Cyber Security Month: Guiding the AI Horses Where You Want to Go

The first post in this Cyber Security Month blog series examined where AI already lives inside a utility, and the second fenced the field, describing where an AI model may sit on the network, and who approves what it produces. With the horses safely reined in, the next question is which way to point them for maximum benefit to your organization.

As the UK National Cyber Security Centre (NCSC) explained in a September 2026 blog post, defenders find AI harder to use than attackers do. An attacker's problems are mostly technical, with a clear test of success. A defender's problems are mostly organizational; somebody has to answer for every action taken. Defenders cannot put AI to work the way attackers do. As the NCSC states: “Technology is behind the detection, but humans respond with actions.”

Defensive Use Cases

The NCSC suggests starting with low-potency work, where AI advises a person instead of changing a system directly. IBM's Cost of a Data Breach Report 2026 put the savings from extensive use of AI and automation in security at $1.93M USD compared to organizations using none across the breached organizations studied with the Ponemon Institute. In each of the use cases below, a human makes the final decision.

Log Triage and Alert Enrichment

The NCSC notes that AI summarizes text exceptionally well and already helps defenders work through large volumes of reports and threat intelligence. Pointed at the alert queue, a model can group related alerts, describe each cluster with the raw events attached, and rank what the analyst should investigate first.

Enrichment is where a utility's own internal context generates tailored insight. The model can attach the asset owner, data tier, network zone, open CVEs and the last change ticket before the analyst opens the alert, all pulled directly from your asset inventory. The analyst still decides what happens next, and the logs remain within a tool cleared for their data tier.

AI Detection and Response

One essential defensive job is watching AI itself. AI Detection and Response (AIDR) is an emerging product category that monitors what employees type into AI tools, the responses they receive, and how AI agents interact with connected tools and systems. CrowdStrike, for one, made Falcon AIDR generally available in December 2025, providing runtime logs of how employees use AI and how agents operate.

Figure 1 shows how AIDR applications work in utility networks.

The NCSC's blog on prompt injection asks for this level of evidence, down to model inputs, outputs, and tool calls, while warning against any product claiming to stop prompt injection outright. Treat AIDR as both a sensor and a brake.

Phishing and Deepfake Detection

The old red flags are gone. IBM's 2026 report recorded a 56% increase in AI-driven attacks, led by deepfake impersonation and AI-enabled malware. On the email front, a model can read a reported message, check the sender, links, and attachments against threat intelligence, and draft a verdict for the analyst. Under the guardrails below, however, it cannot delete, forward or reply on its own.

Voice and video need a second layer. The 2023 deepfake guidance from the National Security Agency (NSA), the Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) recommends real-time verification, passive detection and protection for high-priority officers, along with rehearsed responses.

Try it yourself: play the three clips below and decide which voice you think is real.

Tabletop Drafting and Code Review

Because language models excel at drafting text, use them to build tabletop exercises. CISA's Tabletop Exercise Packages include cyber scenarios for ransomware, phishing and ICS compromise, complete with a water sector package. A model can adapt these templates to your specific roles, sites and vendor contacts to produce a unique set of tabletop scenarios, such as a deepfake call demanding an urgent change while an AI-assisted system goes down.

Code review follows the same pattern. In the finals of DARPA's AI Cyber Challenge in August 2025, competitors' systems discovered 86% of the synthetic vulnerabilities and patched 68%, while teams found 18 real, non-synthetic vulnerabilities. In a utility, similar models can scan in-house scripts, integration code and vendor patches as an additional testing suite. An engineer reviews and merges the code only after verifications are complete. Nothing the model writes goes straight to a controller without a human in the loop.

Figure 2 places each of these jobs on the NCSC's scale, from advice a person acts on to direct changes to a system.

Turn Their Recon Against Them

Our AI blog series showed how AI made reconnaissance cheap, turning a utility's own published materials into intelligence for external research. Fortunately, the same tools work in both directions.

In May 2025, CISA, the FBI, the EPA and the Department of Energy warned that exposed OT is “quickly found by searching for open ports on public IP ranges with search engine tools.” They urged operators to identify their public-facing assets and remove exposure nobody intended. Attackers are already running these searches against you; run it first to see how exposed your footprint is.

Censys reported in September 2026 that approximately 70% of the roughly 134,000 internet-exposed ICS hosts observed globally sit on consumer and mobile networks, where registration data often points to the carrier. A researcher finding an exposed controller there might only reach the carrier, meaning the utility running it may never know. Furthermore, CISA's 30 July 2026 alert for the water and wastewater sector noted that cellular modems installed by operators, vendors or integrators may be undocumented and missed by routine scans.

CISA's Internet Exposure Reduction Guidance establishes a clear order: assess what is exposed, decide what needs to be reachable online, protect what must stay exposed, and repeat the process on a regular schedule. It highlights search platforms like Shodan, Censys and Thingful, while CISA's Cyber Hygiene service offers free vulnerability scanning.

AI earns its place by sorting through these results. It can match search results against the asset inventory and flag every host that is missing, which is how an undocumented host surfaces. It can analyze your public footprint, from procurement records and interconnection filings to conference talks and job postings, and flag any mentions of controllers, firmware versions or network details. From there, a human in the loop makes the necessary decisions.

Guardrails

If the model makes a mistake, or someone steers it maliciously, what can it touch? Strict limits must be set to prevent AI from any possible overstepping.

Placement:
The joint guidance on AI in operational technology from CISA, the NSA and their partners, published in December 2025, instructs operators to push data from the OT environment to a separate, isolated AI system where appropriate, keeping a human in the loop for critical decisions. Defensive AI reads copies within the business layer and offers advice. Nothing it produces reaches a setpoint, a protection setting, or a switching order.

Privilege:
Meta's Agents Rule of Two states that within one session, an agent should have no more than two of three properties: processing untrustworthy input, accessing sensitive systems or private data, or changing state or communicating externally. Needing all three necessitates human approval. For example, a phishing triage agent could read untrusted mailboxes but cannot delete, forward, or reply on its own; it would require a human to finalize the assessment.

Design:
The NCSC maintains that prompt injection may never be totally mitigated the way SQL injection can; therefore, it points to deterministic, non-AI limits on what the system can do, privileges that drop to the level of whoever wrote the content being read, and logs of inputs, outputs and tool calls.

Review:
As noted throughout our AI blog series, AI output is raw material, and the person submitting the work ultimately owns it. Keep the agent's reasoning visible, sample closed tickets and always include a human reviewer.

When pointed at reading, sorting and drafting, AI earns its valuable spot on the defender's team. The final post in this series covers the build: where AI models sit, how to control the data leaving for external AI services, how to harden the model layer, and which records to keep for an audit.

Guided well, the horses pull their weight, but someone must always hold the reins.

References