Critical infrastructure is entering a new phase of digital transformation as artificial intelligence (AI) moves from analysis to action. The emergence of agentic AI —systems capable of autonomously perceiving, reasoning and executing decisions— represents a step change for industrial control systems (ICS) environments. From power generation and water treatment to manufacturing and transportation, these technologies promise improved efficiency, resilience and operational performance. However, they also introduce an unprecedented cybersecurity challenge: AI as an embedded insider threat.

Unlike traditional cyber risks that originate externally, agentic AI operates within the control environment, directly influencing physical processes, equipment and networks. This shift fundamentally changes the scope of OT cybersecurity, from securing systems against intrusion to governing the behavior, integrity and decision-making of autonomous entities. As autonomy increases, so does the risk of unintended or unsafe actions, particularly in safety-critical ICS environments.

This session explores how agentic AI is reshaping cybersecurity across critical infrastructure. We will examine emerging risk categories, including model drift, hallucinations, training data poisoning, unauthorized or “shadow” agents and cascading impacts across interconnected systems. These risks challenge conventional security architectures and raise new questions around accountability, trust and operational control.

As ICS environments evolve toward greater autonomy, cybersecurity must evolve with them. This session equips attendees with the insights needed to safely harness agentic AI, ensuring that innovation enhances, rather than compromises, the resilience, reliability and safety of critical infrastructure.

Attendees will gain a practical framework for addressing these challenges. Key topics include establishing governance models for AI in OT, enforcing bounded autonomy and least privilege, ensuring human oversight and implementing independent monitoring and safety controls. We will also outline a structured path for adoption, from readiness assessment and use case prioritization to implementation and continuous risk management.