AI Agents in OT: Treat Them as Insider Threats, Says Panel

On November 5, 2026, IIoT World published a summary of a panel held at the Industrial AI Summit 2026. The question: is agentic AI in OT (Operational Technology) an insider threat? The panelists' position is clear-cut: every agent should be treated as an insider, and its governance should fall to the industrial cybersecurity team.

The panelists were Ian Bramson (Black & Veatch), Scott Christensen (GrayMatter) and Gary Tillery (CEO of Skkynet), moderated by Matt Morris of EverLine. An important caveat: the article is labeled "Sponsored by Skkynet | Editorially Independent" and states that AI tools helped summarize its content. It should therefore be read as a vendor-linked viewpoint.

Suggesting vs. acting: the difference that matters

According to the panel, generative AI suggests, while agentic AI acts. An agent that changes a set point or triggers a model change operates in systems tied to site safety, the environment, public safety and production continuity. The article speaks of "cyber-physical" consequences, a category IT environments do not share.

Putting agentic AI into the real world means "taking the human out of the loop, and that's probably the scariest place to be" (Ian Bramson).

Why OT is not IT

The article includes a comparison of the two worlds:

• Consequences of failure: in IT, data loss or service interruption; in OT, safety incidents, environmental damage and plant downtime.
• System age: in IT, refresh every 3–5 years; in OT, systems in service for 15 to 50 years.
• Patching: in IT, on a schedule; in OT, impossible without a planned shutdown.

Some control systems have been running for 50 years and were not designed for AI connections or autonomous changes. Moreover, a change in one of more than 20 interconnected systems can propagate to the others.

Why an agent is an insider

An agent holds credentials, accesses systems and performs actions: it is therefore an insider. The cause may be manipulated training data, a rogue agent or model drift, but the consequences are the same. Even an agent doing exactly what it was designed to do can cause damage at scale: the so-called "paperclip" problem.

The article also cites a figure of 6–10% of AI output that still contains hallucinations, to justify containment controls on every agent with access to production. The source of the figure is not given, so it should be treated as uncertain.

Who is accountable

According to the panel, governance of every agent in OT belongs to the industrial cybersecurity team, not the IT security department. Otherwise responsibility bounces between IT, OT and corporate security, with no clear owner.

Adoption seen as inevitable

All three panelists say agentic AI is already present in industrial environments. The retirement of plant experts creates a knowledge gap that agents are expected to help fill. Christensen put it this way: "Everybody's got that one guy at the plant that's threatening every year, this will be the year I retire." The choice, in essence, is to adopt on your own timeline and with defined rules, or to discover agents already running without controls.

What this means for automation professionals

The article is a governance argument, not a technical guide: it provides no implementation details. But for integrators and engineers adding agents at the PLC, SCADA or MES levels, the practical takeaway is to treat every agent as a privileged identity:

• least-privilege write access;
• limits on set point changes;
• logging of what the agent does;
• a human in the loop for actions with physical effect.

Before introducing an agent, it is also worth clarifying who is accountable for it, and taking an inventory of any agents already present in the plant. Since this is sponsored content, its claims should be weighed critically, but the underlying principle, no agents with write access without identity, limits and oversight, is a reasonable starting point.