A single security operations function with visibility and defined authority across both IT and OT estates, replacing the historical split between a corporate SOC and a plant that security 'doesn't reach'.
Agentic AI SOC agents for OT environments
Industrial IT / OT / Critical Control Information Infrastructure
Over-Promise
Near-term · 2–5 yrs
Evidence E2 · Field pilot
AI / ML
AI agents that triage, investigate and in some cases respond to security alerts autonomously, extending the AI-SOC pattern rapidly emerging in enterprise IT security into the OT security operations centre.
Short entry. This page summarises our current placement. Full, sourced analyses are published first for the technologies closest to practical use; see the list of full analyses.
How it works
Security analysts spend much of their time on repetitive investigation: gathering context about an alert, checking whether it matches known activity, and deciding whether to escalate. AI SOC agents automate that sequence. An agent receives an alert, queries other systems for related evidence, reasons about what probably happened, writes up its findings and recommends or takes a next step.
The difference from earlier automation is flexibility. A scripted playbook follows fixed steps; an agent decides which steps are relevant. In operational technology the investigating and summarising part transfers well. The acting part is deliberately restricted, with containment actions on plant networks requiring human approval.
Why it matters
Could meaningfully close the OT security-analyst staffing gap by handling first-line triage at machine speed across the flood of alerts a converged IT/OT SOC generates.
Where it fits
The realistic near-term role is first-line triage in a converged SOC: reducing the queue of low-value alerts, enriching OT alerts with asset and process context, and drafting incident reports. It is most attractive to organisations that cannot hire enough analysts with OT knowledge. Autonomous response in a live control network needs the same caution as any other automated action that can affect the process.
Why we place it at the Over-Promise stage
AI SOC agents are one of the most heavily marketed ideas in enterprise security; OT-specific deployment is earlier still, and evidence of results in industrial environments is scarce. Estimated time to the Proven in Use stage: 2–5 yrs. What the stages mean.
Key risk
An autonomous agent taking a containment action (e.g. isolating a segment) inside a live OT network carries process-safety consequences that a pure-IT SOC agent never has to consider.
Questions to ask before committing
- Which actions can the agent take without approval, and are any of them able to affect plant communications?
- How is the agent's reasoning recorded so that an analyst can audit a decision afterwards?
- What access does the agent itself hold, and how is that access protected from misuse?
- How is its accuracy measured against your own alert history?
Standards and terms to know
- Triage
- The first assessment of an alert to decide whether it needs investigation.
- SOAR
- Security orchestration, automation and response, the earlier generation of playbook-based automation.
- Human in the loop
- Requiring a person to approve an action before it is carried out.
Related technologies
See this entry on the full maturity map · All IT/OT & CCII entries · How placements are made. Stage and time-horizon placements are editorial judgements based on public information as of October 2026, not engineering, safety or investment advice; see the Terms of Use.