An AI Cyber Defender Can Stop The Attack And Still Lose The Mission – OpEd

Key Takeaways:

• The author says the next AI-cyber failure may start after the find: an agent isolates a hospital backup, water plant, radio, or controller, the dashboard goes green, and the physical service dies. OT is not IT; NIST treats safety and uptime as peers of security. WEF: industrial AI is outrunning visibility.
• Design rule in the piece: mission-preserving containment—cut the attacker and keep the function. Split watch, reversible digital steps, and acts that can stop a pump. Pre-agreed local emergency moves; the detector must not be the only definer of a safe physical state. NSA/CISA and partners: humans on critical calls, fail-safes, tight privileges.
• Count defender-caused outages separately so metrics do not reward the fastest cut. Buy tests for bad comms, conflicting sensors, and missing bosses—not only detection scores. NIST is revising SP 800-82 (2026). A green panel is not a win if the lights or radios are out.

As AI agents gain authority to isolate devices, change configurations and patch networks, success cannot be measured only by whether the intrusion stopped. The defense must preserve the physical service the network exists to protect.

The next serious AI-cyber failure may not begin when an attacker gets in. It may begin after the attacker is found.

Imagine a defensive AI agent detects suspicious activity on a computer connected to a hospital’s backup power, a water-treatment process, a military communications link or an industrial control system. The agent does what its security objective rewards: it isolates the machine, revokes access or pushes a configuration change. The malicious path closes. The dashboard turns green.

Then the physical service stops.

This is a hypothetical scenario, but the underlying engineering problem is not. Security teams have always had to balance containment against availability. Agentic AI raises the stakes because a defensive system can investigate, decide and act across many assets at machine speed, potentially faster than a human operator can reconstruct the dependencies behind them.

That distinction deserves more attention as critical-infrastructure operators adopt AI. A recent World Economic Forum article argued that AI adoption in industrial environments is moving faster than security visibility in many of those environments. The important question is not simply whether AI can defend critical infrastructure. It is whether an automated defender can act without turning the defensive response into the outage.

The defender can become the incident

Cybersecurity often treats isolation as an obviously protective act. In ordinary information technology, disconnecting a compromised endpoint may be inconvenient but acceptable. Operational technology is different because the network may be controlling something physical: power, pressure, temperature, movement, communications or access.

NIST’s operational-technology security guidance explicitly treats performance, reliability and safety as requirements alongside cybersecurity. That means a technically correct cyber action can still be operationally wrong. A patch can require a restart at the wrong moment. A quarantine rule can sever the path to a controller. A credential revocation can remove the person who still needs local access to keep a process safe.

The failure is not that the cyber defender misunderstood malware. The failure is that it understood the network more clearly than it understood the mission.

Containment needs two objectives

A useful design principle is mission-preserving containment. Every automated response should pursue two objectives at once: close the attacker’s path and preserve the critical function the protected system exists to provide.

Those objectives can conflict. The safest move for a server may be to shut it down. The safest move for the physical process behind that server may be to keep a bounded local function running until operators can transfer control. A security architecture should therefore distinguish between observing a threat, making a reversible digital intervention and taking an action capable of interrupting an essential service.

The higher the operational consequence, the less reasonable it is to let the cyber layer make the decision in isolation. Before an AI defender receives authority over a consequential control path, the organization should know which physical or mission functions could be affected, which local procedures must remain available and who owns the decision when security and operational safety point in different directions.

This does not mean waiting for a distant executive every time an alarm fires. Local operators need pre-authorized emergency actions they can use when delay would itself create danger. The point is to design those boundaries in advance rather than discovering them during an incident.

The safety system must remain independent

There is a second rule: the system that detects the cyber threat should not be the only system allowed to define the safe physical state.

An AI agent may help interpret an alarm, identify a suspicious connection or recommend a change. But the same assessment should not automatically be able to disable an independent protective function, rewrite the conditions under which dangerous equipment keeps operating or remove every manual path to intervention.

Joint guidance issued by the NSA, CISA and international partners on integrating AI into operational technology calls for human participation in critical decisions and fail-safe mechanisms that limit the consequences of failures. More recent international guidance on the careful adoption of agentic AI similarly recommends incremental deployment, strict privilege controls, continuous monitoring and human oversight, particularly for government and critical infrastructure.

The operational implication is straightforward: a cyber defender can have broad visibility without receiving equally broad authority to change physical systems. Observation and intervention do not need the same credential.

Count the harm caused by the defense

Incident reporting also needs to change. A report that records only what the attacker disrupted can miss half the event.

Organizations should separately record disruption caused by the defensive response: which services were interrupted by isolation, which users lost access after emergency revocation, whether a configuration change forced manual fallback, and whether the response transferred risk from the network to a physical process.

This matters because otherwise the metrics can reward the wrong behavior. A cyber agent that blocks malicious traffic instantly may appear superior even if it repeatedly disconnects legitimate operators or interrupts critical equipment. A slower response may be safer if it contains the threat while preserving the service.

The distinction also improves learning. If investigators cannot separate attacker-caused damage from defender-caused damage, the next version of the system may be trained to repeat the same operational mistake more efficiently.

Procure for mission survival, not only detection

The same discipline belongs in procurement. Vendors can demonstrate how quickly an AI defender discovers vulnerabilities, classifies anomalies or pushes remediation. For critical systems, buyers should also ask a harder question: what happens to the mission when the defender is wrong, partially right or forced to act with incomplete information?

Representative testing should include degraded communications, conflicting sensor information, unavailable remote supervisors and dependencies that are not obvious from the network map. The objective is not to prove that no failure is possible. It is to show that a defensive mistake does not automatically become a physical or mission failure.

This is especially timely because the OT security baseline itself is still evolving. NIST began work in 2026 on the next revision of SP 800-82 to address changes in the operational-technology threat landscape. Agentic defense should be treated as part of that changing landscape, not simply as another endpoint-security product.

A green dashboard is not victory

The security industry has spent years learning that confidentiality and integrity are not enough; availability also matters. Agentic AI adds another layer: availability of the network is not enough if the physical mission behind it has become unsafe or unusable.

The best AI cyber defender will not be the one that acts most aggressively or produces the fastest remediation count. It will be the one whose authority is narrow enough, whose operational dependencies are understood well enough and whose fallback paths are tested well enough that stopping an attack does not stop the mission.

A green security dashboard is not victory if the lights, pumps, radios or safety systems it was meant to protect have gone dark.