By John Moore, CEO, ITRoundTable, Inc.
Every vendor pitch this year promises AI will finally solve OT threat detection. In our roundtable conversations, Fortune 1000 security leaders keep circling back to the same question: is this genuinely changing how we defend our environments, or is it another layer of tooling we’ll be maintaining without a clear return?
Both reactions are fair. And having spent the past several months listening to the executives who make up our roundtable community — and comparing notes against the findings in our April 2026 Executive Insights Report — I’ve landed somewhere in the middle, which is probably not the answer anyone wants from an article titled “genuine breakthrough or expensive hype.”
Where AI genuinely helps:
- Anomaly detection across high-volume sensor and telemetry data, where human analysts can’t keep pace
- Flagging unusual protocol behavior on ICS/SCADA networks faster than signature-based tools
- Reducing alert fatigue by prioritizing what actually needs eyes on it
- Surfacing patterns across dispersed sites that would otherwise take a human team weeks to correlate manually
Where the hype outruns reality:
- AI still struggles with legacy OT environments that lack clean baseline data to learn from
- False positives remain costly in environments where downtime equals real-world safety risk
- No AI tool replaces the judgment needed to interpret IEC 62443 or NERC CIP compliance context
- Vendors rarely account for the integration lift required to get a model working with decades-old plant infrastructure
The honest middle
So where does that leave us? My own read, informed by these conversations, is that AI is real technology solving a real, narrow set of problems in OT security today — mostly around noise reduction and pattern recognition in monitoring — and it is not yet the broad threat-detection transformation the marketing suggests. The gap between those two claims is exactly where the hype lives.
The executives navigating this well seem to share a few habits: they pilot against a specific, bounded problem rather than a platform promise. They ask vendors to show false-positive and false-negative rates in their own environment, not a generic benchmark. And they treat explainability as a requirement, not a nice-to-have — because in OT, the cost of a wrong answer is measured in more than dollars.
I’d rather our members make that call with clear eyes than either dismiss the category outright or buy the pitch deck as written. That’s really the purpose of these roundtables — a room where you can say “I don’t think this is working the way the vendor claims” and have a dozen peers who’ve tested the same claim compare notes with you.
If you’re weighing an AI-driven OT security investment right now, I’d genuinely like to hear where you’ve landed — what’s worked, what hasn’t, and what questions you’re asking vendors before you sign.
Where has AI actually earned its place in your OT security stack, and where are you still skeptical?
#OTSecurity #ICSSecurity #CriticalInfrastructure #ITOTConvergence #CyberSecurityLeadership
John Moore is CEO of ITRoundTable, Inc., a nonprofit association facilitating private peer roundtables for Fortune 1000 IT, OT, and AI security executives. Insights referenced in this article draw from ITRoundTable’s April 2026 Master Executive Insights / Best Practices Report: “Securing the Connected Industrial Enterprise.”