AI Agents in OT: Treat Them as Insider Threats, With a Named Owner

On November 5, 2026, IIoT World published a summary of a panel from the Industrial AI Summit 2026 that tackled an uncomfortable question: is agentic AI an insider threat to OT networks? The panelists' answer was unambiguous: every AI agent operating in an industrial environment should be treated as an insider, with a clearly designated owner within the industrial cybersecurity team.

A note on the source: the article is labeled as sponsored by Skkynet (with a statement of editorial independence) and discloses that AI tools were used to summarize the panel. It should therefore be read as expert opinion, not as research findings.

Who spoke and what they said

The panelists were Ian Bramson (Black & Veatch, Global Industrial Cybersecurity), Scott Christensen (GrayMatter, Cyber Practice Director) and Gary Tillery (CEO of Skkynet), moderated by Matt Morris of EverLine. The starting point is the difference between generative and agentic AI: the former suggests, the latter acts. An agent that changes a setpoint operates in a context where the effects reach safety, the environment and production continuity.

Why OT is a delicate environment

According to the panel, three characteristics make the arrival of agents riskier:

• some legacy control systems have been in service for up to 50 years, were not designed to interact with AI, and cannot be updated without a planned shutdown;
• a change in one of 20 or more interconnected systems can propagate to the others;
• the consequences are described as "cyber-physical," meaning they are not limited to data but extend to the process.

The insider argument

An agent holds credentials, accesses systems and performs actions: for all practical purposes, it is an insider. This holds regardless of the cause of anomalous behavior, whether manipulated training data, a rogue agent or model drift.

The article also cites a share of AI output containing hallucinations of between 6% and 10%, used to argue for containment controls on every agent with access to production. The figure comes with no source, so it should be treated with caution; the argument holds even without a precise number.

Removing the human from the decision loop where actions have real-world effects is "probably the scariest part," said Bramson.

Who owns it

The panel proposes that governance of every agent running in OT should fall to the industrial cybersecurity team, not to IT security. Otherwise, the risk is that responsibility falls into the gap between IT, OT and corporate security, with each assuming someone else is handling it.

The speakers also consider adoption inevitable. Agentic AI is reportedly already in use in industry, and the retirement of experienced staff creates a knowledge gap that agents could help fill. The choice, then, is between adopting them on your own timeline with governance rules, or later discovering that agents without controls are already running.

What to do in practice

AI governance in OT is not a new topic: standards, oversight and the principle "AI analyzes, people decide" have already been covered. What is new is the framing as an insider threat and the question of who owns the risk. A simple operating rule follows: before giving an agent write access to PLCs, SCADA or HMIs, treat it as a privileged user.

At a minimum, this means:

• scoped credentials, limited to the systems and actions required;
• containment, to limit the impact of erroneous or malicious behavior;
• audit trails of what the agent reads and changes;
• a named owner, clearly identified.

These are common-sense measures, consistent with the privileged access principles already applied to human users. For leaders of IT and OT teams, the panel's message is above all organizational: define risk ownership before agents reach production, not after.