the convergence of historically separate operating environments. Electricity systems depend on telecommunications and specialised control networks; maritime terminals depend on logistics platforms, industrial equipment and access-control systems; subsea telecommunications and power connections support international connectivity and energy exchange; and industrial production relies increasingly on remote maintenance, supplier software and centrally managed digital services. These relationships create opportunities for attackers to exploit supporting systems that are more accessible than the physical infrastructure itself, while complicating the responsibility of defenders who must determine whether an apparently local cybersecurity event could affect other operational domains. The strategic significance of AI is therefore partly associated with its potential to identify relationships across multiple technical environments, but this capability depends on the completeness of infrastructure maps, the integrity of the observations supplied to the model and the availability of engineering knowledge about the consequences of failure.

The ENISA Threat Landscape 2026 — European Union Agency for Cybersecurity — September 2026 provides an important indication of the broader European threat environment. Based on events observed during calendar year 2025, the agency reported that 73% of targeted organisations belonged to categories of essential or important entities under NIS2, while transport accounted for approximately 8% of recorded sectoral targeting and manufacturing for 7%. Public administration remained the largest reported category at 32%. These figures describe the distribution of documented cyber events in ENISA’s collection, not the probability of successful compromise, the proportion of essential services disrupted or the effectiveness of AI-enabled defensive systems. Their significance is that essential and important entities constitute a substantial part of the observed threat environment, while the distribution of recorded events cannot be interpreted as a direct ranking of physical or economic consequences. ENISA+1

Principal judgment — High confidence: The effectiveness of AI-supported infrastructure defence is constrained by sector-specific physical requirements and cross-sector dependencies. Consequential judgment — Medium confidence: Advanced cross-pported by reliable engineering context, but there is insufficient independent production evidence to quantify the resulting reduction in physical-service disruption

Energy Infrastructure: Reliability, Process Stability and the Limits of Rapid Containment

Electricity infrastructure illustrates the difference between conventional cybersecurity performance and the protection of a continuously operating physical system. Generation facilities, transmission networks, distribution systems and associated supporting services possess different operational architectures, but they share requirements for equipment protection, system availability and the controlled execution of operational changes. In an enterprise network, the isolation of a compromised workstation may be a routine security intervention; in an electricity-control environment, disabling a communications path or interrupting a management connection can create consequences that depend on the equipment, local automation, operating conditions and availability of alternative control mechanisms. The security objective is therefore not to execute every protective action as quickly as possible, but to select an intervention whose expected reduction in hostile capability exceeds its potential to destabilise legitimate operations.

This creates a need for engineering-aware incident classification. A suspicious change to the configuration of a control device, for example, cannot be evaluated solely by identifying that an unusual file operation occurred or that a previously unseen administrative session was established. The SOC must determine whether the activity was authorised, whether the equipment configuration has changed, whether the relevant operational process is affected and whether immediate intervention would protect or impair service continuity. AI-supported investigation can assist by correlating technical evidence from different systems, but the conclusion must remain constrained by authoritative equipment inventories, operating procedures and engineering records. Where these are incomplete, automated analysis risks confusing the absence of recorded abnormal behaviour with the absence of operational danger.

The United States Department of Energy’s Cybersecurity Capability Maturity Model, Version 2.1, provides a relevant institutional reference because it addresses cybersecurity practices across both information-technology and operational-technology environments, including risk management, architecture, third-party dependencies, threat management and situational awareness. Its 2022 revision was developed with industry involvement and validated through practical feedback, including participation by 145 cybersecurity specialists representing 77 organisations. These figures establish the scale of the model’s development process, not the effectiveness of AI-enabled SOCs. The model is useful because it allows operators to examine how security capabilities relate to the broader organisational arrangements required to protect energy infrastructure. Department of Energy Releases Version 2.1 of the Cybersecurity Capability Maturity Model — US Department of Energy — June 2022. Department of Energy

A further issue concerns the operational meaning of recovery. Restoring a digital connection does not necessarily establish that an electricity-related process has returned to a safe and authorised condition. An operator may need to verify equipment configuration, protection settings, communications integrity and the validity of operational measurements before accepting restoration. This requirement becomes especially important when an incident involves the loss or manipulation of engineering data, because a recovered system may still contain unauthorised changes. In June 2026, the National Institute of Standards and Technology published its Operational Technology Backup Quick Start Guide, emphasising that effective backups must be incorporated into change management, regularly created, tested and reviewed during recovery exercises. The guidance explicitly recognises that inadequate OT recovery can produce prolonged downtime, financial losses and safety consequences. OT Backup Quick Start Guide, NIST SP 1339 — National Institute of Standards and Technology — June 2026. CSRC

The implication for AI procurement is that the value of faster cyber analysis must be assessed alongside the operator’s ability to reconstruct and validate the physical operating environment. An AI-enabled SOC that identifies a compromised engineering workstation but lacks reliable configuration backups, independent safety controls or access to competent operational personnel may provide earlier warning without materially shortening the period of service disruption. Conversely, an operator possessing well-tested restoration procedures can translate earlier detection into a meaningful operational advantage. The relationship between monitoring quality and recovery capability is therefore complementary rather than substitutable.

Maritime Infrastructure: Operational Fragmentation and the Security of Interconnected Systems

Maritime cybersecurity differs from the protection of a single industrial installation because responsibility is distributed among vessels, port authorities, terminal operators, shipping companies, logistics providers, communications suppliers and external technology contractors. These participants may operate different digital platforms and be subject to different regulatory or contractual arrangements, yet their activities converge during vessel arrival, cargo handling, terminal management, documentation processing and other operational procedures. A cyber incident affecting one participant may therefore create disruptions beyond its immediate digital environment, even where the attacker has not compromised the industrial equipment responsible for cargo movement or vessel operations. The relationship between a business-system failure and a physical-service interruption depends on operational workarounds, manual procedures, the criticality of affected information and the degree of integration between administrative and operational platforms.

Artificial intelligence offers potential value in analysing distributed events associated with these dependencies, including unusual remote access, supplier activity and suspicious relationships between enterprise and industrial systems. However, the available evidence does not demonstrate that the adoption of AI by a port or vessel operator produces a quantified reduction in operational downtime. A port terminal’s security programme may possess advanced monitoring of enterprise infrastructure while retaining limited visibility into specialist handling equipment, contractor-managed systems or legacy control networks. A shipboard monitoring system may receive security information subject to communications limitations or operational procedures that prevent continuous interaction with a central SOC. These variations make universal automation targets inappropriate and require performance to be evaluated against the specific technical and operational functions of each installation.

The International Maritime Organization’s maritime cyber-risk framework defines the relevant concern in terms of potential operational, safety or security failure resulting from information or systems being compromised, corrupted or lost. Its published material identifies MSC-FAL.1/Circ.3/Rev.4 as the current guidelines on maritime cyber-risk management, establishing high-level expectations for identifying, assessing and addressing cyber risks while preserving safe and secure shipping. These guidelines do not require the installation of a specific AI product or establish that autonomous response is appropriate for operational systems. Maritime Cyber Risk — International Maritime Organization. Organizzazione Marittima Internazionale

The strategic vulnerability is frequently located at the boundary between technical responsibility and operational authority. A managed cybersecurity provider may detect suspicious behaviour on a network serving a terminal, while the decision to isolate that network may depend on equipment operators, port management or maritime safety procedures. A model-generated recommendation that does not identify the equipment affected, the operational process involved and the consequences of communication loss is therefore insufficient for a high-consequence intervention. Effective resilience depends on predefined operational escalation, tested continuity procedures, supplier cooperation and the capacity to maintain essential functions while the security incident is investigated.

Subsea Infrastructure: Strategic Dependencies, Detection Limits and the Distinction Between Cyber and Physical Events

Subsea communications and power infrastructure create a different class of resilience problem because the essential asset may be geographically remote, physically inaccessible for extended periods and dependent on specialised landing stations, terrestrial networks, power systems, maintenance contractors and international coordination. Artificial intelligence can assist in analysing network or equipment telemetry associated with these systems, but the identification of abnormal behaviour at a monitoring point does not necessarily establish the cause of an incident along a submarine route. A loss of service may result from physical damage, equipment failure, terrestrial-network disruption or malicious interference, and the analytical system must avoid equating abnormal technical observations with a particular attribution or attack mechanism.

The European Union has developed a more explicit policy framework addressing these dependencies. On 21 February 2025, the European Commission and the High Representative adopted the EU Action Plan on Cable Security, building on Commission Recommendation (EU) 2024/779 concerning secure and resilient submarine cable infrastructure. In October 2025, the Submarine Cable Infrastructures Expert Group published an EU risk assessment incorporating mapping and stress-testing guidance. On 5 February 2026, the Commission published the Submarine Cable Security Toolbox and Cable Projects of European Interest, with a corrected version of the report released on 16 March 2026. The framework addresses prevention, detection, response, recovery and deterrence across telecommunications and electricity cable infrastructure, and identifies dependencies and mitigation measures relevant to investment decisions. Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission — February 2026. Shaping Europe’s digital future

These developments are strategically significant because they recognise that subsea resilience requires more than monitoring the digital endpoints of a cable system. Redundant routing, repair capability, physical protection, cooperation among operators and the availability of alternative connectivity may determine the ultimate consequences of disruption. AI-supported anomaly detection can potentially assist in identifying unusual equipment or network conditions, but it cannot restore a physically damaged cable or eliminate the logistical limitations associated with offshore inspection and repair. The relevant measure of operational effectiveness must therefore include the relationship between early warning, independent confirmation, rerouting capability and restoration of the affected service.

The European Commission’s 17 July 2026 call for support to EU policy on submarine cable security further demonstrates that this remains an active area of institutional development, including assessment of existing and planned infrastructure and assistance with projects intended to improve resilience. The existence of a funding or procurement initiative is evidence of policy implementation, not of completed deployments or measured reductions in outage duration. Support for EU Policy on Security of Submarine Cable Infrastructure 2026–2027 — European Commission — July 2026. Shaping Europe’s digital future

For the AI-enabled SOC, the resulting operational requirement is to distinguish what can be inferred from cyber telemetry from what requires physical investigation or independent infrastructure data. A suspicious configuration change at a landing station, an unexpected management session and a loss of connectivity along a submarine route may be related, but correlation alone does not establish causation. National authorities, infrastructure owners and telecommunications or electricity operators should preserve the ability to distinguish accidental damage, equipment malfunction and deliberate interference before making consequential attribution or response decisions.

Industrial-Control Systems: Legacy Equipment, Configuration Integrity and Safe Degraded Operations

Industrial-control infrastructure introduces a further limitation because equipment, protocols and maintenance arrangements may remain operational long after the technologies used to monitor them have changed. Replacement of a monitoring platform can be comparatively straightforward, while replacement of industrial controllers, protective equipment or specialised engineering software may require extensive testing, vendor support and production interruption. This produces an asymmetry between the speed of AI software development and the pace at which physical infrastructure can be modified, creating opportunities for analytical improvement but also the possibility that security tools become dependent on data or interfaces that older installations cannot reliably provide.

The critical distinction is between discovering a suspicious digital event and establishing whether the industrial process is operating within authorised parameters. A technically valid controller command may be malicious because of its timing or physical effect, while a statistically unusual sensor reading may reflect legitimate process change or an equipment fault. AI models can examine relationships among variables, but the reliability of their conclusions depends on their representation of engineering constraints and the trustworthiness of the measurements received. Where monitoring is incomplete, the addition of a more sophisticated analytical layer does not eliminate the underlying visibility gap.

NIST’s September 2023 Guide to Operational Technology Security, Revision 3 establishes the final technical baseline for addressing these conditions, including the security of systems interacting directly with physical environments. Its initial public draft of Revision 4, published in September 2026, expands the treatment of contemporary industrial and transport-related environments but had not superseded Revision 3 at the assessment cut-off. These publications reinforce the need to select safeguards according to system-specific performance, reliability and safety requirements rather than applying enterprise security controls without modification. Guide to Operational Technology Security, Revision 3 — NIST — September 2023; Operational Technology Security Publications and Revision Status — NIST — 2026. CSRC+1

Table 6.1 — Sector-Specific Resilience and Operational Constraints

The table describes sector-specific mechanisms and the evidence required to evaluate resilience; it does not imply that identical AI functionality has been deployed across every listed sector.

Cross-Sector Consequences and the Concentration of Critical Dependencies

The strategic vulnerability of interconnected infrastructure arises when disruption in one sector reduces the capacity of another to prevent, contain or recover from an incident. Electricity supports telecommunications, ports, industrial facilities and many monitoring installations; telecommunications enable remote supervision, emergency coordination and external security services; transport and maritime logistics support maintenance and the delivery of specialised equipment. These dependencies are not necessarily visible within an individual organisation’s conventional asset inventory, because the relevant infrastructure may be operated by another entity or governed by a separate contractual arrangement. Consequently, an AI-enabled SOC that monitors only the assets directly owned by its organisation may identify the immediate technical symptoms of disruption without recognising the external dependency responsible for them.

This creates an important distinction between analytical centralisation and operational resilience. A centralised monitoring service may improve the correlation of events across a complex organisation, but the concentration of analysis, infrastructure management and execution authority within a common platform can also create dependence on that platform. A model or provider failure could then affect several operational domains simultaneously, even when their underlying industrial systems remain independent. The resilience advantage of centralised analysis must therefore be balanced against the ability of local operators to continue safe operations and conduct essential investigations without the central service.

The European Commission’s 2026 submarine cable work and the US Department of Energy’s cybersecurity capability model both recognise dependencies as relevant elements of infrastructure protection, although they address different technical and institutional environments. The resulting analytical conclusion is that cross-sector AI monitoring should prioritise accurate dependency mapping and independently verified evidence rather than attempting to transform every correlated event into a single automatically determined cause. Submarine Cable Security Toolbox — European Commission — February 2026; Cybersecurity Capability Maturity Model — US Department of Energy. Shaping Europe’s digital future+1

Chapter 6

The sectoral evidence establishes that critical-infrastructure resilience depends on the physical and organisational conditions under which cyber incidents occur. Energy operations require reliable equipment protection and safe restoration; maritime systems require coordination across distinct operational authorities; subsea infrastructure depends on physical access, routing and repair capabilities; and industrial-control environments require the protection of configuration integrity and process stability. AI can potentially improve the interpretation of information across these systems, but its operational value remains contingent on accurate asset context, independent safeguards and effective recovery mechanisms.

The assessment would become more favourable if operators demonstrated that AI-supported detection translated into earlier, safer intervention and reduced interruption of essential services under independently evaluated conditions. It would weaken if expanded analytical centralisation produced correlated monitoring failures, unsafe containment or reduced local recovery capability. The most consequential outstanding evidence consists of complete operator incident timelines, tested physical recovery performance, comparative evaluations of cross-sector monitoring and documented outcomes under degraded communications or external-service failure.

Chapter 7 — Three Strategic Scenarios for 2028–2030

Principal Judgment: The Strategic Outcome Will Be Determined by Assurance Maturity, Not the Rate of AI Adoption

The trajectory of artificial intelligence in critical-infrastructure security through 2030 is best understood as a competition between increasing analytical capability, adversarial adaptation and the institutional capacity to control the consequences of automation. Three scenarios capture the principal strategic alternatives without presuming that AI development, attacker capability or regulatory implementation will advance uniformly across countries and sectors. Under the first pathway, independently validated AI functions strengthen defensive operations while additional risks remain bounded by engineering controls and effective governance. Under the second, offensive and defensive automation advance sufficiently rapidly that their gains largely offset one another, preserving persistent pressure on legacy infrastructure and organisations with limited security resources. Under the third, widespread adoption without adequate model assurance, supply-chain governance or operational safeguards creates concentrated dependencies and increases the potential for correlated defensive failure. These scenarios are conditional descriptions of possible futures, not statistically derived forecasts, and assigning numerical probabilities would create a misleading impression of precision because reliable base rates for AI-attributable operational outcomes are not available.

The scenario structure is supported by the direction of government assessments, although its specific outcomes remain analytical judgments. The UK National Cyber Security Centre’s November 2026 assessment considers three plausible trajectories through 2028, including a baseline of increasing AI-enabled cyber threats, a pessimistic pathway in which offensive capability outpaces defensive adaptation and an optimistic pathway in which defensive measures develop sufficiently to constrain the threat. The agency specifically identifies the potential exploitation of vulnerabilities in legacy critical national infrastructure and additional attack surfaces arising from the deployment of AI within protected environments. Its scenarios are explicitly not predictions. Artificial Intelligence and Cyber Intrusion — UK National Cyber Security Centre — November 2026. National Cyber Security Centre

The European threat environment provides a second relevant baseline. ENISA’s September 2026 assessment identifies ransomware, cybercrime, geopolitically influenced activity and the increasing importance of interconnected service dependencies, while anticipating greater adversarial use of emerging AI models. These findings reinforce the need to evaluate AI deployment against existing intrusion mechanisms and infrastructure vulnerabilities rather than assuming that AI will replace conventional cyber threats. Exploring the Evolution of the Cyber Threat Landscape: How Dependencies Weaken Our Digital Resilience — ENISA — September 2026. ENISA

Scenario A — Governed AI Becomes a Net Defensive Force Multiplier

Under the first scenario, operators introduce AI selectively into security functions where independently evaluated performance demonstrates an advantage over conventional methods, while maintaining restrictions on model execution and the authority to make consequential operational decisions. The decisive improvement is not the automation of the greatest possible proportion of SOC work, but the creation of a more reliable relationship between available security evidence, investigative conclusions and safe operational intervention. Models would be evaluated against representative attack scenarios and relevant operating states; critical detections would remain traceable to original observations; model updates would be tested before entering production; and engineering personnel would retain authority over interventions affecting industrial processes. This architecture could allow analysts to devote more attention to sophisticated intrusion sequences while reducing the time spent on repetitive information processing, provided that the time saved translates into demonstrable improvements in verified detection and containment.

The scenario also requires substantial investment in the assurance infrastructure surrounding AI. Organisations would need protected reference datasets, controlled adversary-emulation environments, procedures for evaluating changes in model behaviour and mechanisms for maintaining essential monitoring when an AI service is unavailable. Where relevant, digital twins and hardware-in-the-loop facilities could support the examination of security responses without exposing production equipment to unnecessary risk, but such facilities would themselves require careful validation against the characteristics of the systems they represent. Their existence would not automatically prove operational fidelity, particularly where physical processes include complex interactions, ageing equipment or conditions not represented in the test environment.

Energy operators could benefit from improved correlation of engineering and network observations, maritime operators from better analysis of distributed supplier and operational activity, subsea infrastructure operators from stronger interpretation of supporting-system telemetry, and industrial manufacturers from more effective recognition of unusual controller or engineering relationships. These benefits would remain bounded by the extent to which the operator can maintain authoritative context and independently verify the conclusions generated by AI. The decisive indicator of progress would be a reproducible improvement in the proportion of consequential intrusions identified before harmful operational effects, together with a reduction in the time required for safe containment and no corresponding increase in intervention-induced disruption.

Scenario assessment — Medium confidence as a technically plausible pathway; low confidence in any universal cross-sector adoption outcome. The relevant technical and organisational foundations exist, but the public record does not yet establish whether they will be implemented consistently enough to produce a sustained net improvement in overall infrastructure resilience through 2030.

Scenario B — Offensive and Defensive AI Capabilities Remain in Rough Parity

Under the second scenario, improvements in automated detection, investigation and vulnerability management are substantially offset by adversarial gains in reconnaissance, exploitation, identity compromise and the ability to adapt intrusion techniques. Defensive organisations may process alerts more efficiently and improve recognition of certain attack sequences, yet attackers may exploit newly identified vulnerabilities more rapidly, attempt greater numbers of intrusions or use increasingly convincing deception to obtain legitimate access. The result would not necessarily be an increase in the success rate of every attack or a failure of defensive AI. Instead, the aggregate security environment could remain persistently contested because greater defensive productivity is matched by an expansion of adversarial activity and continuing exposure in difficult-to-maintain infrastructure.

This pathway is particularly plausible where organisations possess modern monitoring platforms but remain dependent on legacy operational equipment, external suppliers or incomplete asset inventories. An AI system may rapidly identify suspicious activity while the operator still requires extended testing or coordination before remediating the underlying weakness. Adversaries can exploit this gap by concentrating on installations whose technical and organisational constraints delay corrective action. The relevant competitive variable is therefore the relationship between vulnerability exposure, intrusion progression and the operator’s ability to intervene, rather than the absolute sophistication of either side’s AI systems.

In energy and industrial operations, this scenario would preserve the importance of conventional segmentation, privileged-access management, maintenance controls and recovery preparation. In maritime infrastructure, continued exploitation of supplier relationships and interconnected operational systems could offset improvements in centralised security analysis. In subsea infrastructure, enhanced digital monitoring could improve the interpretation of incidents without eliminating physical vulnerabilities, external dependencies or restoration constraints. Organisations might consequently report higher levels of automation and improved workflow productivity while continuing to experience serious incidents, a pattern that would not establish the failure of AI but would indicate that its contribution is being absorbed by the changing threat environment.

The observable signs of this pathway would include increasing attacker automation alongside improved defensive analytical capacity, persistent exploitation of known vulnerabilities, little sustained change in the occurrence of consequential service interruptions and continued reliance on specialist human investigation for complex incidents. The strongest evidence would come from longitudinal studies that compare attack progression and response outcomes under consistent definitions rather than counting deployed AI products or total alerts.

Scenario assessment — Medium confidence as a credible competitive equilibrium. Both offensive and defensive advances are documented, but the evidence does not establish the rate at which their effects will offset one another or whether particular infrastructure sectors will experience a persistent advantage for either side.

Scenario C — Poorly Governed Automation Produces a Net Increase in Systemic Risk

The third scenario assumes that deployment incentives favour rapid integration, extensive automation and dependence on shared AI infrastructure before the associated assurance mechanisms mature. Organisations may adopt AI-supported SOC platforms to reduce staffing pressure, satisfy procurement objectives or demonstrate technological modernisation, while failing to test the reliability of model-generated conclusions under adversarial conditions. Security operations could become increasingly dependent on common providers, centralised inference services, automated response mechanisms and model-generated investigative records. Under these conditions, a vulnerability affecting a shared service or widely used model integration could impair multiple defensive functions, and analysts might have insufficient independent evidence or practical authority to recognise and correct the resulting failure.

The principal systemic mechanism would be the convergence of operational dependencies that were previously more independent. If alert prioritisation, threat hunting, investigation and containment rely on a common analytical infrastructure, compromise or malfunction of that infrastructure could affect several protective functions simultaneously. The immediate result might be the suppression of relevant observations, misleading investigative conclusions, unauthorised response recommendations or the loss of essential monitoring capacity. In critical infrastructure, the consequences would depend on whether independent safety systems, local operational controls and recovery mechanisms remain effective. The scenario therefore does not assume that an AI failure automatically produces physical damage; it identifies conditions under which an analytical failure could propagate into a consequential operational decision or reduce the operator’s ability to manage a separate incident.

The investment consequences would be substantial because remediation after widespread adoption may require redesign of execution permissions, replacement of supplier integrations, reconstruction of model provenance, revalidation of detection systems and restoration of analyst competence. Organisations that have reduced conventional investigative capabilities could face additional difficulty recovering from a compromised AI environment, while regulators might discover that documentary compliance provides insufficient insight into common-mode dependencies. The most consequential institutional response would be to establish enforceable boundaries on high-impact automation and require independently demonstrated continuity and recoverability before delegating additional authority to AI systems.

Observable indicators of this pathway would include repeated failures associated with common AI providers, material discrepancies between model-generated findings and original evidence, increasing dependence on unvalidated automated containment, security incidents triggered or amplified by model updates, and the inability of operators to conduct essential monitoring without external AI services. A pattern of such observations would provide stronger evidence of systemic deterioration than a simple increase in the number of reported cyber incidents, since reporting volumes can change because of improved visibility or regulatory disclosure requirements.

Scenario assessment — Medium confidence as a plausible downside pathway, with low confidence in its eventual prevalence. The underlying failure mechanisms are technically credible and recognised in official adversarial-machine-learning and infrastructure security guidance, but their aggregate effect on production critical-infrastructure resilience has not been established.

Comparative Scenario Assessment

Scenario Transition Indicators and Decision Thresholds

The scenarios become useful for public authorities and infrastructure operators only when they are connected to observable evidence capable of changing an assessment. The appropriate indicators should measure the complete security and operational chain rather than the adoption of AI as a technology category. This requires stable definitions of what constitutes an intrusion, a consequential missed event, safe containment and operational recovery, together with a means of distinguishing changes in real performance from changes in reporting practice. Where representative historical data do not exist, initial threshold values should be derived from an operator’s own baseline, documented risk appetite and engineering safety requirements; imposing arbitrary universal percentages would be misleading.

Table 7.1 — Strategic Indicators Through 2030

These indicators should be interpreted together. An improvement in detection coverage accompanied by a deterioration in recovery performance does not establish a net gain in resilience, while a reduction in recorded incidents may reflect weaker monitoring rather than improved security. The strongest signal of progress towards Scenario A would be a sustained improvement in multiple independent outcomes, particularly the detection of consequential intrusions, safe intervention and physical recovery. The strongest signal of Scenario C would be evidence that increased automation is creating correlated failures or reducing the ability to operate independently of AI services.

Chapter 7

The three scenarios demonstrate that technological capability does not determine institutional outcomes independently of governance, infrastructure design and operational competence. Governed AI could provide a sustained defensive advantage where its performance is independently validated and its authority remains bounded; rough parity could emerge where attacker efficiency improvements offset defensive gains; and systemic risk could increase where rapid deployment creates concentrated dependencies and weakens independent decision capability. The public record supports the technical plausibility of all three pathways, but does not justify assigning numerical probabilities or presenting a universal winner in the attacker–defender competition.

The most decisive uncertainty concerns whether operators will invest in assurance, engineering integration and human expertise at a rate sufficient to match the expansion of AI functionality. By 2030, the maturity of these supporting capabilities is likely to be more informative than the number of AI products installed within an SOC.

Chapter 8 — Strategic Investment, Regulatory Options and Final Net Assessment

Principal Judgment: Investment Should Be Governed by Demonstrable Risk Reduction and Safe Operational Outcomes

The principal investment decision facing critical-infrastructure operators is not whether artificial intelligence should become part of cybersecurity operations, but which functions justify its introduction, what independent safeguards must accompany it and how its performance can be assessed against the continuity requirements of the protected service. A deployment programme organised around the number of automated workflows, purchased AI capabilities or reported reductions in analyst workload risks confusing technological adoption with security improvement. Conversely, a programme that treats AI as an additional analytical capability within an independently secured operating architecture can evaluate investment according to measurable detection outcomes, response effectiveness and the consequences of failure. The relevant economic question is whether the benefits of improved analysis, reduced repetitive work and earlier detection exceed the capital, operating and assurance costs of the system, including the potential consequences of incorrect decisions, loss of external services and the need to retain specialist human competence.

This requires a different approach to investment appraisal from one based primarily on licence costs and conventional SOC productivity. A model may reduce the time required to prepare incident summaries while introducing expenditure on inference infrastructure, integration, data governance, model testing, access management and supplier continuity. Those expenditures should not automatically be interpreted as inefficient overhead; they are part of the cost of obtaining a reliable security capability. However, their necessity does not justify unlimited spending, and operators should distinguish assurance measures that directly reduce consequential failure modes from controls that primarily produce documentation. The financial benefit of automation must therefore be compared with both a realistic conventional-security alternative and the fully assured cost of the proposed AI deployment.

The US Department of Energy’s C2M2 provides a practical foundation for organising such investment because it treats cybersecurity as a portfolio of capabilities rather than a collection of individual products. Its coverage of architecture, risk management, third-party risk and situational awareness allows operators to identify weaknesses that could prevent advanced analytical tools from producing operational value. NIST’s guidance on OT backup and recovery provides a complementary foundation for evaluating whether improved detection can be converted into successful restoration after an incident. Cybersecurity Capability Maturity Model — US Department of Energy; OT Backup Quick Start Guide — NIST — June 2026. Department of Energy+1

Principal judgment — Medium–high confidence: The most defensible investment sequence is to establish trustworthy monitoring and recoverability before expanding autonomous execution, and to require independently demonstrated operational benefits before granting AI greater authority over consequential cybersecurity actions.

Investment Architecture: From Essential Infrastructure to Advanced Analytical Capability

The order of investment matters because advanced AI functions cannot compensate reliably for missing observations, unverified equipment relationships or inadequate recovery procedures. An operator with incomplete asset records and poorly controlled remote access may obtain greater immediate protection by correcting those weaknesses than by deploying a sophisticated investigation model, while an operator with mature monitoring and response processes may benefit more substantially from machine-assisted correlation and advanced threat hunting. The investment programme should therefore begin with an assessment of the limitations that constrain the organisation’s current ability to detect and respond to consequential incidents, followed by evaluation of whether the proposed AI capability addresses those limitations.

The financial structure of a deployment should distinguish initial integration expenditure from recurring operational costs and assurance liabilities. Initial expenditures may include infrastructure design, telemetry integration, model configuration and the development of representative validation environments. Recurring expenditure may include inference capacity, licences, specialist analysts, testing personnel, data management, supplier assurance and periodic revalidation. Contingent costs may arise from emergency model replacement, supplier outages, investigation of unreliable outputs or the need to restore conventional security capabilities. None of these categories supports a universal cost estimate without operator-specific procurement, staffing and infrastructure data. A defensible investment appraisal must therefore use actual contractual costs, resource requirements and measured operational baselines rather than applying arbitrary percentages to a generic SOC budget.

Table 8.1

The relationship among these investments is cumulative rather than interchangeable. Improved model accuracy does not eliminate the need for segmentation, while stronger supplier contracts do not replace the requirement to test continuity under actual service failure. The most effective portfolio is therefore the one that addresses material constraints along the complete intrusion-to-recovery pathway, rather than concentrating resources on a single advanced technology.

Procurement Assurance and the Allocation of Supplier Responsibility

Procurement of AI-enabled SOC technologies should distinguish declared capability, independently tested performance and the results obtained after deployment in the operator’s environment. A supplier may legitimately provide technical benchmarks, reference architectures and evidence of security testing, but those records must be assessed according to their scope and limitations. Performance obtained from a controlled demonstration should not be represented as equivalent to performance under industrial operating conditions, particularly when the demonstration lacks representative benign activity, incomplete telemetry or constraints on response authority. The procurement process should therefore require a documented statement of intended functionality, data dependencies, model-update arrangements, operational permissions and the consequences of supplier failure, together with acceptance tests that reproduce the operator’s material security and engineering conditions.

Contractual responsibilities are especially important when AI functions depend on external model services or managed security providers. The operator should be able to determine which entity controls model changes, who can inspect security-relevant records, how incidents involving the AI infrastructure will be investigated and what happens when the provider changes the service or cannot maintain availability. A contract should also establish how sensitive telemetry is handled, whether information can be used for model improvement, which subcontractors participate in processing and how access is terminated or transferred. The degree of contractual protection needed will depend on applicable law, the service model and the consequences of disruption, but the underlying principle is that the outsourcing of technical functions does not automatically transfer responsibility for protecting an essential service.

The practical procurement decision should be staged. An initial deployment can provide read-only analysis and evidence enrichment, followed by operational validation under representative conditions. Additional automation may then be considered where the organisation can demonstrate that specific actions are reliable, sufficiently reversible and subject to effective authority controls. This approach is preferable to procuring a fully autonomous workflow before determining which functions can safely be delegated. It also preserves reversibility: an operator can withdraw or replace an AI component without necessarily redesigning the entire security and industrial-control environment.

Table 8.2 — Procurement Acceptance Requirements

Regulatory Supervision: From Control Documentation to Verified Performance

Regulators responsible for critical infrastructure should assess whether AI introduces risks that are inadequately captured by conventional compliance evidence, while avoiding the assumption that the technology requires identical supervisory measures in every sector. The appropriate level of assurance depends on the system’s intended purpose, execution authority, data dependencies and potential consequences of malfunction. An AI tool used solely for summarising incident records requires a different assessment from a system authorised to change protective controls or initiate containment affecting industrial operations. This distinction is consistent with the risk-based character of cybersecurity governance and with the need to preserve proportionality in supervisory requirements.

Supervision should focus on evidence that directly addresses the ability of an operator to maintain essential functions under hostile or degraded conditions. Where an AI system performs security-critical classification, the regulator may reasonably seek evidence that relevant attack classes have been tested, that model updates are controlled and that the organisation can identify and investigate false negatives. Where automated response is involved, the more consequential requirement is to establish whether interventions remain within approved authority and whether their physical effects have been evaluated. Where a common supplier supports multiple critical operators, the supervisory question extends to concentration, continuity and the consequences of simultaneous service failure.

At the European level, the combination of NIS2, critical-entity resilience requirements and applicable AI governance provisions provides the legal context for examining these questions, but their exact application remains dependent on the entity and the function of the AI system. The European Commission’s 2026 work on submarine cable security demonstrates a complementary policy approach in which threat assessment, stress testing, mitigation measures and infrastructure investment are treated as connected elements of resilience. Directive (EU) 2022/2555 — European Parliament and Council; Submarine Cable Security Toolbox and Cable Projects of European Interest — European Commission — February 2026.

Strategic Options for Operators and Public Authorities

The practical choices are not limited to unrestricted automation or the rejection of AI. Operators can retain human-led monitoring while improving conventional controls, introduce AI into bounded investigative functions, or expand automation under progressively stronger assurance requirements. Public authorities can support these choices through technical guidance, sector-specific exercises, procurement requirements and supervisory expectations that distinguish lower-consequence analytical assistance from systems capable of affecting essential operations. The appropriate balance depends on technical maturity, resource availability and the consequences of failure.

Table 8.3 — Courses of Action and Decision Consequences

The time required to implement these options cannot responsibly be reduced to universal calendar estimates because existing infrastructure, procurement cycles, legal authority and required engineering changes differ substantially. Their order should be determined by exposure and consequence, with particular priority given to deficiencies that make relevant events unobservable or render containment unsafe.

Performance Thresholds and the Conditions for Expanding Automation

The decision to delegate additional authority to an AI system should depend on evidence that its operation meets explicit acceptance criteria under the conditions in which it will be used. A general demonstration of analytical accuracy is insufficient if the proposed action affects industrial operations, while a vendor’s assertion that its system is capable of autonomous response does not establish that the response is appropriate for the operator’s equipment. Acceptance criteria should therefore be defined separately for detection, investigation, execution and recovery, with the more consequential functions requiring stronger evidence and more restrictive authority. Where an acceptable failure rate cannot be established from available data, a lower-risk deployment boundary should be maintained until representative testing becomes possible.

Table 8.4 — Decision Gates for AI Deployment

Final Net Assessment: AI as a Conditional Force Multiplier and a Material

The overall assessment is that artificial intelligence already provides measurable improvements in selected cybersecurity functions and is likely to become an increasingly important component of critical-infrastructure security operations, but the evidence available as of November 2026 does not justify treating its deployment as a universal net improvement in operational resilience. Controlled evaluations have demonstrated substantial capability in activities such as vulnerability discovery and software analysis, while official threat assessments and documented adversarial activity indicate that attackers are also using AI to accelerate established intrusion methods. The central unresolved question is whether improvements in analytical performance can be translated consistently into earlier detection of consequential incidents, safer containment and more reliable restoration of essential services under realistic industrial conditions.

The material expansion of the attack surface is not hypothetical. AI systems introduce data pipelines, model artifacts, inference services, external suppliers, orchestration tools and execution permissions that must themselves be protected. The importance of these dependencies is greatest when a common service supports multiple security functions or when model-generated conclusions influence actions affecting physical processes. The existence of technical vulnerabilities does not establish that systemic failure is inevitable, but it requires operators to evaluate the security of their defensive architecture with the same discipline applied to the infrastructure being protected.

The final strategic judgment is conditional defensive advantage, with medium confidence. AI is most defensible when deployed to strengthen observation, analysis and investigation while independent controls preserve evidence integrity, human accountability and safe operational authority. Its net contribution becomes uncertain where deployment expands faster than the organisation’s ability to validate models, maintain specialist expertise and recover from supplier or analytical failure. In the most adverse conditions, poorly governed automation could increase systemic exposure even while producing apparently favourable productivity indicators.

The decisive criterion for governments, regulators and infrastructure operators through 2030 is therefore demonstrated resilience under adverse operating conditions. Investment and supervision should reward independently verified improvements in relevant detection coverage, time to safe containment, continuity under degraded conditions and physical recovery, rather than treating AI adoption, workflow automation or formal compliance as substitutes for evidence of effectiveness. A SOC becomes more resilient when it can recognise consequential threats, preserve trustworthy evidence, act within authorised operational boundaries and maintain essential services when its own analytical systems are unreliable. AI can support those capabilities, but it does not replace their engineering, institutional or evidentiary foundations.

Critical Infrastructure Resilience and Strategic Decision Dashboard, 2028–2030

Three Determinants of Operational Resilience

DETERMINANT 01
Physical-System Integrity

Security measures must preserve safe operations, engineering configurations and essential-service continuity.

DETERMINANT 02
Independent Defensive Assurance

AI detection must be validated through representative testing, protected evidence and controlled response authority.

DETERMINANT 03
Recovery and Institutional Capacity

Operators must retain qualified personnel, alternative monitoring and independently tested restoration capabilities.

01 / INTERACTIVE INFRASTRUCTURE DEPENDENCY NETWORK

Six Interdependent Operational Domains

Select a domain to examine its operational dependencies, potential cyber-physical consequences and assurance priorities. Connections represent possible dependencies, not verified incidents or calculated risk weights.

PHYSICAL ASSETS ⇄ DIGITAL DEPENDENCIES ⇄ SECURITY DECISIONS

Electricity and Energy Infrastructure

Dependency: Control communications, operational equipment, telecommunications and engineering access.

Operational consequence: Incorrect containment or compromised monitoring may affect visibility, equipment availability or safe operating conditions.

Required assurance: Engineering-approved intervention, protected configuration records, independent safety functions and tested restoration.

02 / STRATEGIC SCENARIOS 2028–2030

Three Conditional Futures for AI-Enabled Cyber Defence

Select a pathway to examine the governing conditions, implications for essential services and observable transition indicators. No probabilities are assigned.

Scenario A

Independently validated AI functions improve detection and investigation while operational authority remains bounded by safety requirements.

Independent testingHuman oversightSafe recovery

Sectoral effect: Better visibility and earlier safe intervention across energy, maritime, subsea and industrial systems.

Transition indicators: Reproducible detection improvement, fewer validated missed events and stronger recovery performance.

03 / OFFICIAL EUROPEAN THREAT DATA

ENISA 2026 — Documented Targeting Distribution

Selected sectoral shares reported in the 2026 ENISA threat landscape, based on observed events in calendar year 2025. The categories shown are not a complete distribution and are not AI-specific.

32%
Public administration
8%
Transport
7%
Manufacturing
Scale: column height is relative to the largest displayed category (32% = full chart height). Values represent reported shares of ENISA’s documented targeting distribution, not breach success, physical disruption, incident severity or AI-driven attacks. The selected categories are not exhaustive.

04 / INVESTMENT AND GOVERNANCE MATRIX

Operational Priorities and Evidence Required

The following table links investment choices to measurable outcomes, implementation responsibilities and residual risks without assigning arbitrary budgets or projected savings.

Investment domain	Strategic objective	Required proof	Primary authority	Residual risk
Asset and dependency visibility	Establish complete operational context	Reconciled inventories and tested dependency maps	Operator and OT engineering	Undocumented systems and external dependencies
Telemetry integrity	Maintain trustworthy observations	Coverage tests, provenance and timestamp integrity	SOC and infrastructure engineering	Missing or manipulated evidence
AI detection validation	Demonstrate incremental security benefit	Matched tests, false-negative evaluation and adversary emulation	Independent assurance function	Model drift and unseen attack classes
Bounded response automation	Accelerate safe containment	Permission tests, engineering acceptance and rollback	Incident command and operations	Incorrect execution and process disruption
Model supply-chain assurance	Protect analytical dependencies	Provenance, artifact integrity and update testing	Security engineering and supplier management	Common-mode compromise
Human expertise	Preserve independent judgment	Blind exercises and case reconstruction	SOC leadership and OT management	Automation complacency
Supplier continuity	Limit concentration and provider failure	Failover, exit and degraded-service testing	Procurement and security management	Shared platform outage
Physical recovery	Restore safe essential operations	Tested backups, engineering acceptance and recovery exercises	Operations and continuity management	Persistent disruption after cyber containment

05 / OFFICIAL DOCUMENTARY REFERENCES

Technical and Institutional Evidence

European Union Agency for Cybersecurity: ENISA Threat Landscape 2026.

European Commission: Submarine Cable Security Toolbox and Cable Projects of European Interest — 2026.

UK National Cyber Security Centre: Artificial Intelligence and Cyber Intrusion — 2026.

US Department of Energy: Cybersecurity Capability Maturity Model.

National Institute of Standards and Technology: Operational Technology Backup Quick Start Guide — 2026.

International Maritime Organization: Maritime Cyber Risk.

AI is a conditional force multiplier rather than a substitute for infrastructure resilience. Its contribution becomes defensible when improved analytical capability is supported by independently verified detection, trustworthy operational evidence, bounded execution authority, qualified human oversight and demonstrated recovery. The strategic objective through 2030 is to improve protection of essential services without creating new concentrated points of failure.

Pillar III — Final Net Assessment: Artificial intelligence offers a conditional defensive advantage, but the decisive measure of success through 2030 is not increased automation. It is independently demonstrated protection of essential services, including detection of consequential intrusions, safe operational intervention, resilience under supplier or model failure, and verified physical recovery.