How to defend the connected factory against AI-accelerated cyberattacks
Key Highlights
- The threat is accelerating, and the weak point is often the response. Frontier AI can compress the attack timeline, and processes built around slow, manual decisions and siloed ownership may not keep up.
- Clear decision rights and testing matter as much as technology. Pre-authorized actions, named owners and exercises that measure real response times can determine how quickly a plant contains an incident.
- AI can help defenders, but only with governance. Its value in detection and remediation depends on least-privilege access, human oversight, audit trails and validation in OT-representative environments before deployment.
Manufacturing has never been smarter or more exposed. Cloud-connected platforms, advanced robotics, digital twins and AI are improving productivity and resilience. But as a new article from Deloitte’s Tim Gaus and Mehdi Houdaigui points out, each of those connections can also give an attacker another way in.
The piece, “Securing the Connected Factory in the Age of Frontier AI,” published by our sister publication Automation World, argues that the question for manufacturers is no longer whether connected operations can be targeted. It’s whether teams can understand what’s happening and act quickly enough to do something about it.
Gaus, principal and smart manufacturing business lead at Deloitte, and Houdaigui, principal and cyber-AI leader, focus on “frontier AI,” the most capable emerging AI models. Their concern is that these tools can help threat actors find vulnerabilities, develop exploits and plan attacks faster than before. That puts pressure on response processes built around human-paced analysis and manual approvals.
The consequences reach well beyond a typical IT breach. Where remote access is poorly controlled, systems are exposed or segmentation is weak, an intrusion can move into production environments. The authors describe outcomes that include halted lines, safety and quality incidents, stolen intellectual property and cascading disruption across suppliers and customers. As plants add robotics, digital twins and physical AI, the exposure grows.
Gaus and Houdaigui lay out five practical steps for manufacturers to take now. They cover:
- Governance: bringing cyber, operations, engineering and business leaders together, with decision owners and escalation paths defined before an incident, not during one.
- Prioritization: focusing on the systems whose disruption would hurt most, rather than treating every alert as equally urgent.
- AI with guardrails: using AI for triage, anomaly detection and remediation planning, with controlled access, human approval for high-consequence changes and a way to shut agents off.
- Realistic testing: going beyond tabletop exercises to measure how fast teams can triage, authorize, contain and restore safe operations.
- Workforce readiness: using AI to extend security knowledge to operators and technicians, backed by training and regular exercises.
The Automation World piece goes further on each of the five steps, including the specific response metrics the authors suggest tracking and how to set up AI guardrails in an OT setting. For anyone responsible for plant cybersecurity, operations or AI strategy, it’s a useful checklist.
