2026: The State of AI in OT Security
Can AI help plan industrial cyberattacks? And how should defenders respond?
Frenos tested how AI models execute decisions in an isolated vacuum, full plans, and simulated scenarios. The research helps security, engineering, and operations teams understand where AI can assist attack planning, where it falls short, and what defenders can do.
What we tested
We put six frontier AI models, two US open-weight models, and two foreign open-weight models through the same attack-planning challenges. To evaluate how they plan, adapt, and execute, Frenos analyzed more than 13,000 decisions, 2,500 planning attempts, and 500 simulated runs.
16,980
Total tests
13K+
Decision attempts
2.5K
Path attempts
500+
Simulator observations
The models assessed target assets, network connections, vulnerabilities, and privileges to build attack paths—testing whether their choices reached goals in simulation.
How models compared on attack planning
The top frontier models scored highest, but even they didn’t give reliable answers every time.
Read the full resultsThree frontier models led our tests, averaging roughly 90% success at building attack plans. The strongest foreign open-weight model averaged about 36%, and the strongest US open-weight model about 5%.
Conclusions from the research
Three frontier versions passed roughly 90% of complete-path attempts, compared with 36% for the strongest tested foreign open-weight version. The strongest tested US open-weight version passed 5%, although results varied greatly between individual model versions.
Models sometimes skipped a needed step or assumed access they did not have. Without human review, those mistakes can remain in the final plan. A knowledgeable person can check the assumptions, spot missing steps, and ask for a correction.
The models worked with supplied choices and facts, and the tests checked plans or goals reached in a simple simulator. Neither result shows that a model could find a target and carry out an OT attack on its own.
Four priorities for OT defenders
Strengthen defenses, connect detection to response, and use verified context to focus action.
Focus on defensibility
Separate networks, limit remote access and user rights, and test recovery. These defenses still matter when attackers use AI.
Prioritize detection and response
Watch for failed logins, unusual remote sessions, and unapproved changes. Connect those signals to tested response steps.
Use AI to your advantage
Use AI to connect assets, networks, vulnerabilities, and security events. Analysts should verify findings before acting.
Not all exposure is equal
Assess weaknesses alongside required access, user rights, affected systems, and existing controls. Prioritize changes that protect operations.
Get the full report
Methods, model-by-model results, vulnerability and threat-actor analysis, and the full defender worklist.