Trusted resilience: securing critical infrastructure in an AI-driven, connected world

Critical infrastructure is becoming more connected, distributed and software defined. In energy, water, transport, manufacturing, healthcare and other essential services, operational technology (OT) and cyber-physical systems (CPS) increasingly interact with enterprise IT, cloud services, remote users, third parties, data platforms and AI. This convergence creates enormous operational value, but it also changes the security equation: a digital event can now propagate across domains and, in the most consequential environments, become a physical event.

 

The business benefits are clear. The security challenge is to capture them without allowing connectivity, complexity or automation to erode safety, reliability and operational control.

 

From cyber risk to operational consequence

 

The defining characteristic of OT and CPS security is consequence. Cyber incidents can affect confidentiality and data, but they can also stop production, interrupt electricity or water, disrupt transport, damage equipment, and, in extreme cases, threaten human safety. This is why critical infrastructure cybersecurity is about more than protecting devices. The objective is to protect the essential services those devices support.

 

The closer a system sits to a safety or mission-critical process, the more carefully connectivity and autonomy must be governed. Even highly isolated environments can be exposed through remote access, third-party connections, maintenance activities or supply-chain relationships. Organisations should therefore focus on controlled connectivity, strong access management and clear segmentation between critical systems.

 

The balance differs by sector and even by process. Critical infrastructure organisations often combine enterprise IT with operational systems whose failure would affect public safety or service continuity. Security architecture therefore needs to follow consequence rather than labels: understand what must keep operating, what can be isolated, what can fail safely, and what must be recovered first.

 

Long asset lifecycles make this harder. Industrial systems often remain in service for decades, combining modern and legacy operating systems that pre-date current security assumptions. Vulnerabilities may be discovered quickly, while remediation can take much longer because patches require extensive testing and operational approval. This exposure gap makes compensating controls, segmentation, visibility and disciplined lifecycle management essential.

 

Traditional IT security principles remain important, but they must be adapted to operational environments where safety and uptime are paramount. Strong visibility, access control, secure remote access, segmentation and monitoring form the foundation of effective OT security.

 

A successful approach therefore requires defence in depth across the full lifecycle and multiple layers of protection sharing information and working together. Combining visibility across networks, identities, endpoints and industrial systems helps operators identify risks faster and respond with greater confidence.

 

Convergence requires shared accountability

 

Technology alone cannot solve this problem. Convergence also requires a change in governance and accountability.

 

Security, engineering and operations teams often view risk differently. Security teams may focus on identities, vulnerabilities and information assets; operational teams are accountable for safe, reliable physical processes and production continuity. Yet resilience depends on collaboration between them.

 

The most mature organisations increasingly bring cyber risk into engineering and operational risk decisions, with clear ownership across the asset lifecycle. Cyber risk is business risk. And increasingly, boards and executive teams are becoming directly accountable for understanding this risk, prioritising resilience, and ensuring compliance.

 

Resilience must be engineered, not assumed

 

For critical infrastructure, resilience is not only about preventing attacks but ensuring that essential services can continue operating and recover safely to a trusted state when disruption occurs. Achieving this requires planning, segmentation, recovery procedures and regular testing long before an incident happens.  “Recover” is not a product feature; it is an operational capability that must be designed and exercised.

 

AI makes the resilience discussion more urgent because it accelerates both sides of the cyber equation. Attackers can use AI to increase speed, scale and automation, while defenders can use AI to analyse large volumes of data, accelerate investigations and help prioritise actions. Defenders can gain an advantage when AI draws on trusted, live context: which assets belong in the environment, who should access them, which communications are expected and what is normal for the physical process. That advantage depends on connecting asset, identity, network and process information; AI cannot create context that was never collected.

 

At the same time, critical infrastructure organisations must secure AI itself. As generative and agentic AI gains access to enterprise data, applications, APIs and tools, organisations need strong governance over identities, permissions, data flows, tool use, monitoring and auditability. “AI for security” and “security for AI” are becoming two sides of the same challenge.

 

Human accountability remains fundamental, but not every AI-assisted action requires human approval. The appropriate level of autonomy should follow consequence, not capability. Low-impact, reversible actions may be automated, while actions that could affect safety, production or essential services should have tighter boundaries, escalation and, where necessary, explicit human authorisation. Humans define the operating boundary and remain accountable when automated decisions affect something important.

 

Trust requires evidence, not claims

 

As critical infrastructure becomes more dependent on software and connected security controls, trust must be demonstrable. Asset owners should not have to rely solely on vendor claims; they need evidence that products are developed securely, implement appropriate technical controls and can be operated within a defensible architecture.

 

Independent certification is one important part of that evidence.

 

Certification does not make a system secure by itself, nor does it replace sound architecture, configuration and operations. It does, however, provide independent assurance against defined requirements and helps asset owners, integrators and regulators establish a common basis for trust.

 

Within industrial automation and control systems, the IEC 62443 series provides one of the most important common frameworks for asset owners, service providers, system integrators and product suppliers. It addresses security across roles and lifecycle stages, from security programmes and system design to secure product development and component requirements.

 

The value extends beyond a compliance checkbox. Regulation is increasingly pushing critical infrastructure operators toward stronger governance, risk management, supply-chain assurance and incident accountability, but the objective should remain operational resilience. Certification helps establish trust in individual building blocks; resilience depends on how those building blocks are architected, operated and recovered as a system.

 

Five shifts shaping critical infrastructure security

 

Five shifts are converging: hybrid and distributed architectures; AI on both sides of the security equation; stronger regulation and secure-by-design expectations; a renewed focus on resilience and recovery; and the transition toward post-quantum cryptography. Together, they are moving the conversation from “OT security products” toward the architecture and governance of trusted cyber-physical systems.

 

First, critical infrastructure will remain hybrid. Cloud platforms, edge computing, private connectivity and remote operations will expand, while many deterministic and safety-critical functions remain close to the physical process. The question is therefore not “cloud or on-premises?” but where  workloads and control functions can run while meeting operational, safety and regulatory requirements. Security policy and visibility need to follow the workload across those boundaries.

 

Second, AI will become both a force multiplier and a new trust boundary. Security teams will increasingly use it to strengthen prevention, vulnerability detection and response, while adversaries use it to accelerate attacks. At the same time, agentic AI will introduce new identities with access to data, applications and tools. Organisations will need an AI trust chain that connects identity, data, models, tools, actions and consequences, with autonomy bounded according to operational risk.

 

Third, regulation and secure-by-design expectations are moving deeper into the technology lifecycle. Operators increasingly need to understand not only if a product has security features, but how it was developed, maintained, updated and independently assessed.

 

Fourth, resilience and recovery are becoming first-class design requirements as organisations recognise that prevention will never be perfect.

And fifth, post-quantum migration can no longer be treated as a distant research topic. NIST’s first PQC standards are available today, while industrial assets may remain deployed for 20 to 30 years. Organisations should begin identifying systems that may be affected by the transition. “Harvest now, decrypt later” adds urgency for information that must remain confidential for many years.

 

Ultimately, critical infrastructure cybersecurity is moving from a narrow question of protection toward a broader question of trust: can we connect, automate and innovate without losing control of the systems on which society depends? The organisations best positioned for the next decade will be those that combine strong security fundamentals, independent assurance, and resilience. Connectivity will continue to grow. AI will move faster. The architecture around them must evolve just as deliberately.

---

Learn more about Fortinet’s approach to securing critical infrastructure and independent IEC 62443 certification.