By Vinayak Godse
Debate about frontier AI risk still centres on enterprise IT: software vulnerabilities, cyber operations, malware, and digital infrastructure. Industrial environments face a different challenge. Frontier AI systems capable of sustained reasoning across physical domains carry real implications for operational technology and critical infrastructure. Industrial systems have not suddenly become easier to compromise. What has changed are the conditions that once shaped their security.
Industrial cyber security has always differed from enterprise security in one respect. The scarce resource was rarely the exploit itself. It was the process engineer who understood what would happen after access was obtained: the industrial processes, the safety systems, and the relationship between a digital action and its physical consequence. That knowledge has traditionally remained fragmented across cyber, control-systems, and process-engineering specialists. Advancing AI is beginning to challenge that.
Process knowledge is also deeply contextual and consequence-aware in ways cyber expertise alone cannot supply. Understanding whether a turbine protection system can be bypassed without triggering a shutdown requires judgment at the intersection of engineering, operations, and safety. That judgment has historically limited how far access could translate into operational impact, and it has rarely sat with any single specialist.
Today’s models are capable coders. What makes them consequential runs deeper. They can reason across physical systems, read multimodal documentation, and bring together knowledge that has long stayed separate across domains. Engineering diagrams, vendor manuals, PLC logic, and historian data can be analysed within a single context. Assembling that picture once required coordinating specialists who rarely worked from the same material, and a model that holds all of it at once removes much of that friction.
The implications extend beyond vulnerability discovery. A chain that previously required a team to trace manually, from compromised credentials through remote access infrastructure to the controllers governing physical processes, can now be analysed as a connected sequence within a single reasoning context.
A model that can interpret an industrial process can also learn how it is monitored: what operators watch, and how anomalies are investigated. An attacker able to shape what the control room sees while the process drifts does more than break in. Operators lose the ability to trust their own instruments.
Operational technology carries structural disadvantages of its own. Enterprise IT benefits from extensive telemetry, endpoint detection, and mature incident response, while OT often has limited logging, cannot host security agents, and runs engineering workstations long after their enterprise counterparts have been retired. The visibility needed to investigate sophisticated manipulation frequently does not exist at the same level. These environments also cannot adapt at the pace of enterprise IT: operational continuity constrains patching, and safety requirements constrain architectural change, so vulnerabilities identified today may remain difficult to remediate for extended periods. The concern is structural: the speed of understanding may begin to outrun the speed of defense.
The longer-term picture is more serious. A power substation, a water treatment facility, and a manufacturing process run on different engineering principles that have traditionally required distinct expertise. Models capable of reasoning across these environments erode that separation. Agentic coordination could extend the pattern further, sustaining activity across multiple environments over time rather than requiring continuous human coordination.
For India, these developments carry particular weight. Operational technology security maturity is uneven across sectors. Banking and financial services have strengthened their capabilities over time, driven by regulatory oversight and investment, while critical-infrastructure sectors running industrial control systems have been slower to build the same momentum. Power and water utilities continue to modernise while carrying technology designed for an earlier era. Recent CEA regulations underline the urgency of improving cyber security in power systems, and other critical sectors are likely to face the same imperative.
Critical infrastructure cannot rely on the gradual evolution of security practice when adversary capabilities may advance far faster. Strengthening industrial cyber resilience calls for comparable levels of operational technology security maturity across India’s critical infrastructure ecosystem, and rapid advances in AI make that requirement more immediate. Industrial security frameworks took shape when process knowledge was scarce, industrial environments were isolated, and expertise was difficult to scale.
Frontier AI can alter all three conditions at once. Whether frontier AI will matter to industrial security is no longer the interesting question. The practical one is whether the current window, before these capabilities become widely accessible, is being used to build the security architecture the next phase will require.
The writer is CEO, Data Security Council of India
Disclaimer: The views expressed are the author’s own and do not reflect the official policy or position of Financial Express.