From IT to the Field: Booz Allen's AI Tests and the SCADA Gateway as a Pivot Point

Booz Allen Hamilton has published the whitepaper "From Digital to Physical: The AI Threat Is Here", which Industrial Cyber reported on October 20, 2026. The document describes tests in which frontier AI models, with limited human guidance, moved from a network compromise to actions on industrial control systems. One detail bears directly on anyone working with SCADA and HMI: the role of a SCADA gateway.

How the tests were run

The tests took place in Booz Allen's OT Cybersecurity Lab in Chantilly, Virginia: an isolated environment with hundreds of IT, IoT and OT devices, configured to represent critical infrastructure operations, along with OT security tools. The question was whether the models, with little supervision, could map connected equipment, identify weaknesses, move through the network and then act on PLCs, motor drives and robotic equipment with controlled physical changes.

The results

As reported:

• the models achieved all eight test objectives;
• just over 16 minutes passed between compromising the perimeter and taking actions in the control zone;
• a robotic arm was identified and moved within a few minutes;
• less specialist knowledge and less step-by-step instruction were needed than many organizations expect.

Booz Allen concludes that defenders may have minutes, not hours, to detect and contain an attack. Firewalls, network segmentation, endpoint protection and local control settings added friction, but no single measure consistently stopped the models. After a failed attempt, the models often changed approach.

The SCADA gateway case

In one test, the models discovered that a SCADA gateway maintained active, already-authenticated sessions to 14 devices. This gave them a path to multiple controllers at once. It is not a software vulnerability as such but an architectural choice: concentrating persistent access in a single node makes it a very valuable pivot point.

A node that keeps authenticated sessions open to many controllers hands all of those privileges to whoever compromises it.

Limits and caveats

The picture should be read with caution. The models had been told to wait for human approval before executing any exploit or kinetic action. Booz Allen describes the results as preliminary, and the tests were run in a lab, not in a real plant. The author has not read the full whitepaper, so methodological details remain to be verified in the original document.

The report also cites real incidents, none of which is publicly attributed to AI: suspected network compromises aboard oil tankers; attacks on water and wastewater services in at least seven US states, disrupting monitoring and control and causing pressure loss and flooding; an attack that shut down a gas turbine generation plant in the UK for four days; and compromises of Internet-exposed controllers that altered project files and control room screens.

What to do about it

Booz Allen's recommendations are to constrain attack paths, harden critical assets and access, and improve detection and recovery. For integrators and plant managers, the practical reading is this:

• check which SCADA gateways, historians and HMI servers keep persistent, pre-authenticated sessions to many controllers;
• narrow credential scope, avoiding shared accounts with broad privileges;
• apply per-device authorization, not just at the gateway;
• design detection and response around machine-speed timescales, with isolation procedures already prepared and tested.

This is not a study of building exploits with AI, a topic covered in other cases, but a prompt to review access design. If an automated attacker can move in minutes, limiting the blast radius of each compromised node becomes an architectural decision, to be made before the incident.