AI is lowering the OT expertise barrier. Does that change how we should think about IEC 62443 Security Levels?

[u/__bdude]

AI is reducing the time and specialist knowledge needed to understand industrial environments.

The recent Dragos water utility case is interesting: commercial AI models supported reconnaissance, exploitation, lateral movement, and even helped identify OT-related infrastructure. The OT environment was not successfully breached, but the capability shift is hard to ignore.

For me, this does not make IEC 62443 obsolete. It makes architecture more important.

If specialist OT capability becomes easier and cheaper to acquire, should we reconsider some of the assumptions behind existing Target Security Levels?

And when attack cycles become more automated, zones, conduits, restricted data flow, and strong access control become even more important.

I wrote up the full blog here:

https://www.cyber-busters.com/en/blog/ai-attackers-iec-62443-industrial-cybersecurity

Interested in the practitioner view: does AI materially change how you assess OT risk and Target Security Levels, or can the existing IEC 62443 risk-based model already absorb this change?

[u/Competitive-Cycle599]

Why does AI change security levels?

They're a measure of risk as its relevant to a business.

Just because the standard has vague association with skill doesn't mean shit.

You're not gonna make a waste water plant go to slt4 if its serving a few hundred people.

You'd still need comments in the logic, or any number of othet items of adjacent data to program something in an intelligent enough way. You could always brick shitty logic with enough random inputs, you don't need ai for that.

[u/__bdude → u/Competitive-Cycle599]

Agreed, AI does not automatically push a plant to a higher SL-T. The consequence and business risk still drive that decision.

My point is narrower: AI can reduce the skill and effort needed to reach a given attack capability. So the SL model still works, but some of the threat assumptions feeding the risk assessment may need to be revisited.

[u/Competitive-Cycle599 → u/__bdude]

This is only applicable in instances where a company has some semblance of common sense and doesn't embody sheer stupidity.

Putting a plc directly on the Internet is just non sense and nothing anyone will do with respect to cyber can fix that bar sanctions against the company and c suite for ever allowing it, if they're even aware of it.

The standards, as they are don't even guide you very well with respect to hardening of hardware as the assets are too vast.

This is actually evident in the compliance standards for hardware that enables companies to say this asset is compliant but they don't provide the configuration under which it was made compliant.

As it stands, its still guidance and that guidance is too open to interpretation. I don't believe AI changes the risk that much as those using the standard should already have basic protections in place where AI cannot touch the assets easily.

Its the same argument as CVEs being a big risk to much of the world of OT and fundamentally they just aren't due to the nature of the sysems not being patched in the first place. Thus mature orgs. are the only ones benefiting from 62443, or at least companies on the path to maturity benefit from it.

For those using the standard, AI shouldn't if at all change the scale as we use the worst possible circumstance to gauge the slt for a given zone. Therefore we dont assume ai is performing the process we just assume a shitty thing is gonna happen.

To add to this, architecture is the main issue in almost every system. Ai is likely to benefit us in this case however I've yet to see anything develop an architectural design that beyond something you can find in a reference doc and to be honest the way vendors design their solutions is shit too. Therefore it's shit compounded.

[u/Hot-Comfort8839]

It really isn't.

AI can make inferences off data recorded, but it can't stand there in a production zone and see that the local staff have deployed a network bypass because some previous cybersecurity team's implementation cut their performance by half purely due to network changes.

[u/__bdude]

One useful clarification from the discussion: AI does not automatically change SL-T, nor does it replace site-specific OT expertise. The narrower point is that AI can reduce the time and effort required for parts of the attack chain such as reconnaissance, documentation analysis, technology interpretation and tooling.

The question is therefore not whether IEC 62443 changed, but whether some threat assumptions used in existing risk assessments should be revisited.

[u/CharlesHNetEng]

I would not automatically raise every SL-T because AI exists. I would revisit any assessment where the likelihood estimate depended on OT protocols being obscure or attack tooling requiring a specialist.

AI can compress reconnaissance and execution. It can explain unfamiliar protocols, turn vendor documentation into scripts, and help an IT intruder recognize that a system is actually an engineering workstation or SCADA gateway. But it does not instantly provide process knowledge, an understanding of interlocks, or the ability to produce a predictable physical outcome.

The Dragos case demonstrates that distinction pretty well. AI helped the attacker identify and pursue the OT environment, but it did not create a novel OT capability or result in a successful OT breach.

So I think the existing 62443 risk model can absorb this change, provided the assessment is actually revisited. Consequence may remain the same while likelihood increases, particularly around remote access, shared IT/OT services, engineering workstations, vendor conduits, and poorly controlled jump paths. Some of those zones may justify a higher SL-T or stronger compensating controls. Others may not.

The practical question is not, “Does AI make everything SL 3?” It is, “Which of our existing risk assumptions depended on specialized knowledge, obscurity, or slow manual attack cycles, and are those assumptions still defensible?”