{"resourceId":"frenos-ai-ot-attack-planning-report-2026","versions":[{"version":"external-f6a0c85f721465413e9a7cc25e80c1fce2322e9379d5bdcd17af16349c473810","resource":{"id":"frenos-ai-ot-attack-planning-report-2026","title":"2026 AI & OT Cybersecurity Report: testing AI models on industrial attack planning","organization":"Frenos (OT security vendor)","sector":"Operational technology security for water, power and other industrial operators","geography":"United States (test scenarios generic; case material includes a Mexican water and drainage utility)","publishedAt":"Report released 21 Oct 2026 (PDF dated 2026; press release 21 Oct 2026)","publicationDate":"2026-10-21","eventDate":null,"sourceName":"Frenos","sourceLabel":"Vendor research report (PDF)","sourceUrl":"https://23951793.fs1.hubspotusercontent-na1.net/hubfs/23951793/PDF/Frenos_Report_2026_Digital_Final.pdf","evidenceClass":"vendor-claim","outcomeClass":"cautionary","topics":["data-security","infrastructure","developers-agents"],"finding":"Frenos ran 16,980 tests (13,884 decision attempts, 2,520 planning attempts, 576 simulated runs) on anonymized frontier, US open-weight and foreign open-weight models given supplied facts about OT assets, weaknesses and access. Three frontier versions produced passing complete attack plans in 91.9%, 89.5% and 92.9% of attempts. Only 60.0%, 62.9% and 74.3% of their plans passed every repeat. Other frontier versions scored 17.9-31.9%, the best foreign open-weight 36.2% and the best US open-weight 5.2%. Single-decision scores were 6.0-46.8%, against a random baseline of about 39.5%, and in 16.3% of questions the stated goal did not match the scoring rule. Frenos concludes autonomous attacks were not demonstrated. It recommends segmentation, limited remote access and user rights, detection of unusual sessions, and human review of AI output. It also summarizes Dragos's account of AI-assisted targeting of a Mexican water utility's SCADA/IIoT interface that failed to gain OT access.","sledRelevance":"Water and power utilities with small security teams are the targets the report describes. It shows that AI planning ability depends heavily on context the attacker already holds, which shifts the defender's priority to limiting reachable access. It complements the archived FBI/EPA PLC alert.","evidence":"Vendor-run benchmark with anonymized models, supplied facts and fixed action sets, scored by Frenos with a simple harness. The report itself flags a scoring/goal mismatch in 16.3% of single-decision questions. Not peer reviewed and no released dataset was observed. Independent press coverage (Axios, 21 Oct) restates the figures but does not independently test them.","architectureImplications":"Defensive architecture should assume an attacker with IT access and AI help can turn discovered facts into plans quickly. Priority moves to segmentation between IT and OT, limited remote access and identity-based monitoring of engineering workstations and SCADA hosts.","governanceImplications":"Model choice is a material risk variable, so governance of utility-side AI tools (and of what OT context they can read) matters. The report recommends human review of AI-generated security findings before action.","securityPrivacyImplications":"Core security relevance: AI can organize attack steps when given context. Documentation, network diagrams and asset inventories become sensitive data whose exposure raises attack-planning success.","caveats":"Vendor research from a company selling OT attack-path analysis, with a commercial interest in the conclusions. Model names are withheld, so results cannot be replicated or mapped to tools a utility uses. Supplied-context tests do not measure discovery or execution. The Dragos water-utility case is summarized secondhand. Published 21 Oct, before the stream's first edition, and not archived; included because it is the most recent quantitative attempt to measure AI-assisted OT attack planning against water and power targets.","streamIds":["utility-management"],"roles":{"sales":"Sales framing: use this as a careful conversation starter about OT exposure, not a fear pitch. The vendor's own figures show strong but inconsistent AI attack planning, and no autonomous attacks. That supports a discussion with water and power utility leaders about which documents, accounts and remote paths would give an attacker useful context. A bounded engagement is an exposure review of IT-to-OT paths. Avoid citing the 90% figure without its caveats or claiming AI makes breaches imminent.","engineering":"Engineering framing: the result depends on supplied context, so the engineering question is what context an intruder could collect. Map IT-visible OT interfaces, remote access accounts, engineering workstations and stored network documentation. A proof of value checks whether segmentation and monitoring detect discovery traffic, repeated login failures and unusual sessions. Limitations matter: anonymized models, a simple harness and a vendor-designed scoring scheme, so engineering conclusions should rest on the utility's own path analysis.","delivery":"Delivery framing: the owner is the OT security lead with operations and engineering. Work is an IT-to-OT reachability review, tightening remote access and privileges, and rehearsing safe containment actions with operators. Acceptance would be proposed reductions in reachable paths to control systems and documented response steps. Risks include disrupting sensitive industrial systems during testing, over-reliance on vendor scores, and handling diagrams and inventories carelessly during the review itself."},"roleDetails":{"sales":{"customerProblem":"Utilities cannot tell how much AI changes the risk from intruders who already hold IT access and system documentation.","stakeholders":["OT security manager","Water or power operations superintendent","IT director","Utility general manager"],"discoveryQuestions":["Which OT interfaces are visible from the business network today?","Where are network diagrams and asset inventories stored, and who can read them?","Have containment actions been tested with operations?"],"valueHypothesis":"Reducing reachable IT-to-OT paths and protecting system documentation may lower the usefulness of AI-assisted planning; the report does not quantify risk reduction.","potentialEngagement":"A scoped IT-to-OT exposure and documentation-handling review for one treatment plant or substation group.","unsupportedClaims":["That AI can autonomously attack utility OT","That 90% success applies to real intrusions","Ranking of named commercial models","Guaranteed breach prevention"]},"engineering":{"fit":"Good fit as a threat-model input for OT segmentation and monitoring work.","architectureIntegration":"Feed asset, network and identity data into attack-path analysis and link findings to OT monitoring and change records.","prerequisites":["OT asset and network inventory","Remote access account list","Logging from SCADA hosts and engineering workstations"],"constraints":["Anonymized models prevent mapping to tools in use","Supplied-context tests do not measure discovery","Industrial systems are sensitive to active scanning"],"security":"Treat diagrams, inventories and credentials as high-value data; restrict AI tools from reading OT documentation without approval.","proofOfValue":["Identify every IT-visible OT interface","Verify alerts for repeated login failures and unusual remote sessions","Tabletop a safe containment decision with operations"]},"delivery":{"work":"Reachability review, remote-access and privilege reduction, monitoring tuning and containment rehearsal.","dependencies":["Operations staff availability","OT network documentation","Monitoring tools"],"ownership":"OT security lead with plant or system operations manager.","skillsAdoption":"Operators and IT staff need shared response playbooks; analysts need to validate AI-generated findings before acting.","governanceCheckpoints":["Change approval before any active testing","Documentation-handling rules for the review","Sign-off by operations on containment actions"],"acceptanceCriteria":["Proposed: inventory of all IT-to-OT paths completed","Proposed: number of standing remote access accounts reduced","Proposed: containment playbook tested once with operations"],"risks":["Operational disruption from testing","Over-reliance on vendor benchmark","Exposure of sensitive documentation during review"]}},"retrievedAt":"2026-10-30T22:08:55-05:00","enrichedAt":"2026-10-30T22:16:33-05:00","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"Small utilities with thin OT security staffing are the most exposed; the report's recommendations depend on operator and engineering staff time.","procurementImplications":"Buyers of OT security tools should ask vendors for reproducible methods and should not procure on headline AI-threat statistics alone.","operatingModelImplications":"Supports joint IT-OT-operations ownership of containment decisions rather than security-only response.","sourceVerification":{"openedUrl":"https://23951793.fs1.hubspotusercontent-na1.net/hubfs/23951793/PDF/Frenos_Report_2026_Digital_Final.pdf","referenceExcerpt":"The research points to three conclusions: model choice matters, plans need human review, and autonomous attacks were not demonstrated.","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}