From the Utility Management edition of October 30, 2026
2026 AI & OT Cybersecurity Report: testing AI models on industrial attack planning
Frenos (OT security vendor) · Operational technology security for water, power and other industrial operators · United States (test scenarios generic; case material includes a Mexican water and drainage utility)
- Publisher
- Frenos
- Original publication
- Report released 21 Oct 2026 (PDF dated 2026; press release 21 Oct 2026)
- Source retrieved
- 2026-10-31
What happened
Frenos ran 16,980 tests (13,884 decision attempts, 2,520 planning attempts, 576 simulated runs) on anonymized frontier, US open-weight and foreign open-weight models given supplied facts about OT assets, weaknesses and access. Three frontier versions produced passing complete attack plans in 91.9%, 89.5% and 92.9% of attempts. Only 60.0%, 62.9% and 74.3% of their plans passed every repeat. Other frontier versions scored 17.9-31.9%, the best foreign open-weight 36.2% and the best US open-weight 5.2%. Single-decision scores were 6.0-46.8%, against a random baseline of about 39.5%, and in 16.3% of questions the stated goal did not match the scoring rule. Frenos concludes autonomous attacks were not demonstrated. It recommends segmentation, limited remote access and user rights, detection of unusual sessions, and human review of AI output. It also summarizes Dragos's account of AI-assisted targeting of a Mexican water utility's SCADA/IIoT interface that failed to gain OT access.
Why it matters
Water and power utilities with small security teams are the targets the report describes. It shows that AI planning ability depends heavily on context the attacker already holds, which shifts the defender's priority to limiting reachable access. It complements the archived FBI/EPA PLC alert.
Evidence and measured results
Vendor-run benchmark with anonymized models, supplied facts and fixed action sets, scored by Frenos with a simple harness. The report itself flags a scoring/goal mismatch in 16.3% of single-decision questions. Not peer reviewed and no released dataset was observed. Independent press coverage (Axios, 21 Oct) restates the figures but does not independently test them.
Limitations and uncertainty
Vendor research from a company selling OT attack-path analysis, with a commercial interest in the conclusions. Model names are withheld, so results cannot be replicated or mapped to tools a utility uses. Supplied-context tests do not measure discovery or execution. The Dragos water-utility case is summarized secondhand. Published 21 Oct, before the stream's first edition, and not archived; included because it is the most recent quantitative attempt to measure AI-assisted OT attack planning against water and power targets.
Put this evidence to work
Lighthouse Advisory interpretation, grounded in this source. Enriched 2026-10-30; this does not change the original publication date. Each role follows the same checklist so takeaways compare across sources.
Sales
Role takeaway
- Customer problem
- Utilities cannot tell how much AI changes the risk from intruders who already hold IT access and system documentation.
- Stakeholders
- OT security manager
- Water or power operations superintendent
- IT director
- Utility general manager
- Discovery questions
- Which OT interfaces are visible from the business network today?
- Where are network diagrams and asset inventories stored, and who can read them?
- Have containment actions been tested with operations?
- Value hypothesis
- Reducing reachable IT-to-OT paths and protecting system documentation may lower the usefulness of AI-assisted planning; the report does not quantify risk reduction.
- Potential engagement
- A scoped IT-to-OT exposure and documentation-handling review for one treatment plant or substation group.
- Unsupported claims
- That AI can autonomously attack utility OT
- That 90% success applies to real intrusions
- Ranking of named commercial models
- Guaranteed breach prevention
Pre-sales engineering
Role takeaway
- Fit
- Good fit as a threat-model input for OT segmentation and monitoring work.
- Architecture and integration
- Feed asset, network and identity data into attack-path analysis and link findings to OT monitoring and change records.
- Prerequisites
- OT asset and network inventory
- Remote access account list
- Logging from SCADA hosts and engineering workstations
- Constraints
- Anonymized models prevent mapping to tools in use
- Supplied-context tests do not measure discovery
- Industrial systems are sensitive to active scanning
- Security
- Treat diagrams, inventories and credentials as high-value data; restrict AI tools from reading OT documentation without approval.
- Proof of value
- Identify every IT-visible OT interface
- Verify alerts for repeated login failures and unusual remote sessions
- Tabletop a safe containment decision with operations
Delivery
Role takeaway
- Work
- Reachability review, remote-access and privilege reduction, monitoring tuning and containment rehearsal.
- Dependencies
- Operations staff availability
- OT network documentation
- Monitoring tools
- Ownership
- OT security lead with plant or system operations manager.
- Skills and adoption
- Operators and IT staff need shared response playbooks; analysts need to validate AI-generated findings before acting.
- Governance checkpoints
- Change approval before any active testing
- Documentation-handling rules for the review
- Sign-off by operations on containment actions
- Acceptance criteria
- Proposed: inventory of all IT-to-OT paths completed
- Proposed: number of standing remote access accounts reduced
- Proposed: containment playbook tested once with operations
- Risks
- Operational disruption from testing
- Over-reliance on vendor benchmark
- Exposure of sensitive documentation during review
Implementation considerations
Lighthouse Advisory interpretation across the operating dimensions a public-sector buyer must settle before this evidence becomes a design. Each note answers the question under its heading for this specific source.
Architecture and integration
What must connect, and where does the AI sit in the workflow?
Defensive architecture should assume an attacker with IT access and AI help can turn discovered facts into plans quickly. Priority moves to segmentation between IT and OT, limited remote access and identity-based monitoring of engineering workstations and SCADA hosts.
Governance
Who approves, reviews and stays accountable for outcomes?
Model choice is a material risk variable, so governance of utility-side AI tools (and of what OT context they can read) matters. The report recommends human review of AI-generated security findings before action.
Security and privacy
What data, permissions and controls need testing?
Core security relevance: AI can organize attack steps when given context. Documentation, network diagrams and asset inventories become sensitive data whose exposure raises attack-planning success.
Accessibility and workforce
Who is affected, and what skills or accommodations follow?
Small utilities with thin OT security staffing are the most exposed; the report's recommendations depend on operator and engineering staff time.
Procurement
What should contracts, pricing and exit terms secure?
Buyers of OT security tools should ask vendors for reproducible methods and should not procure on headline AI-threat statistics alone.
Operating model
Which teams own the service once it runs?
Supports joint IT-OT-operations ownership of containment decisions rather than security-only response.
Publication history
- 2026-10-30Utility Management · Issue 026 resources
Stable resource ID: frenos-ai-ot-attack-planning-report-2026